# AI governance help in New Zealand.

URL: https://levystreet.com/compare/ai-governance-consultants-nz/
Updated: 2026-10-19

AI governance in NZ: law firms, consultancies and ISO/IEC 42001 certification compared, with what each offers, published proof and the NZ rules that apply.

## Short answer

New Zealand AI governance help comes from Levy Street (Wellington), law firms such as Russell McVeagh, Bell Gully and MinterEllisonRuddWatts (Auckland and Wellington) and Simpson Grierson, consultancies such as NSP (Auckland) and Simply Privacy, and BSI for ISO/IEC 42001 certification. Choose by the question you need answered: a lawyer for legal advice, a certification body for a certificate, and an operational adviser for the policy, register and monitoring.

- New Zealand has no AI-specific act; MBIE says existing privacy, consumer and human rights law applies.
- Choosing rule: lawyers for legal advice, BSI for certification, operational advisers for day-to-day controls.
- Since 1 May 2026, IPP 3A generally requires notice when personal information is collected from someone else.
- Levy Street wrote this guide, is listed first and does not give legal advice.
- Of the ten providers listed, only BSI published a price, for ISO/IEC 42001 training.

AI governance means deciding in writing which AI you use, for what, with which information, who owns each system and how mistakes are caught. This guide lists New Zealand providers who help, and which kind of help answers which question.


Levy Street wrote this guide and is one of the providers in it, listed first because this is our site. Every other provider's details come from its own website, checked on 20 October 2026. No provider paid to be included. If something here is wrong or out of date, [tell us](/contact/) and we will fix it.


## New Zealand AI governance providers compared

| Provider | Based in | What it says it offers | Published proof | Prices published | Suits |
|---|---|---|---|---|---|
| Levy Street | Wellington, works nationally | AI register, use policy, risk tiers, privacy impact assessments, board reporting | Portfolio; free policy and risk register templates | No | Organisations with AI in use or being built |
| Bell Gully | Auckland, Wellington | Law firm: AI governance frameworks, board reporting, procurement | Named AI Lead partner; describes its own AI governance group | No | Legal advice and board reporting |
| BSI | NZ site of a global certification body | ISO/IEC 42001 training, pre-certification assessment and certification | Lists UKAS, RvA and ANAB accreditation for ISO/IEC 42001 | Yes, one-day course $995 (as listed) | Organisations seeking a certificate |
| Deloitte New Zealand | NZ member firm | Governance, trust and regulatory advisory for AI agents | Trustworthy AI framework; published research | No | Large organisations |
| EY New Zealand | NZ member firm | Responsible AI services: governance framework, readiness assessment, training | Named client case study | No | Large and regulated organisations |
| MinterEllisonRuddWatts | Auckland, Wellington | Law firm: governance frameworks, AI use policies, procurement, privacy | Anonymised matters; named client (Autohive) | No | Legal advice for regulated organisations |
| NSP | Auckland | AI acceptable use policy, risk register, staff training, 12-month programme | None on the service page | No | Small businesses linking AI to cyber insurance |
| Russell McVeagh | Auckland, Wellington | Law firm: governance frameworks, policies and controls | Anonymised matters | No | Boards and listed companies |
| Simply Privacy | NZ (city not stated) | Responsible AI frameworks, algorithmic impact assessments, AI audits | Named testimonials | No | Privacy-led governance, public sector |
| Simpson Grierson | Auckland, Wellington, Christchurch | Law firm: AI advice; help developing or reviewing AI use policies | Published AI governance series | No | Legal review of an AI use policy |

## Legal advice, certification or day-to-day governance?

Most organisations need some of each, from different providers.

| Kind of help | Typical provider | What you get | When you need it |
|---|---|---|---|
| Legal advice | Law firms | Advice on obligations, contracts and liability; policy review | AI touching customers, staff decisions, regulated work or vendor contracts |
| Certification | Certification bodies such as BSI | ISO/IEC 42001 training, an independent audit and a certificate | Customers, tenders or regulators ask for evidence |
| Operational governance | Consultancies and AI engineers, including Levy Street | A register, a short policy, risk tiers, impact assessments and monitoring | As soon as staff use AI tools, and before any system acts on its own |

A certificate shows a management system exists, not that a given chatbot behaves. A policy says what should happen; logs and permission limits make it happen.

## Provider profiles

### Levy Street
Levy Street is a Wellington AI engineering and advisory company whose [AI governance advisory](/services/ai-governance/) produces an AI register, a use policy, risk tiers, privacy impact assessments for the riskiest systems, an approval workflow and board reporting, tested on two live systems before rollout. Our engineers build controls such as access limits and logging into the systems. We work alongside your lawyers and do not give legal advice or certify compliance. See the [property management agent for APL Property](/portfolio/property-management-agent/), designed so staff keep every decision.

### Bell Gully
Bell Gully is a law firm with offices in Auckland and Wellington whose [AI practice](https://www.bellgully.com/our-firm/artificial-intelligence/) advises on AI governance frameworks and board reporting, AI procurement and AI in workplace decisions. It has a partner designated as AI Lead and describes its own AI use policy and governance group.

### BSI
BSI's New Zealand site offers [ISO/IEC 42001 services](https://www.bsigroup.com/en-NZ/products-and-services/standards/iso-42001-ai-management-system/) from the standard and training through pre-certification assessment to certification. Its one-day [ISO/IEC 42001 requirements course](https://www.bsigroup.com/en-NZ/training-courses/isoiec-420012023-artificial-intelligence-requirements-training-course/) was listed at $995 as a virtual classroom, with in-house delivery available.

### Deloitte New Zealand
Deloitte New Zealand's [agentic AI services](https://www.deloitte.com/nz/en/what-we-do/capabilities/agentic-ai.html) include strategy with pragmatic governance, trust, legal and regulatory advisory, and governance and trust implementation, founded on its Trustworthy AI framework. It also publishes [research on AI governance](https://www.deloitte.com/nz/en/Industries/consumer/analysis/trustworthy-artificial-intelligence.html).

### EY New Zealand
EY New Zealand's [Responsible AI services](https://www.ey.com/en_nz/services/ai/responsible-ai) include a GenAI governance framework, a Responsible AI Readiness Assessment and training programmes, and feature a case study on a governance framework built for Mott MacDonald.

### MinterEllisonRuddWatts
MinterEllisonRuddWatts, a law firm with offices in Auckland and Wellington, has an [AI advisory practice](https://minterellison.co.nz/expertise/services/technology/ai-advisory) that helps boards set governance frameworks, develops and reviews AI use policies, and advises on procurement and privacy. Its published matters include governance work for an NZX-listed agribusiness.

### NSP
NSP is an Auckland managed IT and cyber security provider whose [AI governance and compliance service](https://nsp.co.nz/modern-workplace/ai-governance-compliance/) gives small businesses an AI acceptable use policy, a risk register, staff training records and a governance structure, mapped to frameworks including the NIST AI Risk Management Framework and ISO/IEC 42001. Its 12-month programme includes an evidence pack for cyber insurers.

### Russell McVeagh
Russell McVeagh, a law firm with offices in Auckland and Wellington, [helps organisations develop governance frameworks for AI](https://www.russellmcveagh.com/our-expertise/artificial-intelligence-ai/), including policies, controls and decision-making structures. Its September 2026 board handbook, [AI governance: A practical framework](https://www.russellmcveagh.com/insights-news/ai-governance-a-practical-framework/), is available on request.

### Simply Privacy
Simply Privacy is a New Zealand privacy and AI governance consultancy whose [services](https://simplyprivacy.co.nz/services/) include Responsible AI frameworks, algorithmic impact assessments, AI health checks and independent AI audits. It says it is an approved supplier on the government Marketplace and publishes testimonials from Stats NZ and Foundation North.

### Simpson Grierson
Simpson Grierson, with offices in Auckland, Wellington and Christchurch, advises on AI through its [digital, new technologies and AI practice](https://www.simpsongrierson.com/what-we-do/focus-industries/digital-new-technologies-ai-law). Its [AI governance series](https://www.simpsongrierson.com/insights-news/legal-updates/ai-governance-series-part-two-getting-ai-governance-right-start-with-an-effective-ai-use-policy) sets out what an AI use policy should cover, and its team offers help developing or reviewing one.

## How to choose AI governance help

Know which question you need answered, then ask any provider, including us:


- Who owns the policy and register when the engagement ends?
- Will you test the rules against one of our real tools or systems?
- Do you cover the Privacy Act 2020, including IPP 3A, and our sector's rules?
- Who turns rules into technical controls such as access limits, logging and approval steps?
- Is the output sized to us: a two-page policy for a 12-person firm, not a 60-page framework?
- What does a yearly review cost?


For a view on where you stand, book a [short assessment conversation](/contact/?topic=assessment). Our free [AI use policy template](/resources/ai-use-policy-template-for-nz-smbs/) and [AI risk register template](/resources/ai-risk-register-template/) are a start before you pay anyone.

## Where AI governance goes wrong

- **A policy nobody follows.** Principles with no owner, register or incident log protect nobody. Our lesson on [creating a team AI use policy](/learn/creating-a-team-ai-use-policy/) keeps it short.
- **Paper controls on systems that act.** A rule that an agent must not send money means little unless it lacks permission to. Controls belong in the system, which is why governance links to [AI security reviews](/services/ai-security-review/).
- **Certification as the goal.** An audit can pass while a live tool still gives customers wrong answers.
- **One-off assessments.** Vendors change models and terms often; every assessment needs a review date.

## The New Zealand rules governance has to cover

As at October 2026, New Zealand regulates AI through existing law. MBIE's [AI Strategy](https://www.mbie.govt.nz/assets/new-zealands-strategy-for-artificial-intelligence.pdf) (July 2025) describes "a light-touch and principles-based approach", and its [Responsible AI Guidance for Businesses](https://www.mbie.govt.nz/assets/responsible-ai-guidance-for-businesses.pdf) is voluntary. That guidance reminds businesses that anyone handling personal information must have a privacy officer.

- **Privacy Act 2020.** The Privacy Commissioner's [starting point](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ai/) is that the Act applies to everyone using AI tools in New Zealand. Its [AI guidance](https://www.privacy.org.nz/assets/New-order/Resources-/Publications/Guidance-resources/AI-Guidance-Resources-/AI-and-the-Information-Privacy-Principles.pdf) expects a privacy impact assessment before AI tools are used and human review before acting on outputs.
- **IPP 3A.** Since 1 May 2026, an organisation that collects personal information from someone other than the person must generally take reasonable steps to [tell them](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ipp3a/), as soon as reasonably practicable. That can include AI tools that enrich records about people.
- **Public sector work.** The [Public Service AI Framework](https://www.digital.govt.nz/standards-and-guidance/technology-and-architecture/artificial-intelligence/public-service-artificial-intelligence-framework) is advisory for agencies, not binding, but suppliers should expect questions shaped by it.
- **Free local frameworks.** AI Forum New Zealand's [AI Governance Pathways](https://aigovernance.aiforum.org.nz/) scale governance to size and risk.

## Questions people ask

### Who can help a New Zealand company develop an AI use policy and governance plan?

Several kinds of provider. Levy Street (Wellington) builds the operational side: an AI register, use policy, risk tiers and privacy impact assessments tested on real systems. Law firms including Russell McVeagh, Bell Gully, MinterEllisonRuddWatts and Simpson Grierson advise on AI governance frameworks and use policies. NSP (Auckland) and Simply Privacy offer governance consulting, and BSI certifies against ISO/IEC 42001. Many organisations use an adviser to draft and a lawyer to review.

### Does New Zealand have AI regulation businesses must follow?

There is no AI-specific act. MBIE's July 2025 AI Strategy describes a light-touch, principles-based approach that relies on existing privacy, consumer protection and human rights law, and MBIE's Responsible AI Guidance for Businesses is voluntary. The Privacy Commissioner's position is that the Privacy Act 2020 applies to everyone using AI tools in New Zealand, and it expects a privacy impact assessment before AI tools are used. Since 1 May 2026, IPP 3A also applies. Take legal advice on your situation.

### Should we go to a law firm or a consultancy for AI governance?

It depends on the question. Go to a law firm when you need advice on obligations, liability, contracts with AI vendors or board duties. Go to an operational adviser when you need the working parts: a list of AI in use, a short policy staff will follow, risk tiers, monitoring and an incident routine. The two fit together: an adviser drafts and tests, a lawyer reviews what carries legal risk.

### Do we need ISO/IEC 42001 certification?

Usually only if customers, tenders or regulators ask for it. ISO/IEC 42001 is the international standard for an AI management system, and certification bodies such as BSI audit against it; BSI's New Zealand site lists training, pre-certification assessment and certification. A certificate shows a management system exists. It does not show that a particular chatbot or agent behaves safely, so the register, testing and monitoring still matter.

### Is there free or funded help with AI governance in New Zealand?

Yes. MBIE's Responsible AI Guidance for Businesses and the Privacy Commissioner's AI guidance are free. AI Forum New Zealand publishes free AI Governance Pathways, Simply Privacy offers free awareness modules, and Levy Street publishes a free AI use policy template and risk register template. The government's AI Advisory Pilot co-funds up to 50% of an AI roadmap and its implementation for eligible small businesses until 30 June 2027.


## Sources

- [Artificial Intelligence](https://www.bellgully.com/our-firm/artificial-intelligence/)
- [ISO 42001 AI management system](https://www.bsigroup.com/en-NZ/products-and-services/standards/iso-42001-ai-management-system/)
- [ISO/IEC 42001:2023 Artificial Intelligence Requirements course](https://www.bsigroup.com/en-NZ/training-courses/isoiec-420012023-artificial-intelligence-requirements-training-course/)
- [Agentic AI services](https://www.deloitte.com/nz/en/what-we-do/capabilities/agentic-ai.html)
- [AI at a crossroads: building trust as the path to scale](https://www.deloitte.com/nz/en/Industries/consumer/analysis/trustworthy-artificial-intelligence.html)
- [Responsible AI services](https://www.ey.com/en_nz/services/ai/responsible-ai)
- [AI advisory](https://minterellison.co.nz/expertise/services/technology/ai-advisory)
- [AI governance and compliance](https://nsp.co.nz/modern-workplace/ai-governance-compliance/)
- [Artificial Intelligence / AI](https://www.russellmcveagh.com/our-expertise/artificial-intelligence-ai/)
- [AI governance: A practical framework](https://www.russellmcveagh.com/insights-news/ai-governance-a-practical-framework/)
- [Services](https://simplyprivacy.co.nz/services/)
- [Simply Privacy home](https://simplyprivacy.co.nz/)
- [Digital, new technologies and AI](https://www.simpsongrierson.com/what-we-do/focus-industries/digital-new-technologies-ai-law)
- [AI Governance Series: Part Two, start with an effective AI use policy](https://www.simpsongrierson.com/insights-news/legal-updates/ai-governance-series-part-two-getting-ai-governance-right-start-with-an-effective-ai-use-policy)
- [Contact us (offices)](https://www.simpsongrierson.com/contact-us/auckland-lawyers)
- [AI Governance Pathways](https://aigovernance.aiforum.org.nz/)
- [New Zealand's Strategy for Artificial Intelligence: Investing with confidence](https://www.mbie.govt.nz/assets/new-zealands-strategy-for-artificial-intelligence.pdf)
- [Responsible AI Guidance for Businesses](https://www.mbie.govt.nz/assets/responsible-ai-guidance-for-businesses.pdf)
- [Artificial intelligence](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ai/)
- [Artificial intelligence and the Information Privacy Principles](https://www.privacy.org.nz/assets/New-order/Resources-/Publications/Guidance-resources/AI-Guidance-Resources-/AI-and-the-Information-Privacy-Principles.pdf)
- [IPP 3A](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ipp3a/)
- [Privacy Act 2020](https://www.legislation.govt.nz/act/public/2020/31/en/latest/)
- [Public Service AI Framework](https://www.digital.govt.nz/standards-and-guidance/technology-and-architecture/artificial-intelligence/public-service-artificial-intelligence-framework)
- [AI Advisory Pilot Programme: explore AI for your business](https://www.business.govt.nz/strategy-and-performance/regional-business-partner-network/ai-advisory-pilot-programme-explore-ai-for-your-business)

Published by Levy Street (https://levystreet.com), Wellington, New Zealand.