AI governance advisory.

What AI governance means in New Zealand

AI governance is deciding, in writing, which AI your organisation uses, for what purpose, with which information, who owns each system and how errors are caught. In New Zealand it sits on top of existing law rather than an AI act: the Government’s AI Strategy (July 2025) takes “a light-touch and principles-based approach” and relies on privacy, consumer protection and human rights law. MBIE’s Responsible AI Guidance for Businesses is voluntary.

Light-touch regulation does not mean light obligations. The Privacy Commissioner expects a privacy impact assessment before AI tools are used, and human review before acting on AI output. Most organisations have not caught up: in Datacom’s 2025 survey of larger NZ organisations, 55% had an internal AI policy but only 29% had formal ethics or safety guidelines, and 52% called unapproved “shadow AI” a problem (Datacom).

Who needs governance help

• Staff are already using AI on personal accounts and nobody has said what is allowed.
• A board or regulator is asking. The Reserve Bank and FMA told regulated entities on 15 October 2026 that boards “need to know where AI is being used in their business” and who is accountable (RBNZ).
• AI is about to touch customers or decisions about people, such as support replies, screening or eligibility.
• You are building agents that can act in your systems, where a policy alone will not stop a mistake.

What we deliver

AI register

Every AI tool and system in use, its owner, purpose, data, vendor, processing location and risk tier, kept in a format like our AI risk register template.

Use policy

Approved tools and plans, information that must never be entered, review rules and how to report a mistake. Our AI use policy template for NZ small businesses shows the shape.

Risk tiers

A short rule for sorting uses into low, medium and high risk, with the checks each tier requires.

Privacy impact assessments

Completed for your highest-risk systems, with a lighter template for the rest.

Approval workflow

How a new tool or use gets proposed, assessed and approved, with a target turnaround.

Incident routine

What counts as an AI error, who is told, and when a privacy breach notification may be needed.

Board reporting

A one-page quarterly view of systems, incidents, costs and changes.

How the work runs

1. Discover: find the AI already in use. We interview team leads, check single sign-on and expense records for AI subscriptions, and map where personal and confidential information flows. This is where tools nobody approved come to light.
2. Prove: test the rules on real systems. We draft the policy and risk tiers, then run them against two live cases, typically one bought tool and one built system, including a full privacy impact assessment. Rules that cannot be applied in practice get rewritten.
3. Scale: embed and hand over. Owners are named, the approval workflow goes live, staff are briefed, and the first board report is produced. We can stay on for quarterly reviews or hand everything to your team.

Ownership is part of the output. The senior owner holds the policy and register. Your privacy officer, whom every organisation handling personal information must appoint under section 201 of the Privacy Act, signs off privacy assessments. Each system has a business owner who answers for its output, and engineering owns the technical controls: access, logging and the switch that turns it off. We write, test and embed these arrangements. We do not give legal advice or certify compliance, and we work alongside your lawyers where a question needs one.

The New Zealand rules your governance has to cover

Sector rules sit on top: financial services, law, real estate, health and education regulators have all issued AI guidance. Our industry pages list them by sector.

Which framework to use

Most organisations do not need a formal framework; they need a register, a policy and proportionate assessments. When you want structure, we map to one of these:

• NIST AI Risk Management Framework. Voluntary, released January 2023, built around four functions: Govern, Map, Measure and Manage. NIST says a revision is in progress (NIST).
• ISO/IEC 42001:2023. The international standard for an AI management system. Certification is voluntary and done by independent bodies; ISO itself does not certify (ISO).
• AIGovernance.nz. AI Forum New Zealand’s free framework and toolkit site (AI Forum), a sensible local starting point for small organisations.

What it costs

Cost depends on how many teams and systems are in scope, whether AI already touches customers or decisions about people, how many privacy assessments need full treatment, and whether you want ongoing reviews. A single-team policy and register is a small piece of work; a regulated organisation with several live systems is not. Our guide to what custom AI projects cost explains how we scope fixed pieces of work.

Where governance goes wrong

• Banning everything. Staff move to personal accounts and the organisation loses sight of its data. Approve good tools on business plans instead.
• Policy without enforcement. A rule that an agent “must not send money” is worthless unless the agent has no permission to do it. Controls belong in the system, which is why governance links to our AI security reviews.
• One-off assessments. Vendors change models and terms often. Assessments need a review date.
• Theatre. Long principle statements with no owners, no register and no incident log protect nobody.

Work this draws on

• Property management agent for APL Property: an internal agent for a regional NZ property firm, designed so staff keep every decision and the agent handles routine administration.
• PainPal: Levy Street worked with BetterWorx on this AI workmate, which answers workers from expert-reviewed guidance while employers see only anonymised insights.

Written by the Levy Street team in Wellington. Last updated 19 October 2026.