Contact usGet started

Frameworks · New Zealand

AI governance frameworks and AI rules in New Zealand

New Zealand has no AI-specific law. It governs AI through the Privacy Act 2020, the Privacy Commissioner's guidance and the binding Biometric Processing Privacy Code, with voluntary MBIE guidance for businesses and public sector frameworks for government agencies.

Who regulates AI here

New Zealand

New Zealand relies on the Privacy Act and public sector commitments to govern algorithms and AI.

Public sector policyNZ Public Service AI FrameworkNew Zealand Public Service AI FrameworkNew Zealand's Public Service AI Framework sets five principles and six pillars for AI use across public service agencies. Agencies are encouraged, not bound.Published January 2025 (last updated 29 January 2025). Non-binding. Agencies are encouraged to align.Public sector policyNZ Algorithm CharterAlgorithm Charter for Aotearoa New ZealandNew Zealand's Algorithm Charter sets six commitments for government agency algorithms that affect people, applied through a likelihood and impact risk matrix.Published July 2020. Voluntary commitment for government agencies, with current signatories listed by Stats NZ.LawNZ Biometric Processing Privacy CodeBiometric Processing Privacy Code 2025 (New Zealand)New Zealand's Biometric Processing Privacy Code 2025 sets 13 rules for facial recognition and other biometric AI, with limits on inferring emotion and health.Issued 21 July 2025. In force 3 November 2025, and for processing that was already under way from 3 August 2026.Voluntary frameworkNZ Responsible AI Guidance for BusinessesResponsible AI Guidance for Businesses (New Zealand)MBIE's voluntary Responsible AI Guidance for Businesses, published in July 2025, sets out how New Zealand businesses can use and develop AI responsibly.Published July 2025. Voluntary.Regulator guidanceNZ Privacy Act and AINew Zealand Privacy Act 2020 and AIHow New Zealand's Privacy Act 2020 applies to AI. The Privacy Commissioner's expectations, the Information Privacy Principles, IPP3A and the Biometrics Code.AI guidance published 2023. IPP3A in force 1 May 2026. Biometric Processing Privacy Code fully in force 3 August 2026.

All New Zealand frameworks

International

Standards and frameworks that apply across borders. Most organisations use one of these as the backbone of their AI governance, whatever their jurisdiction.

StandardISO/IEC 42001ISO/IEC 42001:2023 AI management systemsISO/IEC 42001 is the certifiable international standard for an AI management system. What it requires, how Annex A works and how to get ready to certify.Published December 2023, current editionIn Aicura from ProStandardISO/IEC 42005ISO/IEC 42005:2025 AI system impact assessmentISO/IEC 42005 is international guidance on assessing how an AI system affects people and society, when to assess, what to record and how it links to 42001.Published May 2025, current editionVoluntary frameworkNIST AI RMFNIST AI Risk Management Framework (AI RMF 1.0)The NIST AI RMF is a voluntary framework for managing AI risk through four functions, Govern, Map, Measure and Manage. What it asks and who uses it worldwide.Version 1.0 current, revision under wayIn Aicura from ProVoluntary frameworkNIST Generative AI ProfileNIST AI RMF Generative AI Profile (NIST AI 600-1)NIST AI 600-1 applies the AI Risk Management Framework to generative AI. Its 12 risks, the suggested actions behind them and who uses the profile and why.Final, published July 2024StandardISO/IEC 23894ISO/IEC 23894:2023 Guidance on AI risk managementISO/IEC 23894 adapts the ISO 31000 risk process to AI. What the guidance covers, its AI risk sources and lifecycle mapping, and how it fits with ISO 42001.Published February 2023, current editionStandardISO/IEC 38507ISO/IEC 38507:2022 Governance implications of the use of AI by organizationsISO/IEC 38507 is guidance for boards on governing an organisation's use of AI. What it asks of directors, how it links to ISO/IEC 38500 and who uses it.Published April 2022, current editionVoluntary frameworkOECD AI PrinciplesOECD Recommendation of the Council on Artificial Intelligence (OECD AI Principles)The OECD AI Principles are the intergovernmental standard for trustworthy AI, adopted 2019 and revised 2024. The five principles and how to apply them.Adopted May 2019, revised May 2024Voluntary frameworkHUDERIAHUDERIA: Risk and impact assessment of AI systems for human rights, democracy and the rule of lawHUDERIA is the Council of Europe's method for assessing AI risks to human rights, democracy and the rule of law. Its four elements, scoring and who uses it.Methodology and Model adopted, non-bindingLawCouncil of Europe AI ConventionCouncil of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225)The Council of Europe AI Convention is the first binding international treaty on AI. Who has signed and ratified, what it asks of parties and when it applies.Open for signature, not yet in forceVoluntary frameworkG7 Hiroshima Code of ConductHiroshima Process International Code of Conduct for Organizations Developing Advanced AI SystemsThe G7 Hiroshima Code of Conduct sets 11 voluntary actions for advanced AI developers, with OECD HAIP reporting. What it asks and who reports under HAIP 2.0.Voluntary, reporting framework v2.0 liveVoluntary frameworkUNESCO AI Ethics RecommendationUNESCO Recommendation on the Ethics of Artificial IntelligenceUNESCO's Recommendation on the Ethics of AI is the global standard its member states adopted in 2021. Its values, principles and Ethical Impact Assessment.Adopted November 2021

All International frameworks

Aicura in New Zealand

Frameworks elsewhere

Guides

Questions

Does New Zealand have an AI law?

No. The Government's AI Strategy of July 2025 commits to light-touch, principles-based policy aligned with the OECD AI Principles. The Privacy Act 2020 is the main binding law for AI that uses personal information.

Does the Privacy Act apply to AI?

Yes. The Privacy Commissioner's position is that the Privacy Act applies to everyone using AI tools in New Zealand, at every stage from collecting training data to acting on an output. Its expectations for generative AI include senior leadership approval, a privacy impact assessment and human review of outputs.

Is facial recognition regulated in New Zealand?

Yes. The Biometric Processing Privacy Code 2025 applies to facial recognition and other automated biometric processing. Organisations must be satisfied the processing is necessary and proportionate, with safeguards, and the code restricts inferring emotion, health or personality from biometrics.

Is the Algorithm Charter mandatory?

No. It is a voluntary commitment by government agencies, published by Stats NZ in July 2020. Signatories assess their algorithms with a likelihood and impact matrix that decides how strictly the charter's commitments apply.

Start with the AI you run.

Every framework begins with knowing which AI systems and agents you have. The AI register is free to start.

Sign upContact us