AI governance in New Zealand, what applies and what to do

New Zealand governs AI through the laws it already has. The Government’s AI Strategy, released in July 2025, commits to light-touch, principles-based policy aligned with the OECD AI Principles, and relies on existing law. That does not mean nothing applies. The Privacy Act 2020 reaches almost every AI system that touches personal information, two changes in 2026 tightened it, and regulators in finance and government are asking questions. This guide sets out what applies and the work it asks of an organisation.

The Privacy Act is the main rule

The Privacy Commissioner’s starting point is that the Privacy Act applies to everyone using AI tools in New Zealand. The Information Privacy Principles apply at every stage, from collecting training data to acting on an output. The Commissioner’s expectations for generative AI turn that into a working list. Senior leaders approve the use, someone checks it is necessary and proportionate, a privacy impact assessment comes first, people are told plainly how the tool is used, Māori are engaged on impacts on their communities, a human reviews outputs before the agency acts on them, and personal information stays out of tools that retain it. The Privacy Act and AI page sets out each expectation.

In practice that list needs three things you can point to. A record of each AI tool in use with an owner and its approval. An assessment for each one that touches personal information. And a description of where a person sits in each decision the tool supports.

Two changes in 2026

IPP3A. Since 1 May 2026, an agency that collects personal information indirectly, from someone other than the individual, must notify the individual unless an exception applies. It covers information collected from that date. For AI, the cases to check are systems that enrich customer records with third-party data, models trained or tuned on data from partners or brokers, and tools that pull information from public sources. Each needs either a notice or a documented exception.

The Biometric Processing Privacy Code. The Biometric Processing Privacy Code 2025 came into force on 3 November 2025, and its transition for processing already under way ended on 3 August 2026. It applies to facial recognition, voice analysis and any automated process that verifies, identifies or categorises people from how they look, move or behave. Before collecting, an organisation must be satisfied the processing is necessary, effective and proportionate, with safeguards in place. The code also restricts inferring emotion, health, personality or attention from biometrics. Retail security cameras with face matching, identity checks at onboarding and call centre voice analytics are the common systems it reaches.

Overseas AI tools and IPP 12

Most AI tools used in New Zealand are hosted overseas. The Privacy Commissioner’s guidance is that using an offshore cloud provider to store or process information is not a disclosure under IPP 12, because section 11 treats the information as still held by your organisation, as long as the provider does not use it for its own purposes. The Commissioner gives AI training as an example of a provider’s own purpose. Where that happens, IPP 12 applies and you need a ground for sending the information overseas, such as comparable safeguards or the person’s informed authorisation. So the terms that matter in an AI contract are whether the provider retains your inputs and whether it trains on them. The vendor AI risk guide covers the questions to ask.

Voluntary guidance for businesses

MBIE’s Responsible AI Guidance for Businesses was published alongside the AI Strategy. It is voluntary, draws on the OECD AI Principles and works in three layers. A business first works out why it is using AI, then builds foundations such as governance, risk management, procurement, privacy and transparency, and finally addresses the specific system, from data and models to human involvement in decisions. It is the closest thing New Zealand has to a national AI governance framework for the private sector.

Government agencies and their suppliers

Public service agencies are encouraged to align with the Public Service AI Framework and the GCDO’s responsible AI guidance, and signatories to the Algorithm Charter assess their algorithms against its likelihood and impact matrix. Suppliers to government often meet these through contract terms and due diligence questionnaires, so a supplier that can show its register and assessments is better placed.

Financial services

The Financial Markets Authority began an exploratory thematic review of AI in financial advice in August 2026, with risks it is looking at including opaque decision-making, automation bias, data quality and accountability for advice outcomes. It has said the review is not an enforcement exercise. Financial advice providers should expect questions about which AI tools they use and who is accountable for the advice those tools shape.

Where to start

Start with an inventory, because every obligation above depends on knowing which AI tools are in use. Include the ones staff adopted on their own, which a shadow AI search will turn up. Then, for each tool that touches personal information, run an impact assessment that answers the Privacy Commissioner’s questions, check IPP3A notices and the vendor’s retention and training terms, and flag any biometric processing for a code assessment.

Where Aicura fits

Aicura is an AI governance platform. Its AI Register records every system and agent with owners and status, discovery surfaces AI in use that is not yet on the register, and risk and impact assessments, policies and vendor records sit on the same entries. Aicura does not assess against New Zealand law. Its register, assessments and records support the work the Privacy Act and the Biometrics Code ask for, and the judgements stay with you. Aicura is hosted on AWS in Sydney, Australia, its AI runs on Amazon Bedrock in Australia, and your data is not used to train models.

A note on this page

This is Aicura’s reading of New Zealand law and guidance as at October 2026. It is not legal advice. Read the Privacy Act, the Biometric Processing Privacy Code and the Privacy Commissioner’s guidance, and take advice on how they apply to your organisation.