AI governance in New Zealand: what the rules are, and what a board should ask.

01What the rules actually are

New Zealand chose a principles-based, light-touch approach. There is no equivalent of the European Union's AI Act, and the July 2025 strategy confirmed the Government does not intend to legislate for AI specifically. That does not mean AI is unregulated. It means the rules are the ones directors already answer to, applied to a new kind of system.

The Responsible AI Guidance for Businesses sets out a table of legislation and its relevance to AI. The entries that matter most for a governance conversation:

• Privacy Act 2020. Personal information in AI inputs and outputs is covered, and any business handling personal information must have a privacy officer. The Office of the Privacy Commissioner has published guidance on how the information privacy principles apply to AI.
• Companies Act 1993. Directors' duties of due care and diligence apply to decisions about AI systems as they do to any other.
• Fair Trading Act 1986. Misleading or deceptive conduct includes conduct produced by an AI tool.
• Human Rights Act 1993 and Bill of Rights Act 1990. Discrimination through AI-informed decisions is discrimination.
• Commerce Act 1986. The guidance's own worked example is algorithmic pricing collusion through a shared AI tool.

Sector rules and international law apply on top where an organisation operates offshore.

02What the July 2025 guidance asks of a business

The guidance is voluntary and structured in three layers: understanding your purpose for AI, good business foundations, and AI-system-specific considerations. The foundations layer is the governance layer, and it asks for four things.

1. A team with named responsibilities. Leadership, security, data, legal, privacy, HR and communications, sized to the organisation, with it clearly documented who is in charge of what.
2. A map of legal obligations. Identify and catalogue every obligation relevant to how AI is used or developed.
3. A risk cycle. Identify, assess, manage, record and review, started early and repeated. The guidance recommends a risk inventory and, for generative AI, usage policies that state the organisation's stance and rules.
4. Recordkeeping. Documentation that shows where AI is being used and how, so the organisation can answer customer queries and comply with audits. Larger businesses, it notes, may already log technologies in a central place.

That last point is the one boards should sit with. The guidance assumes an organisation can say where AI is used. Most cannot.

03Where New Zealand organisations actually stand

Datacom's 2026 State of AI Index, released at the end of August 2026, found that 91 percent of New Zealand organisations use some form of AI, up from 87 percent in 2025 and 66 percent in 2024. Fifteen percent are scaling AI across the organisation. Four percent say AI has transformed core operations, down from 8 percent a year earlier.

The governance numbers are thinner. Twenty percent have a dedicated AI budget with clear cost tracking. Sixty-two percent have some form of AI strategy, and 16 percent a clearly defined standalone one. Twenty-two percent have a dedicated AI leadership role.

Read against the guidance, the gap is specific. The Government asks for a record of where AI is used and a named person in charge. Most New Zealand organisations have neither for the AI their teams already run.

The cost of the gap is now measured internationally. In 2026, IBM's Cost of a Data Breach Report found shadow AI, meaning AI used without approval or oversight, in 43 percent of breaches, double the year before. Novamind's position is that this is an inventory problem before it is a policy problem.

04Eight questions a board should ask about AI this quarter

1. Can we list every AI system and agent running in the business, with an owner for each?
2. What did AI cost us this year, attributed to a team, and who signed off each line?
3. Who approved each agent that takes actions on our behalf, and what scope did they approve?
4. When an agent's model or tools change, does its approval come up for renewal?
5. Which of our AI systems handle personal information, and does our privacy officer know?
6. Which decisions about customers or staff involve AI, and where is the human in the loop?
7. If the Privacy Commissioner or an auditor asked what an agent did last month, how long would the answer take?
8. Who in this room is accountable for the answers to questions one to seven?

If the answer to the eighth question is a pause, that pause is the governance gap.