New Zealand’s Regulatory Approach to AI and Steps NZ Businesses Should Take

It’s no secret that NZ is behind its peers in AI adoption and regulation. Internationally, AI is instrumental in boosting the productivity of its adopters, however, to date, NZ has been conspicuously absent from the conversation.

In a key step forward in Aotearoa’s AI adoption journey, the New Zealand government, led by Minister Judith Collins, has outlined a strategic approach to artificial intelligence (AI) in a Cabinet paper titled “Approach to Work on Artificial Intelligence”.

This is the first signal from the Minister on how AI will be regulated in New Zealand. In a nutshell, there is no AI-specific legislation on the horizon. Instead, existing laws apply, and may be amended as needed. While further guidance is on its way, how existing laws apply to the use of AI is uncertain.

Why have NZ businesses been slow to adopt AI?

• Public mistrust of AI: New Zealanders are concerned that the use of AI may be for malicious purposes, be unregulated, have unintended consequences,[1] and present security risks.
• Regulatory uncertainty is hindering AI adoption: Only 28% of businesses agreed they had a good understanding of the legal and ethical implications of AI.[2]
• Limited AI adoption in the public sector: Most agencies are early in their AI journeys and are seeking support for managing privacy, security, and ethics/bias concerns.

The Minister clearly expressed the Government’s intention to support increased use of AI.  

Here’s what you need to know about the regulatory approach to AI in NZ:

No AI-specific legislation on the horizon

The Government’s view is that AI is a general-purpose technology with many potential uses, and regulating AI based on “predicted uses” or “speculated harms” may be overly broad and harm productivity.

• In contrast to the approach of the European Union, the NZ government prefers a “light-touch” approach by adjusting existing laws to manage AI risks, rather than introducing a standalone AI Act.
• Instead of strict regulations, expect voluntary guidelines, industry codes, and technical standards.

International Influence:

• New Zealand will follow international norms for AI, including on AI safety. The OECD AI Principles will continue to inform the key direction for New Zealand’s approach to AI.  

Upcoming Guidance:

• The Minister has asked the Ministry of Business, Innovation and Employment to provide risk management guidance and an AI Roadmap to help businesses adopt AI.
• The Government Chief Digital Officer will develop a programme to support safe AI innovation in the public sector.

• The Minister also acknowledged that the Crown may have Treaty of Waitangi obligations arising from the development and use of AI and will consult with iwi and Māori as relevant.

Privacy Commissioner’s View:

• While there is no need for an AI-specific law yet, quick progress is needed to clarify how existing laws apply to AI.

What does NZ’s AI regulatory approach mean for Kiwi businesses?

While the Minister’s clarification of New Zealand’s regulatory approach to AI is welcome, uncertainties for businesses remain. 

Organisations are making decisions about AI now without clear guidance on responsible risk management. How our existing legal framework applies in the context of AI is unclear and untested.  We agree with the Privacy Commissioner that New Zealand businesses need urgent clarification on how existing laws apply to AI, and what areas may be amended. 

New Zealand businesses should stay informed about upcoming guidance on AI, as well as any updates in the areas of privacy, consumer protection, employment and human rights laws that the use of AI is relevant to. 

What steps should NZ businesses take when implementing AI?

• Stay informed:
  • Keep up with new AI guidance and any changes in laws related to privacy, consumer protection, employment, and human rights.

• Privacy Impact Assessment (PIA)
  • Refer to the Privacy Commissioner’s guidance on the use of AI.
    • Before adopting AI, conduct a PIA and develop a privacy policy framework to govern the use of AI. Update your privacy policy if needed.
• Review terms and conditions of the AI tool:
  • Carefully review the terms and conditions of the AI tool, including:
    • Whether and how information is retained and disclosed (and if so, what information).
    • Whether terms assign ownership of input data and/or outputs to the AI provider. 
    • Whether terms offer any indemnity for infringement of intellectual property from the use of the tool (and conditions attached to those indemnities).
    • The conditions attached to any licence to use the outputs of the tool. If feasible, ask the provider for documentation of the sources of input data to understand privacy and intellectual property infringement risks. 
• Develop an AI policy:
  • Understand how your employees are using AI, and create an AI policy for your business.
  • Communicate with customers about AI use to build trust and seek consent for data collection.
• Build AI capabilities:
  • Partner with AI specialists to bridge any skills gaps in your team. 

If you have any questions about the legal and ethical issues that arise from the use of AI in your business, please get in touch. Our legal team are at the forefront of helping our clients building robust AI frameworks, and would love to assist your business too.

Here’s to boosting NZ’s productivity and AI adoption, together.

[1]New Zealand’s Internet Insights 2023, a Verian Research Report, December 2023.  

[2] 2021 Qrious survey.