Skip to main content

    AI by country · Oceania

    AI in New Zealand: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in New Zealand know before starting with AI?

    New Zealand has no dedicated AI law as of 29 October 2026. The Privacy Act 2020 applies to AI that uses personal information, and two newer rules matter: IPP 3A on information collected from other sources, in force since 1 May 2026, and the Biometric Processing Privacy Code. The national AI strategy takes a light-touch approach built on existing laws, so the Privacy Commissioner's guidance is the practical starting point.

    At a glance

    New Zealand at a glance

    Key facts about New Zealand
    Data protection lawPrivacy Act 2020, in force since 1 December 2020, amended by the Privacy Amendment Act 2025
    RegulatorOffice of the Privacy Commissioner (OPC)
    AI policyNew Zealand's Strategy for Artificial Intelligence: Investing with confidence (2025), with voluntary Responsible AI Guidance for Businesses. No dedicated AI law as of 29 October 2026
    Time zoneNZST UTC+12, NZDT UTC+13 during daylight saving (late September to early April)
    CurrencyNZD (New Zealand dollar)
    Business languageEnglish

    Why now

    Why New Zealand is worth watching

    Each point links to the document it comes from.

    • New Zealand's AI strategy, Investing with confidence, was published in 2025 and focuses on adopting existing AI tools to lift productivity, naming health care, agriculture and education.[8]

    • The government keeps a light-touch, principles-based approach agreed in mid-2024 that builds on existing laws such as privacy and consumer protection.[9]

    • An OECD.AI article notes that New Zealand's small and medium firms have some of the lowest rates of AI adoption among OECD countries.[9]

    • IPP 3A came into force on 1 May 2026, so firms that collect personal information from third parties now have new notice duties.[2]

    • The Biometric Processing Privacy Code came into force on 3 November 2025, and the grace period for existing biometric systems ended on 3 August 2026.[7]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    Privacy Act 2020

    In force2020The Act came into force on 1 December 2020 and its 13 Information Privacy Principles apply to AI that collects, uses or shares personal information. Under IPP 12, personal information can go overseas only if the recipient offers comparable protection on one of the listed grounds, or the person is expressly told it may not be protected and agrees. A breach that has caused or is likely to cause serious harm must be notified to the Commissioner and affected people as soon as practicable.[1]

    Privacy Amendment Act 2025: IPP 3A

    In force2025Since 1 May 2026, an agency that collects personal information from someone other than the person must take reasonable steps to tell the person, unless an exception applies. The notice covers the fact of collection, the purpose, the recipients and the person's rights of access and correction. This matters for AI that uses bought-in, scraped or partner data.[2]

    Biometric Processing Privacy Code 2025

    In force2025The code sets privacy rules for organisations that collect and use biometric information, such as facial recognition. It came into force on 3 November 2025, and systems already running had until 3 August 2026 to comply. An amendment for IPP 3A applies from 1 May 2026.[7]

    Offence of failing to notify a privacy breach (section 118)

    In force2020Failing to notify the Commissioner of a notifiable breach without reasonable excuse is an offence. The maximum fine a court can order is $10,000, for individuals and companies.[5]

    Where AI fits first

    Where AI fits first

    Health care

    Drafting clinical notes and summarising referrals, with clinicians checking every output.

    The AI strategy names health care as a sector for applying proven AI tools. The Commissioner expects a privacy impact assessment and human review before acting on generative AI outputs.[8]

    Agriculture

    Forecasting, pasture and herd data analysis, and drafting compliance reports.

    Agriculture is named in the AI strategy. We found no AI rule specific to the sector; privacy rules apply where farm data identifies people.[8]

    Retail and venues

    Customer service chatbots and stock forecasting. Facial recognition needs much more care.

    Any use of biometric information, such as face matching at store entrances, falls under the Biometric Processing Privacy Code.[7]

    Professional services

    Summarising documents and drafting letters with an AI tool that does not keep your inputs.

    The Commissioner expects agencies not to put personal or confidential information into a generative AI tool unless the provider confirms it will not be retained or disclosed.[6]

    Your first steps

    Your first steps

    1. Get senior leadership to approve each AI tool after weighing risks, as the Privacy Commissioner expects.
    2. Run a privacy impact assessment before using an AI tool with personal information, and update it as the tool changes.
    3. Check where your AI provider stores and processes data, and confirm an IPP 12 ground before personal information goes overseas.
    4. If you use third-party or scraped data, set up IPP 3A notices for information collected since 1 May 2026.
    5. If you use facial recognition or other biometrics, check your system against the Biometric Processing Privacy Code.
    6. Keep a person in the loop to review AI outputs before you act on them, and make sure you can handle access and correction requests.
    7. Write a breach process that lets you notify the Commissioner as soon as practicable.

    AI services for New Zealand

    AI consulting and development for teams in New Zealand

    We work remotely with companies in New Zealand, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. India is on UTC+5:30, so a 9:30 to 18:30 Indian day runs 04:00 to 13:00 UTC. New Zealand on UTC+12 overlaps with a 9:00 to 17:00 local day for about 1 hour (16:00 to 17:00 NZST), and during daylight saving on UTC+13 the standard days do not overlap at all. We handle this honestly: we agree a fixed call window, for example 15:00 to 17:00 NZDT, which is 7:30 to 9:30 in India with our team starting early, and run the rest of the work in writing so you find updates waiting each morning.

    Questions

    Common questions about AI in New Zealand

    Does New Zealand have an AI law?

    Not as of 29 October 2026. The government has chosen a light-touch approach that relies on existing laws such as the Privacy Act 2020 and consumer protection law, plus voluntary guidance for businesses.

    Can we use generative AI tools with customer information?

    The Privacy Commissioner expects you not to enter personal or confidential information unless the provider confirms it will not be retained or disclosed. A privacy impact assessment and leadership approval should come first.

    What is IPP 3A?

    It is a new privacy principle in force since 1 May 2026. If you collect personal information about someone from another source, you must generally take reasonable steps to tell them, unless an exception applies.

    Can our data be processed in another country?

    Disclosing personal information overseas is covered by IPP 12. The recipient must offer comparable protection on a listed ground, or the person must be expressly told and agree. The OPC's guidance on sending information overseas helps with specific cases.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Office of the Privacy Commissioner, 2026-10-29. Privacy principles(privacy.org.nz)
      Full title and what we used it for

      Privacy principles. Primary regulator page, accessed on this date. Used for the 1 December 2020 commencement and the list of 13 principles plus IPP 3A. The legislation website refused automated access, so we did not read the Act text directly.

    2. [2] Office of the Privacy Commissioner, 2026-10-29. IPP3A(privacy.org.nz)
      Full title and what we used it for

      IPP3A. Primary. Used for the 1 May 2026 start, the Privacy Amendment Act 2025 and what the notice must cover.

    3. [3] Office of the Privacy Commissioner, 2026-10-29. Principle 12: Disclosure outside New Zealand(privacy.org.nz)
      Full title and what we used it for

      Principle 12: Disclosure outside New Zealand. Primary. Used for the grounds for overseas disclosure and the express consent route.

    4. [4] Office of the Privacy Commissioner, 2026-10-29. Privacy breaches(privacy.org.nz)
      Full title and what we used it for

      Privacy breaches. Primary. Used for the serious harm test and notifying as soon as practicable.

    5. [5] Office of the Privacy Commissioner, 2026-10-29. Prosecution policy(privacy.org.nz)
      Full title and what we used it for

      Prosecution policy. Primary. Used for the section 118 offence and the $10,000 maximum fine.

    6. [6] Office of the Privacy Commissioner, 2023-06-15. Generative artificial intelligence(privacy.org.nz)
      Full title and what we used it for

      Generative artificial intelligence. Primary. Used for the Commissioner's expectations: leadership approval, privacy impact assessment, transparency, human review and not retaining or disclosing personal information.

    7. [7] Office of the Privacy Commissioner, 2026-10-29. Biometric Processing Privacy Code(privacy.org.nz)
      Full title and what we used it for

      Biometric Processing Privacy Code. Primary. Used for the 3 November 2025 start, the grace period ending 3 August 2026 and the IPP 3A amendment.

    8. [8] OECD.AI Policy Observatory, 2025-12-25. New Zealand's Strategy for Artificial Intelligence, Investing with Conf…(oecd.ai)
      Full title and what we used it for

      New Zealand's Strategy for Artificial Intelligence, Investing with Confidence. Policy database entry, last updated 25 December 2025. Used for the strategy's focus on adopting existing AI and the named sectors. MBIE's own pages blocked automated access with a security check, so we could not read the strategy text.

    9. [9] OECD.AI Policy Observatory, 2025-09-29. New Zealand created its AI Strategy and Guidance products to incorporat…(oecd.ai)
      Full title and what we used it for

      New Zealand created its AI Strategy and Guidance products to incorporate OECD values in a distinct manner. Commentary written by New Zealand officials, used for interpretation. Used for the light-touch, principles-based approach agreed in mid-2024 and the point on SME adoption.

    This is general information, not legal advice. Laws, codes and guidance change, and we could not read the AI strategy or the Act on the government's own sites, so those points rest on regulator pages and OECD.AI. Check with a qualified New Zealand lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in New Zealand?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score