New Zealand - Responsible AI Guidance

Overview

Responsible AI Guidance for the Public Service: GenAI (published February 2025) is a practical policy guidance package produced by the Government Chief Digital Officer and published on Digital.govt.nz. The guidance supports public service leaders, decision‑makers and practitioners to explore and adopt Generative AI (GenAI) safely, transparently and responsibly. It updates the July 2023 interim guidance and sits alongside the Public Service AI Framework and the OECD AI system lifecycle. The document frames an AI lifecycle approach (plan & design; collect & process; build & use; verify & validate; deploy; operate & monitor), recommends embedding privacy by design, security, accessibility and human oversight, and encourages agencies to publish their use of AI to maintain public trust. Practical outputs include an A3 summary, a printable guidance PDF and linked toolkits and resources.

Definitions

The guidance defines key terms for the public service context. "AI" is described as a machine‑based system that infers from inputs and generates outputs to achieve explicit or implicit objectives. "GenAI" (Generative AI) is explained as systems capable of creating new content — text, images, audio or video — from learned patterns. The guidance distinguishes "open" and "proprietary" models, and "public" v "enterprise" AI deployments. It provides a glossary of terms and cross‑references the OECD definitions and the Public Service AI Framework to ensure consistent terminology across agency implementations.

Governance and Institutional Framework

The guidance requires agencies to establish clear governance arrangements for GenAI, including senior sponsorship, defined accountability and integrated assurance. It recommends committees or governance boards that include legal, privacy, security and Māori representation, where relevant. The GCDO proposes an assurance model and an Expert Advisory Panel to coordinate cross‑agency learning, and advises agencies to align governance to the Public Service AI Framework and existing obligations such as the Privacy Act 2020 and NZISM. Procurement governance is emphasised: agencies should apply procurement best practice, include contractual protections for data handling and IP, require supplier transparency and rights to audit or inspect, and consider options for enterprise (isolated) deployments where sensitivity or security demands it.

Key Focus Areas

The guidance organises detailed material into two parts: GenAI foundations and GenAI & customer experience. Foundational focus areas include governance, security (threat models and mitigations), procurement, skills and capability development, information management and assurance. Customer‑facing topics include transparency/disclosure (declaring when GenAI is used), bias and fairness mitigation (testing for disparate impacts and dataset provenance), accessibility (dual track of preventing harm and enabling benefits for people with disabilities), privacy (privacy‑by‑design, DPIAs and data minimisation), and misinformation/ hallucination management. The guidance highlights particular attention to Māori and indigenous data considerations: engaging mana whenua, respecting tikanga and data sovereignty principles and working with the data stewards relevant to taonga data sets. It provides practical risk management steps: proportional risk assessments, layered mitigations, human oversight thresholds for high‑stakes decisions (welfare eligibility, sentencing inputs, clinical triage), and scenario‑based testing. Security guidance covers model security, supply chain risks, access controls, secrets management and protections against prompt injection and data exfiltration. For procurement and contracting, agencies are counselled to obtain appropriate warranties, clarity on model training data, logging and explainability assurances where practicable, and exit/rollback provisions.

Implementation Framework

The guidance sets out an implementation approach tied to the OECD AI system lifecycle. For each lifecycle phase it lists recommended artefacts, roles and outputs. In planning & design: define objectives, stakeholders, impact assessments and acceptance criteria. In collect & process: inventory datasets, label sensitivity, perform privacy impact assessments and ensure lawful bases for processing. In build & use: select models, document training data provenance, maintain model cards or system documentation and perform robustness testing. In verify & validate: run test suites, red‑team exercises, fairness audits and external validations where required. For deployment: establish deployment gates, run pilot phases, implement logging and monitoring, and prepare rollback plans. For operate & monitor: continuous monitoring of performance drift, user feedback loops, incident response and periodic re‑assessment. The framework encourages rightsizing: smaller, lower‑risk projects have lighter governance; high‑risk systems require formal assurance, documentation and senior approval. The guidance references templates and checklists available on the Digital.govt.nz toolkit to operationalise these steps.

Monitoring and Evaluation

Ongoing monitoring and independent evaluation are central to the guidance. Agencies are directed to implement metrics and KPIs for accuracy, fairness, accessibility and security; maintain audit logs and provenance records; and establish cadence for reviews and re‑validation, particularly where inputs, data sources or model updates change. The guidance suggests a mix of automated monitoring (performance drift detection, anomaly detection) and periodic human reviews, combined with user feedback channels and processes for correcting outputs and remediating harms. It also encourages publishing aggregated monitoring outcomes to promote transparency and cross‑agency learning while protecting sensitive information.

Penalties, Liability, and Appeals

As non‑binding guidance rather than primary legislation, the document itself does not prescribe criminal penalties. Instead it clarifies that agencies remain subject to existing statutory obligations (eg. Privacy Act 2020, Public Records Act) and that failures can trigger administrative remedies, audit findings, internal disciplinary action, reputational damage, procurement restrictions and corrective orders under existing frameworks. The guidance recommends clear incident response pathways, accountability records to support possible liability assessments, and internal appeals processes for decisions driven by GenAI where individuals may be adversely affected. Agencies are advised to document decisions, evidence of risk assessment and steps taken to mitigate harm to support defensibility and redress processes.

Relationship to Other Instruments

The guidance situates itself alongside and in support of existing New Zealand instruments: the Public Service AI Framework, the Public Service Act, the Privacy Act 2020, the Public Records Act, the New Zealand Information Security Manual (NZISM) and the Cabinet direction to align with the OECD AI Principles. It supersedes and expands the Interim Generative AI guidance (July 2023) and complements MBIE guidance for businesses and other sectoral guidance. Agencies are instructed to follow "usual rules" and any sector‑specific statutory obligations, and to integrate AI assurance into existing regulatory and records regimes.

International Alignment

The guidance explicitly aligns New Zealand practice with international best practice: it maps recommendations to the OECD AI Principles and the OECD AI system lifecycle and references international resources for assurance, model cards and testing. It acknowledges ongoing international work (OECD, OECD accountability resources) and aims for interoperability with other jurisdictions’ public sector AI playbooks. The guidance encourages agencies to monitor global standards and to design procurement and contractual terms to facilitate cross‑border data and model considerations consistent with privacy and sovereignty obligations.

Implementation Timeline

Sources and References