A practical AI governance checklist for New Zealand organisations

Governance should help someone make a decision

An AI policy is useful, but it cannot decide whether a particular use should proceed. That requires an owner, an understood purpose, proportionate review and a way to stop or change the use when the facts change.

The checklist below is a practical starting point. The depth of work should match the consequence of the use, the people affected and the information involved.

Purpose and accountability

• Name the job: What task or decision is AI expected to support, and what is explicitly out of scope?
• Name the owner: Who can approve the use, accept the remaining risk and stop it?
• Keep a register: Record approved, trialled, declined and retired AI uses, including the tool, owner, information and review date.
• Classify the consequence: A drafting aid should not receive the same review as a use that affects rights, safety, employment, eligibility or access to a service.

Information, privacy and security

• Map the data path: Identify what is entered, retrieved, generated, logged, retained and disclosed, including supplier services and model providers.
• Confirm permitted use: Check privacy, confidentiality, contractual, intellectual-property, records and information-classification requirements.
• Test access: Make sure source permissions survive indexing, retrieval and the final response.
• Review suppliers: Understand hosting, support access, model use, updates, subprocessors, jurisdiction, continuity and exit.

New Zealand organisations can draw on the Office of the Privacy Commissioner's AI privacy guidance, the National Cyber Security Centre's AI data-security guidance and MBIE's responsible AI guidance for businesses.

Human judgement, testing and operation

• Make the human role real: State what the reviewer must check, what authority they have and when they must reject or escalate.
• Test normal and failure cases: Include missing information, conflicting sources, inappropriate requests, access changes and supplier outages.
• Approve the complete service: Review the workflow, integrations, people, support and records, rather than only the model.
• Monitor and revisit: Track incidents, overrides, complaints, material errors, changes in use and changes made by suppliers.
• Prepare a stop route: People must know how to pause the use, preserve necessary records and return to a safe manual process.

Additional questions for public-service organisations

The Public Service AI Framework and Algorithm Charter for Aotearoa New Zealand provide additional context. Public organisations should consider statutory authority, policy intent, explainability, accessibility, Māori data interests, transparency, review rights and the effect on people who cannot or do not use a digital channel.

The minimum record for one AI use

Keep the purpose, owner, approved users, information sources, model and supplier, risk assessment, human checks, test results, limitations, monitoring, incidents, change history, review date and stop decision together. If the organisation cannot reconstruct why the use was approved, governance has become a policy statement rather than an operating practice.

How Hot Desk can help

Hot Desk has developed AI policies and governance frameworks for two New Zealand public-sector organisations through collaborative workshops. The frameworks were formally approved and are currently adopted. We can help with policy, use registers, assessment methods, workshops, pilots and implementation planning.

Explore our AI consultancy, learn about Pūnaha or discuss your AI governance work.

A note about this article

This is general information from Hot Desk Consultancy Services Limited. It is not legal, privacy, security, employment, regulatory or procurement advice. Guidance and obligations change, so confirm the current requirements that apply to your organisation and use.