The AI frontier is moving fast. Claude, Gemini, GPT-4o, and their successors are not arriving gradually — they are already inside your business, whether or not you know it. Your staff are using AI tools to draft emails, summarise contracts, and analyse customer data. That is good news for productivity. It is also a governance problem you probably have not solved yet.
For IT leads, CEOs, CIOs, and startup founders in New Zealand, the question is no longer whether to build IT governance. It is whether you build it deliberately — or let events force you into it.
What IT Governance Actually Means for an SME
Strip away the enterprise jargon and IT governance comes down to four questions your organisation must be able to answer:
| Question | What it looks like in practice |
|---|---|
| Who decides? | One named person owns IT risk and AI tool decisions — not "the IT team" collectively |
| What are the rules? | Clear policies on data access, acceptable AI use, and password standards — written down and communicated |
| How do we know it's working? | Basic monitoring: who has access to what, whether backups run, whether unusual logins are flagged |
| Does IT serve the business? | Technology spending and risk decisions are aligned with what the organisation actually needs to grow |
For a small organisation, answering these four questions concisely — and reviewing those answers once a year — is the entirety of IT governance. The framework gives you the structure for doing so consistently.
The NZ Regulatory Landscape You Must Know
New Zealand has not introduced AI-specific legislation yet. The government's stated position is a light-touch, principles-based approach — meaning your existing legal obligations under current law already apply to how you use AI and manage your IT.[1]
| Law / Framework | What it requires | Applies to SMEs? |
|---|---|---|
| Privacy Act 2020 | Mandatory breach notification to OPC within 72 hours; personal data must be secured and used only for the purpose it was collected — including AI training data | Must |
| NZ AI Strategy 2025 (MBIE) | Voluntary guidance for businesses on responsible AI adoption; OECD AI Principles adopted by Cabinet (June 2024) | Should |
| Public Service AI Framework (Feb 2025) | Mandatory for government agencies; sets the standard private sector will increasingly be benchmarked against by procurement teams | Should |
| Algorithm Charter for Aotearoa NZ | Required for public sector algorithmic decisions — transparency, human oversight, and Māori data sovereignty considerations | If public sector |
| RBNZ / FMA Expectations | Regulated financial entities must manage AI risk within existing governance, risk, and compliance arrangements | If regulated |
| Consumer Guarantees Act 1993 / Fair Trading Act 1986 | AI-generated outputs used in customer-facing decisions (pricing, recommendations) must still meet consumer protection standards | Must |
The Right Framework for Your Starting Point
Two frameworks are the most practical starting points for NZ SMEs. Used together, they cover both governance accountability and security operations.
NIST Cybersecurity Framework 2.0 — Start Here
The NIST CSF is free, non-prescriptive, and globally recognised. Version 2.0 (released 2024) added a sixth function — Govern — which now sits above Identify, Protect, Detect, Respond, and Recover. For SMEs, this is your entry point: assign accountability before you work through anything else.
COBIT Core Model — For Governance Structure
Published by ISACA, the COBIT Core Model addresses how IT decisions are made and how IT aligns with business strategy. Where NIST CSF gives you security controls, COBIT gives you the governance structure around them. For leadership teams unsure who owns IT risk, COBIT's accountability model is the clearest starting point available.
What Not to Do
Don't attempt a full enterprise framework first
ISO 27001 is a multi-year effort even for experienced teams. Starting there before your basics are in place stalls momentum and leaves you more exposed, not less.
Don't hand governance entirely to your MSP
Your managed service provider can implement controls. Under the Privacy Act 2020, accountability for data handling sits with your organisation — not your vendor.
Don't let AI tool adoption happen without a policy
If there is no clear rule on which AI tools staff can use and with what data, shadow AI fills the gap immediately — at a cost your organisation did not budget for.
Don't treat governance as a one-time project
Governance is not a deliverable. It is an ongoing practice. Reviewing it once a year and after every significant technology change is the minimum viable cadence.
A 90-Day Starting Plan
The goal is not perfection — it is having something real in place that you can build on. Here is a grounded sequence.
Key Takeaways
- The Privacy Act 2020 has no SME exemption. Accountability for data — including data used in AI tools — sits with your organisation, not your vendors.
- New Zealand has adopted the OECD AI Principles and published a National AI Strategy (2025). The regulatory direction is principles-based — your existing legal obligations already apply to AI.
- Start with NIST CSF 2.0 for security controls and COBIT Core Model for governance accountability. Add ISO 42001 self-assessment as you adopt AI tools.
- The four most expensive mistakes: attempting a full enterprise framework too early, delegating accountability to your MSP, ignoring shadow AI, and treating governance as a one-time project.
- A focused 90-day plan — inventory, protect, respond — gives you a working foundation without a dedicated team or a large budget. Start where you are.
References
- Buddle Findlay. (2025). Government releases New Zealand's first AI strategy. buddlefindlay.com
- NSP Research. (2025). Fastest Technology Adoption Has the Slowest Governance Response. blog.nsp.co.nz
- MBIE. (2025). New Zealand's Strategy for Artificial Intelligence: Investing with Confidence. mbie.govt.nz
- NCSC / CERT NZ. (2025). Q1 2025 Cyber Security Insights Report. cert.govt.nz
- digital.govt.nz. (2025). Public Service AI Framework. digital.govt.nz
- IBM Security. (2025). Cost of a Data Breach Report 2025. ibm.com/security
- Microsoft NZ / Nemko Digital. (2025). New Zealand AI Strategy 2025 Analysis. digital.nemko.com
- ISACA. (2024). COBIT Core Model. isaca.org
- NIST. (2024). Cybersecurity Framework 2.0. nist.gov
- ISO/IEC 42001:2023. Artificial Intelligence Management System Standard. iso.org