12 APR 2026 · Working Paper

New Zealand - Regulatory Gap as EU AI Act Takes Effect

New Zealand faces a growing regulatory gap as European AI rules (EU AI Act) begin phasing in and reshape global standards. NZ currently relies on a patchwork of existing laws (Privacy Act, Algorithm Charter, Consumer Guarantees Act) with no dedicated AI legislation.

Secondary evidenceRegulatory Gap ·Existing Laws ·Data Privacy & ProtectionIssuing institution: Issuing authority not identified

15 FEB 2026 · Policy / Guidance

New Zealand - Businesses Urged to Lead on AI Regulation

Industry leaders argue that businesses should take the lead in developing AI regulation in New Zealand, as industry-driven standards can be more practical and timely than government-led rules.

Secondary evidenceSelf-Regulation ·Industry StandardsIssuing institution: Issuing authority not identified

11 FEB 2026 · Court Case

Jones v. Family Court at Whangarei

Pro Se Litigant appeared before the Supreme Court. Fabricated: Case Law | "Awatere Huata v Prebble [2002] 3 NZLR 827" — example of a real case name paired with an incorrect citation; Court found it to be a hallucinated/erroneous citation. Outcome: Warning.

Court: Supreme CourtParty: Pro Se Litigant

Secondary evidenceJudicial & Law Enforcement ·Generative AI ·Liability & AccountabilityIssuing institution: Supreme Court

21 JAN 2026 · Other

Privacy Commissioner's investigation into Manage My Health over alleged cybersecurity breach

On 21 January 2026, the Office of the Privacy Commissioner announced an investigation into Manage My Health over a cybersecurity breach in the digital health sector that handles sensitive patient information. The investigation seeks to examine the causes and scale of the breach, the adequacy of security safeguards, affected patient data, governance and contractual arrangements across the health system, and compliance with the Privacy Act and the Health Information Privacy Code 2020. It was st...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

11 NOV 2025 · Court Case

Coulson v. ASB Bank

Pro Se Litigant appeared before the High Court. False Quotes: Legal Norm

Court: High CourtParty: Pro Se Litigant

Secondary evidenceJudicial & Law Enforcement ·Generative AI ·Liability & AccountabilityIssuing institution: High Court

08 NOV 2025 · Law / Act

Privacy Commissioner guidance on use of images under Privacy Act

On 11 August 2025, the Privacy Commissioner issued guidance on the use of images under the Privacy Act 2020. The Commissioner confirmed that photographs qualify as personal information when they identify an individual. Agencies are expected to be transparent when collecting, using, or sharing such information, and commercial agencies must do so fairly and without unreasonable intrusiveness, even in public places. The guidance also stressed that the fact that personal information is publicly a...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

07 NOV 2025 · Court Case

QTR v BXD ([2025] NZERA 716)

Fabricated: Case Law | Lengthy document submitted by QTR contained numerous non-existent case citations described by the Authority as 'hallucinated' legal cases asserted as authority. || Misrepresented: Case Law | Document included incorrectly cited cases and mis-citations (real cases cited incorrectly), which the Authority identified as part of the AI-generated errors.

Court: Employment Relations AuthorityParty: Pro Se LitigantTool: ChatGPT

Secondary evidenceHarms: Hallucination in legal filingsIssuing institution: Employment Relations Authority

22 OCT 2025 · Law / Act

Deepfake Digital Harm and Exploitation Bill

On 23 October 2025, the Deepfake Digital Harm and Exploitation Bill was introduced in New Zealand Parliament. The Bill aims to amend the Crimes Act 1961 and the Harmful Digital Communications Act 2015 by including digitally altered or synthesised images within the definition of an intimate visual recording. This Bill intends to address the proliferation of sexually explicit deepfakes and extend legal protections to individuals whose likeness is used without consent. The Bill specifies that in...

Secondary evidenceContent ModerationIssuing institution: Issuing authority not identified

09 OCT 2025 · Other

Office of the Privacy Commissioner clarification on information sharing for child safety and wellbeing

On 9 October 2025, the Office of the Privacy Commissioner (OPC) of New Zealand issued a public statement clarifying that the Privacy Act 2020 does not prevent the sharing of information where there is a safety or well-being concern for a child. The statement followed the Government’s acceptance of all recommendations from the 2022 Dame Karen Poutasi Review on changes to improve the system of safety nets for preventing harm in the children's system. It stated that the Oranga Tamariki Act allow...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

29 SEP 2025 · National Strategy

New Zealand created its AI Strategy and Guidance products to incorporate OECD values in a distinct manner

New Zealand released a suite of AI materials—a milestone as the last OECD country to publish a national AI strategy.

Official materialNational StrategyOfficial source · oecd.ai ↗

29 AUG 2025 · Court Case

Cunningham v healthAlliance NZ Limited

Pro Se Litigant appeared before the Employment Court. Fabricated: Case Law | Mr Cunningham cited this authority to support a procedural fairness argument; the Court found the case does not exist and noted it may have been generated by AI. Outcome: Warning.

Court: Employment CourtParty: Pro Se Litigant

Secondary evidenceJudicial & Law Enforcement ·Generative AI ·Liability & AccountabilityIssuing institution: Employment Court

07 AUG 2025 · National Strategy

Ministry of Business, Innovation and Employment's Artificial Intelligence strategy

On 8 July 2025, the Ministry of Business, Innovation and Employment adopted the Artificial Intelligence (AI) strategy focusing on investing with confidence to drive AI adoption and economic growth. The strategy aims to boost productivity in key sectors including agriculture, healthcare, education, and tourism. The strategy applies to both public and private sectors, addressing the low uptake among small and medium enterprises and principles-based policy aligned with Organisation for Economic ...

Official materialNational StrategyOfficial source · mbie.govt.nz ↗

20 JUL 2025 · Policy / Guidance

Responsible AI Guidance for Businesses: Investing with Confidence

New Zealand's Ministry of Business, Innovation and Employment (MBIE) published this guidance to accelerate private sector AI adoption while promoting responsible use. It provides a framework for businesses to assess AI risks, establish internal governance, ensure transparency with customers, and comply with existing legal obligations. The document outlines practical steps for due diligence when procuring or developing AI systems, and includes checklists and resources to help organisations ethically source datasets and manage AI-related risks.

Official materialAI Governance ·Data Privacy & Protection ·Risk ManagementOfficial source · mbie.govt.nz ↗

09 JUL 2025 · Working Paper

Department of Internal Affairs inquiry into terrorist and violent extremist content

On 9 July 2025, New Zealand's Department of Internal Affairs (DIA) adopted the 2024 digital violent extremism transparency report, highlighting a 10% increase in referrals of extremist online content, with 974 URLs flagged over the year. The report applies to digital platforms hosting user-generated content and revealed that 243 informal and 38 formal take-down notices were issued, resulting in the removal of 88% of flagged content. The most commonly reported ideology was identity-motivated e...

Official materialContent ModerationOfficial source · dia.govt.nz ↗

25 JUN 2025 · Standard / Framework

Guidance on indirect collection of personal information in Privacy Amendment Bill (No. 292-1)

On 25 June 2025, the Privacy Commissioner closes its consultation on draft guidance on the Privacy Amendment Bill, focusing on the new Information Privacy Principle (IPP) 3A, which introduces notification requirements for the indirect collection of personal information. The draft guidance outlines how organisations should notify individuals when collecting their personal data from third-party sources. It also clarifies the circumstances under which such notification may be waived, the types o...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

30 APR 2025 · Other

Department of Internal Affairs investigation into distribution of child sexual exploitation material online

On 30 April 2025, the New Zealand Department of Internal Affairs published the 2024 Digital Child Exploitation Transparency Report, following an investigation into child sexual exploitation material shared via online platforms. In 2024, the Department blocked more than 1'032'683 attempts to access websites containing objectionable content using the Digital Child Exploitation Filtering System. In collaboration with the National Center for Missing and Exploited Children, the Department received...

Official materialContent ModerationOfficial source · dia.govt.nz ↗

11 APR 2025 · Other

National Cyber Security Centre cyber security alert regarding exploitation of vulnerabilities in Fortinet FortiOS products

On 11 April 2025, the National Cyber Security Centre (NCSC) issued a cyber security warning regarding the exploitation of vulnerabilities in Fortinet FortiOS products. In particular, CVE-2022-42475, CVE-2023-27997 and CVE-2024-21762 have been actively targeted by threat actors since 2023, allowing them to compromise devices, maintain persistence and potentially access sensitive data such as credentials and key material. Organisations with exposed SSL-VPN functionality during this period are u...

Official materialNational StrategyOfficial source · ncsc.govt.nz ↗

07 APR 2025 · Executive Order

National Cyber Security Centre Minimum Cyber Security Standards

On 4 July 2025, the National Cyber Security Centre closes its consultation on the Minimum Cyber Security Standards. The consultation, conducted in collaboration with the Public Service Commission (PSR), seeks feedback from mandated agencies and industry partners regarding the proposed standards. These standards establish minimum cybersecurity practices, require agencies to meet Capability Maturity Model level two (CMM2) for business-critical and external-facing systems, and were published on ...

Primary legal sourceNational StrategyOfficial source · ncsc.govt.nz ↗

29 MAR 2025 · Law / Act

Customer and Product Data Bill

On 29 March 2025, the Customer and Product Data Bill enters into force. The purpose of the Bill is to establish a consumer data rights framework with a view to facilitating access to and sharing of customer and product data across the economy. The Bill stipulates that designated data holders, such as businesses holding customer data, must provide such data to customers and, with the customers' authorisation, to accredited third parties. The Bill stipulates that data holders must respond to el...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

17 MAR 2025 · Court Case

LMN v. STC (No. 2)

Pro Se Litigant appeared before the . Fabricated: Case Law | Plaintiff cited a non-existent case to argue the Court considers financial constraints; the Court stated no such case exists and warned about relying on generative AI outputs. Outcome: Warning.

Party: Pro Se Litigant

Secondary evidenceJudicial & Law Enforcement ·Generative AI ·Liability & AccountabilityIssuing institution: Issuing authority not identified

11 MAR 2025 · Executive Order

Biometrics Code of Practice

On 3 November 2025, the Privacy Commissioner Biometric Processing Privacy Code 2025, issued under the Privacy Act 2020, enters into force. The Code strengthens existing notification, purpose, and transparency obligations and introduces a requirement for agencies to conduct a proportionality assessment weighing the privacy risks and public benefits of biometric processing, as well as to implement appropriate privacy safeguards. It applies to all biometric identification, verification, and cate...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

21 NOV 2024 · Court Case

Wikeley v Kea Investments Ltd

Pro Se Litigant used Unidentified in proceedings before the . Fabricated: Case Law | Mr Wikeley filed and then withdrew a 10 September 2024 memorandum that cited apparently non-existent cases, attributed by the Court to undisclosed use of generative AI. Outcome: Referred to guidance about AI.

Party: Pro Se Litigant

Secondary evidenceJudicial & Law Enforcement ·Generative AI ·Liability & AccountabilityIssuing institution: Issuing authority not identified

29 OCT 2024 · Policy / Guidance

NZSIS and NCSC guidance on secure innovation: security advice for emerging technology companies

On 29 October 2024, the New Zealand Security Intelligence Service (NZSIS) and the Government Communications Security Bureau’s (GCSB) National Cyber Security Centre (NCSC) released the guidance Secure Innovation: Security Advice for Emerging Technology Companies. The guidance provides information to New Zealand’s emerging technology sector, particularly tech start-ups, to defend against potential espionage and intellectual property theft. The guidance, developed with counterparts from Australi...

Official materialNational StrategyOfficial source · ncsc.govt.nz ↗

23 OCT 2024 · International Agreement

Declaration on joining Bletchley Declaration on AI Safety

On 23 October 2024, the New Zealand government adopted the Bletchley Declaration on Artificial Intelligence (AI) safety, which was already signed by 28 other countries. The Bletchley Declaration is an agreement on international cooperation to address AI risks arising from potential intentional misuse or unintended issues of control of frontier AI, focusing on cybersecurity, biotechnology and disinformation risks. In addition, the parties will collaborate to identify AI safety risks and build ...

Primary legal sourceNational StrategyOfficial source · beehive.govt.nz ↗

16 OCT 2024 · Other

Office of the Privacy Commissioner's guide for organisations on handling privacy complaints

On 16 October 2023, the Office of the Privacy Commissioner issued a guide on handling privacy complaints. The guide outlines a five-step process for organisations, specifically acknowledging the complaint, listening to the complainant, investigating the issues, attempting to resolve the problem collaboratively, and rebuilding trust afterwards. The guide aims to help organisations manage privacy concerns effectively and maintain positive relationships with individuals.

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

16 OCT 2024 · Standard / Framework

OPC Guideline on section 77 of the Privacy Act 2020 on conciliation

On 16 October 2024, the Office of the Privacy Commissioner (OPC) issued guidelines on the use of conciliation under section 77 of the Privacy Act 2020 to resolve privacy complaints. The guideline applies to organisations that may have breached privacy principles, aiming to facilitate early resolution through conciliation meetings rather than formal investigations. It allows parties to negotiate a mutually agreeable outcome, with the OPC providing guidance, though the final decision rests with...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

09 OCT 2024 · Other

National Cyber Security Centre Rolls and Responders Incident Response Testing Resource

On 9 October 2024, the National Cyber Security Centre (NCSC) launched "Rolls & Responders," a new tool designed to help organisations improve their cyber resilience. This resource provides a practical and engaging way for businesses to test their incident response plans, ensuring they are better prepared to handle potential cyber incidents. By offering an easy-to-use, simulation-based approach, the tool aims to simplify the testing process, making it more accessible and less time-consuming fo...

Official materialNational StrategyOfficial source · ncsc.govt.nz ↗

22 SEP 2024 · Law / Act

Budapest Convention and Related Matters Legislation Amendment Bill

On 22 September 2024, the Budapest Convention and Related Matters Legislation Amendment Bill was introduced in the parliament. The Bill aligns with the Budapest Convention and includes provisions such as new "preservation directions" in the Search and Surveillance Act for securing digital evidence, amendments to the Mutual Assistance in Criminal Matters Act to enhance international cooperation, and updates to the Crimes Act to ensure cybercrime offences fully meet the Convention's requirements.

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

02 AUG 2024 · Other

Privacy Commissioner Investigation into Foodstuffs North Island's Facial Recognition Technology Trial

On 8 February 2024, the Privacy Commissioner announced an investigation into the facial recognition technology (FRT) trial initiated by Foodstuffs North Island. The trial, which spans over 25 stores, was requested by the Commissioner to provide evidence that FRT is a justified method to reduce retail crime, considering the privacy implications of using shoppers' biometric information. The Commissioner expressed concerns about the effectiveness of FRT in reducing harmful behaviour in supermark...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

25 JUL 2024 · Other

MBIE Cabinet paper on approach to work on Artificial Intelligence

On 25 July 2024, the Ministry of Business, Innovation and Employment adopted a paper on the approach to work on Artificial Intelligence (AI). The paper applies to both the public sector and the broader economy, focusing on the increasing use of AI across various sectors in New Zealand. The paper highlights that New Zealand faces several challenges in securing the potential of AI, including a general mistrust of AI, low uptake in the economy, and limited adoption in public services, hindering ...

Official materialNational StrategyOfficial source · mbie.govt.nz ↗

22 JUN 2024 · Executive Order

Office of the Privacy Commissioner's guidance on good privacy practices

On 22 June 2024, the New Zealand Office of the Privacy Commissioner (OPC) closes the public consultation on the draft guidance on good privacy practices. The guideline is addressed to businesses and serves as a recommendation on how to implement privacy obligations into business practices. The guidance specifically aims to assist businesses in developing and implementing precautionary and preliminary measures in relation to privacy. In particular, the guidance addresses the topics of governan...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

29 APR 2024 · Other

Safer Online Services and Media Platforms Review

On 29 April 2024, the Department of Internal Affairs (DIA) released a summary report concluding the Safer Online Services and Media Platforms review, formerly known as the Content Regulatory Review. The report release represents the closure of the inquiry. The review aimed to regulate online services and media platforms in New Zealand, focusing on reducing harmful online content while balancing freedom of expression and press freedom. The summary document highlights public feedback on the pro...

Official materialContent ModerationOfficial source · dia.govt.nz ↗

26 MAR 2024 · Other

DIA investigation into terrorist and violent extremist content online

On 26 March 2024, the Department of Internal Affairs (DIA) released its 2023 Digital Violent Extremism Transparency Report. The report provides insights into how DIA identifies and addresses online violent extremism. Key findings include a 25% increase in URL referrals from 2022 to 2023, with 38% of the 886 URLs reviewed deemed objectionable. Platforms such as X/Twitter, Telegram, and TikTok were the most commonly referred. Notably, TikTok removed 81% of reported content before formal request...

Official materialContent ModerationOfficial source · dia.govt.nz ↗

04 MAR 2024 · Executive Order

Reserve Bank of New Zealand Cyber Resilience Reporting Requirements

On 4 March 2024, the Reserve Bank of New Zealand made changes to cyber resilience reporting requirements following a public consultation. Entities, such as registered banks, deposit takers, and insurers, are required to report significant cyber incidents to the Reserve Bank as soon as practicable but within 72 hours. Entities are also required to report all cyber incidents to the Reserve Bank, regardless of materiality, with large entities required to report all cyber incidents every six mont...

Primary legal sourceNational StrategyOfficial source · rbnz.govt.nz ↗

20 FEB 2024 · Other

DCET investigations into illegal CSAM material available online

On 20 February 2024, the Department of Internal Affairs of New Zealand (DIA) published the findings following the Digital Child Exploitation Team (DCET) investigations into illegal material available online, including child sexual abuse material (CSAM). The DIA stated that from January to December 2023, the DCET conducted 47 investigations, which resulted in the discovery of 2’966’773 pieces of illegal material and the seizure of 209 devices. Further, the investigation resulted in the blocki...

Official materialContent ModerationOfficial source · dia.govt.nz ↗

16 FEB 2024 · Other

Young People's Privacy Project

On 16 April 2024, New Zealand's Office of the Privacy Commissioner (OPC) released a report following public consultations on children's privacy. The report highlights a need for regulatory changes to better protect children's privacy. Key concerns identified include a desire to strengthen privacy regulations, possibly introducing a child-specific code of practice, and establishing the right to be forgotten, allowing the deletion of personal information. Public feedback emphasised considering ...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

01 FEB 2024 · Working Paper

Privacy Commissioner Guide on Privacy Impact Assessment

On 1 February 2024, the Privacy Commissioner released a guide on Privacy Impact Assessment (PIA), including information on how organisations engaged in projects involving personal information processing can mitigate risks. The guide includes various tools and documents. The PIA serves as a method for organisations to evaluate and manage privacy risks associated with the collection, use, or sharing of personal information. It ensures projects align with privacy laws, identifies and minimises p...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

07 JAN 2024 · Law / Act

Establishment of Trust Framework Board and Authority in New Zealand Digital Identity Services Bill 2021

On 1 July 2024, the New Zealand Digital Identity Services Bill was implemented. The Bill provides for the establishment of a Trust Framework (TF) for digital identity service providers, including two new administering bodies, the TF Board and the TF Authority. The TF Board would be responsible for drafting and recommending new rules to the responsible minister, educating TF providers and the public, and monitoring the framework's effectiveness. The TF Authority would be responsible for admini...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

07 JAN 2024 · Law / Act

Accreditation of digital identity services in New Zealand Digital Identity Services Trust Framework Bill 2021

On 1 July 2024, the New Zealand Digital Identity Services Bill was implemented. The Bill provides for the establishment of an accreditation regime for digital identity service providers, which are defined as services that allow users to share personal or organisational information as part of a transaction. While participation in the accreditation regime is not mandatory, participants will be able to use accreditation marks (called trust marks in earlier versions of the legislation) to identif...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

03 JAN 2024 · Executive Order

FMI Cyber Resilience Standard 17C

On 1 March 2024, the Financial Markets Authority (FMA) adopted the FMI STANDARD 17C, a Cyber Resilience Standard for Financial Market Infrastructures (FMIs). The standard mandates every operator of a designated FMI, as specified under section 29(2)(f) of the Financial Market Infrastructures Act 2021, to ensure the maintenance of cyber resilience in alignment with the FMI’s exposure to cyber risk. It encompasses operators within various classes of designated FMIs, including pure payment system...

Primary legal sourceNational StrategyOfficial source · fma.govt.nz ↗