AI Strategy: global and NZ examples, policy frameworks, regulations, and…

Research Question

What do leading global AI strategies look like, how does New Zealand's regulatory and policy landscape (RBNZ, DIA, MBIE, and others) compare, and what use-case typology — from human augmentation through to fully agentic business units — best describes where organisations should focus their AI adoption efforts given their context and objectives?

Findings

Executive Summary

New Zealand released its first national AI strategy, Investing with Confidence, in July 2025. It is adoption-focused and deliberately light-touch: the government chose to use existing legal instruments rather than introduce AI-specific legislation. The strategy aligns with OECD AI Principles and is led by MBIE, with supporting roles for DIA, RBNZ, and the Privacy Commissioner. Internationally, strategies diverge sharply — the EU has enacted binding risk-based law; the US relies on executive action and voluntary standards; Singapore runs a collaborative, testbed-driven model. For organisations navigating this landscape, the most useful planning lens is a four-type use-case typology (augmentation → agentic business units) combined with March's exploit/explore distinction, which exposes whether an AI investment is deepening existing capability or genuinely searching for new advantage.

Key Findings

1. Global strategies share eight common pillars — foundational research, human-AI symbiosis, ethical/legal frameworks, trust and safety, AI infrastructure, workforce formation, governance, and export controls — but diverge significantly on enforcement model. The EU mandates compliance via the AI Act; the US, UK, and Singapore operate largely through voluntary or sector-specific guidance.

2. NZ's "Investing with Confidence" (July 2025) is a sophisticated-adopter strategy, not a leadership play. It estimates $76B in GDP uplift by 2038 from targeted adoption in agriculture, healthcare, and education. It is principles-based, relies on existing laws (Privacy Act 2020, Human Rights Act, Consumer Law Reform Bill), and explicitly declines to create new AI-specific regulation at this stage.

3. NZ's regulatory landscape is fragmented across agencies with no single AI regulator. MBIE leads strategy; DIA governs the Algorithm Charter for Aotearoa and digital public services; RBNZ has AI considerations embedded in prudential risk supervision; the Privacy Commissioner enforces Privacy Act 2020, which has broad reach over automated decision-making involving personal data.

4. NZ political alignment on AI is asymmetric: the National-led coalition (with ACT and NZ First) backs light-touch, pro-growth adoption. Labour's last government created the Algorithm Charter and would likely favour stronger oversight if returned to power. The Greens push for binding ethical guardrails and environmental safeguards on AI. Current bipartisan consensus exists only on the economic opportunity; the regulatory approach is contested.

5. NZ case law on AI is thin but moving fast. Wikeley v Kea Investments Ltd [2024] NZCA 609 is the leading case — it flagged AI-hallucinated citations as a material procedural risk. The judiciary published generative AI guidelines in December 2023. No binding case law yet governs the legality of automated government decisions; that terrain is anticipated, not settled.

6. The dominant policy frameworks are complementary, not competing. EU AI Act provides risk classification (unacceptable / high / limited / minimal); NIST AI RMF 1.0 (Govern / Map / Measure / Manage) provides voluntary best-practice process; ISO/IEC 42001:2023 provides a certifiable management system; DORA (EU 2022/2554) is not an AI framework per se but catches any AI system that affects the operational resilience of covered financial institutions. ISO 42001 implementation is the strongest evidence base for EU AI Act high-risk compliance.

7. Singapore's Model AI Governance Framework (2024 Gen-AI update) is the most operationally useful reference for NZ financial services organisations. Its nine dimensions — accountability, data, trusted development/deployment, incident reporting, testing and assurance, security, content provenance, safety and alignment, AI for public good — translate directly to internal governance design.

8. The four-type use-case typology captures meaningful strategic distinctions:

   • Type 1 — Augmentation: AI assists humans; humans decide and act. Examples: copilots, analytics dashboards, document summarisation. Risk is primarily quality and over-reliance.
   • Type 2 — Agentic builders: AI generates artefacts (code, reports, contracts, designs) that humans review and approve. Risk is accuracy, IP, and accountability for outputs.
   • Type 3 — Delegated authority agents: AI makes decisions within defined parameters with human escalation paths. Examples: credit pre-screening, fraud flagging, dynamic pricing. Risk is bias, explainability, and regulatory exposure.
   • Type 4 — Fully agentic business units: AI operates an organisational function end-to-end with periodic human governance. Emerging but not yet mainstream. Risk is systemic — loss of oversight, correlated failures, accountability gaps.

9. The exploit/explore distinction from March (1991) is the most important strategic framing device not in NZ's current policy discourse. Exploitation AI investment (refining known patterns, optimising cost, reducing error rates) returns value quickly but does not create durable advantage. Exploration AI investment (discovering new capabilities, entering new value spaces, redesigning operating models) carries higher risk and delayed return but is the source of compounding strategic advantage. Most NZ organisations are currently in exploitation mode. The risk is "competency traps": locking into AI as an efficiency tool while competitors use exploration to redefine what efficiency means.

Assumptions

• Assumption: The NZ AI Strategy document retrieved (July 2025) represents the current authoritative government position. Justification: MBIE's official website, the Beehive publication, and multiple independent legal commentators consistently reference the same document.
• Assumption: "Investing with Confidence" will not be materially superseded by new legislation within the 12-month horizon of this research. Justification: The strategy explicitly declines new AI law at this stage; no active bills in Parliament as at research date.
• Assumption: DORA's AI implications for NZ financial institutions depend on whether those institutions have EU-regulated entities or EU-facing services. Justification: DORA's jurisdictional reach is the EU financial sector; NZ institutions with European subsidiaries or operations are in scope, others are not directly bound.
• Assumption: The four-type typology captures the strategic distinctions that matter for NZ senior leaders. Justification: Built from evidence (MIT CISR, McKinsey, BCG maturity models); additional sub-types exist but are distinctions within types, not new categories.

Analysis

Where NZ sits globally: NZ's strategy is well-positioned as a sophisticated adopter. The decision to use existing law rather than introduce new AI-specific regulation is defensible given the pace of change — locking in regulatory definitions of "AI system" risks obsolescence within a legislative cycle. The light-touch approach is also consistent with NZ's resource constraints and trade relationships. The risk is that it leaves gaps in enforcement where existing laws do not clearly reach (e.g., automated government decisions, bias in private-sector AI affecting protected groups).

The agency coordination problem: Having MBIE lead strategy, DIA govern the Algorithm Charter, RBNZ supervise financial AI risk, and the Privacy Commissioner handle personal data creates genuine coordination gaps. No agency owns cross-sectoral AI risk. This is common internationally — the US has similar fragmentation — but it means NZ organisations face regulatory uncertainty about which agency's guidance prevails when frameworks overlap or conflict.

Political risk: The current government's light-touch approach is subject to electoral revision. If Labour returns to government, a shift toward binding algorithmic accountability standards is probable given their prior Algorithm Charter work. Organisations building AI-dependent processes should design for this regulatory shift, not against it.

Use-case typology for NZ organisations: Most NZ enterprises are currently deploying Type 1 (augmentation) and Type 2 (agentic builders). Type 3 deployments (delegated authority) are concentrated in financial services and utilities. Type 4 (fully agentic business units) is experimental globally and not yet a near-term NZ reality for regulated industries. The strategic question is whether organisations are progressing through this typology with deliberate governance design or by default.

Exploit vs explore in NZ context: The dominant narrative in NZ's strategy is exploitation — using AI to make existing processes more efficient. This is rational given productivity gaps (NZ's long-standing productivity challenge) but incomplete. The $76B GDP estimate implicitly assumes exploration as well: new sectors, new business models. There is a structural tension between a strategy aimed at catching up (exploit) and one aimed at getting ahead (explore) that the current document does not fully resolve.

Framework selection for NZ organisations: The practical stack for a NZ-headquartered organisation is: NIST AI RMF for internal risk process design; ISO/IEC 42001 for certifiable governance (especially if exporting to EU markets or dealing with EU counterparties); Singapore's Model AI Governance Framework as a sector-tested operational reference for financial services; EU AI Act awareness for any system that might be classified high-risk under EU definitions.

Risks, Gaps, and Uncertainties

• NZ enforcement gap: With no AI-specific legislation and no clear lead regulator for cross-sectoral AI risk, it is unclear who enforces against, say, a biased recruitment AI used by a large NZ employer. The Privacy Act 2020 may reach this in some scenarios; it likely does not in others.
• RBNZ position: As at research date, RBNZ has not published a standalone AI strategy or supervisory expectation document. RBNZ AI risk considerations are embedded in ICT risk supervision, but the specific expectations for AI-assisted credit decisions, stress testing, or fraud detection are not publicly documented.
• Thin NZ case law: The absence of binding case law on automated government decision legality means the legal risk for early movers is unquantified. This is a feature of the current landscape, not a permanent state.
• Typology boundary cases: Type 2 and Type 3 blur when an "agentic builder" produces artefacts that are acted upon without meaningful human review. Many organisations believe they are in Type 2 but are functionally in Type 3.
• Exploit/explore measurement: There is no established NZ organisational metric for whether AI investment is exploitation or exploration. Without this, the strategic intent in budget processes is invisible.
• EU AI Act extraterritorial reach: NZ organisations supplying AI systems or outputs to EU entities may be subject to EU AI Act requirements even without EU establishment. The extraterritorial application is unsettled in practice.

Open Questions

• What are RBNZ's specific supervisory expectations for AI use in NZ-regulated financial institutions? (No public document found — potential Official Information Act request or engagement with RBNZ prudential team.)
• How do DIA's Algorithm Charter attestation processes work in practice, and which agencies are currently compliant?
• Are there any NZ cases before the Employment Court or Human Rights Review Tribunal involving AI-assisted HR decisions? (NZLII search warranted with terms: "algorithm", "automated", "AI" + "employment" + 2022-2025.)
• What corporate AI strategy frameworks (not national strategies) have been published by NZ-headquartered companies? The research surfaced global consulting frameworks but no NZ-specific corporate examples.
• How should organisations distinguish between exploitation and exploration AI investment in their portfolio planning processes? A decision tool or framework for this would be strategically valuable.

sources

• [x] OECD AI Policy Observatory — country policy notes for NZ and comparator countries (oecd.ai)
• [x] NZ Government "Algorithm Charter" and associated agency attestations (data.govt.nz)
• [x] NZ political party AI policy documents: National, ACT, NZ First coalition agreement AI-relevant clauses; Labour and Green party policy statements (parliament.nz, party websites)
• [x] RBNZ — any publications or speeches on AI in financial services regulation
• [x] DIA — "Digital Strategy for Aotearoa" and related AI-specific guidance
• [x] MBIE — "Digital Technologies Industry Transformation Plan" and related workforce/AI material; NZ AI Strategy "Investing with Confidence" (July 2025)
• [x] EU AI Act (consolidated text, 2024)
• [x] DORA (EU) Regulation 2022/2554 — ICT risk management and AI capability references
• [x] NIST AI Risk Management Framework 1.0 (2023)
• [x] Singapore IMDA/MAS "Model AI Governance Framework" (2020, updated 2023/2024)
• [x] ISO/IEC 42001:2023 — AI management systems standard
• [x] March, J.G. (1991). "Exploration and exploitation in organizational learning." Organization Science. (foundational exploit/explore framing)
• [x] NZLII — NZ case law search (Wikeley v Kea Investments Ltd, NZCA 609, 2024)
• [x] Commercially published AI strategy frameworks: McKinsey, BCG, Gartner, MIT CISR research on AI maturity models