New Zealand

New Zealand has no AI-specific legislation and has signaled it does not intend to write any soon. AI is governed through existing technology-neutral laws covering privacy, consumer protection, human rights, and intellectual property, with regulators expected to apply them to AI harms as they arise. Its July 2025 AI Strategy confirmed that approach, and a binding biometrics code under the Privacy Act now governs facial recognition and similar systems.

Key points

• No AI act and no published plan for one; the government has favored existing frameworks and light-touch guidance.
• New Zealand's first AI Strategy, published in July 2025, confirmed a light-touch, principles-based approach built on existing law.
• The Privacy Act 2020 and the Office of the Privacy Commissioner carry most of the practical load for AI systems handling personal information.
• The Biometric Processing Privacy Code, in force since November 3, 2025, sets binding rules for facial recognition and other biometric systems.
• Consumer protection, human rights, and IP statutes apply to AI on their ordinary terms.
• The Deepfake Digital Harm and Exploitation Bill, a member's bill, passed its first reading on May 20, 2026 and went to the Social Services and Community Committee. Parliament was dissolved on October 1, 2026 for the November 7 general election, so the bill cannot advance until the new Parliament meets. It would extend the Crimes Act and Harmful Digital Communications Act to synthesized intimate recordings.

Laws and instruments

Timeline

• December 2020
  Privacy Act 2020 in force; later applied to AI through Commissioner guidance.
• 2023 to 2025
  Government confirms reliance on existing technology-neutral law rather than an AI act.
• July 2025
  Government publishes its first AI Strategy, confirming a light-touch approach built on existing law.
• November 3, 2025
  Biometric Processing Privacy Code takes effect.
• May 1, 2026
  Information Privacy Principle 3A, on notifying people whose information is collected indirectly, takes effect under the Privacy Amendment Act 2025.
• May 20, 2026
  The Deepfake Digital Harm and Exploitation Bill passes its first reading and goes to select committee.
• August 3, 2026
  Transition period ends for biometric processing that began before the code.
• October 1, 2026
  Parliament is dissolved ahead of the November 7 general election.

Who it applies to

No AI-specific obligations. Organizations deploying AI answer to privacy, consumer, and human-rights law on ordinary terms, and organizations using biometric systems such as facial recognition must comply with the Biometric Processing Privacy Code.

Penalties

No AI-specific penalties; enforcement runs through the Privacy Act and general statutes.

Common questions