Seven Governance Questions NZ Businesses Should Answer Before Starting an AI Workflow

Governance starts with purpose and data minimization

Write down why the process needs AI, whether it could be solved without it, what personal or sensitive information enters, and whether each data item is truly necessary. The fuzzier the scope, the harder every later decision on vendors, permissions and retention becomes.

Seven pre-launch questions

These are not legal advice — they are an operating checklist an implementation team should be able to answer with evidence.

• Purpose: what problem does this solve; what are the success and stop criteria?
• Information: what personal information enters; can it be reduced or de-identified?
• Vendors: where does data go, how long is it kept, is it used for training?
• Accuracy: what real test set evaluates it, and who approves launch?
• Human review: which decisions must be confirmed by someone accountable?
• Transparency: when do customers and staff need to know AI is involved?
• Ongoing review: how are complaints, exceptions, stale knowledge and vendor changes handled?

Treat the PIA as a living design document

New Zealand’s Privacy Commissioner recommends conducting — and continuously updating — a Privacy Impact Assessment before using AI on personal information. In practice: when the process, fields, vendors or purpose change, the assessment changes too.