New Zealand's first national AI strategy, Investing with Confidence, is a year old. It promised light-touch regulation, business guidance, and confidence-building rather than compliance-building. Twelve months on, we have enough evidence to judge the experiment: the settings are working better than the sceptics feared, and less than the adoption numbers suggest.
What You Need to Know
- The strategy held its shape. No AI-specific legislation has arrived and none is signalled. New Zealand remains principles-based: Privacy Act, Fair Trading Act, sector law, plus voluntary Responsible AI guidance for business.
- The SME machinery is real. The AI Advisory Pilot has run since 19 January 2026, co-funding expert AI advice for small businesses (up to 50%, capped at $15,000 per business), a concrete answer to the "where do we even start?" problem.
- Adoption is up, value is concentrated. Business AI use sits above 80% in every recent survey, and Deloitte's NZ research shows adopters materially out-earning non-adopters. But most adoption remains shallow, tool-level use.
- Targeted rules are arriving where risk is sharpest, not economy-wide: the Biometric Processing Privacy Code fully applies from 3 August 2026.
What the Strategy Got Right
The core bet was that New Zealand's problem is under-adoption, not under-regulation, and the year's evidence backs it. With adoption above 80% and local research now quantifying the earnings gap between adopters and non-adopters, the strategy's diagnosis looks correct: the binding constraint on AI value in this economy is capability and confidence, not legal uncertainty.
The confidence machinery matters more than it looks. The Responsible AI Guidance for Businesses gives SMEs a starting framework that doesn't require a law firm to interpret. The AI Advisory Pilot, running since January with a cohort of small and medium businesses, is the most practical thing any government has done here: subsidised, trusted, hands-on advice at the exact point where most SMEs stall. If it scales beyond the pilot, it's the difference between a strategy document and an adoption programme.
And the light-touch position aged well internationally. Australia has now abandoned its mandatory guardrails proposal and landed on nearly identical settings, while the EU pushed most of its high-risk obligations out to 2027 and beyond. A year ago, light-touch looked like an outlier position. Today it looks like the emerging Anglosphere consensus.
What the Strategy Can't Do for You
Here's the honest reading for business leaders: the strategy removed the excuses, and that's roughly all a strategy can do. Nothing in it closes the gap between the 82% who use AI and the small minority extracting serious value from it. That gap is closed inside organisations, one redesigned workflow at a time, and the local evidence says the return on doing so now has a dollar figure.
Three moves we'd recommend with the settings as they are:
- Treat the guidance as your floor, not your ceiling. The voluntary framework is what regulators, customers, and courts will consider reasonable practice. Meeting it is table stakes; exceeding it is a trust asset.
- Watch the codes, not the acts. New Zealand regulates here through targeted instruments where risk concentrates. Biometrics got a code with full effect from 3 August. If your sector touches health data, children, or credit, assume you're on the shortlist for the next one.
- Use the window. Light-touch settings plus proven local ROI plus most competitors stuck at shallow adoption is an unusually favourable alignment. Windows like this close, usually because the leaders pull far enough ahead that following gets expensive.
The strategy's first year answered the policy question. The next year answers the interesting one: whether New Zealand businesses actually use the room they've been given.