Initial advice on Generative Artificial Intelligence in the public service (New Zealand)

• Authority: Government of New Zealand
• Jurisdiction: Other countries
• Collections: Miscellaneous documents
• Most recent activity: Enacted
• Most recent activity date: 2023-07-01

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Compromise of privacy
• AI system security vulnerabilities
• False or misleading information
• Overreliance and unsafe use
• Loss of human agency and autonomy
• Governance failure
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Unequal performance across groups
• Disinformation, surveillance, and influence at scale
• Cyberattacks, weapon development or use
• Fraud, scams, and targeted manipulation
• AI pursuing its own goals
• AI possessing dangerous capabilities

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 12-14 subdomains, with strong focus on privacy compromise (2.1), security vulnerabilities (2.2), false information (3.1), disinformation/surveillance (4.1), fraud/manipulation (4.3), overreliance (5.1), loss of agency (5.2), governance failure (6.5), goal misalignment (7.1), dangerous capabilities (7.2), lack of robustness (7.3), and lack of transparency (7.4). Coverage is concentrated in privacy, security, misinformation, human-computer interaction, and AI system safety domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• National Security

All other sectors had no coverage in this document.

Sectors Summary

This document primarily governs AI use within the Public Administration sector, specifically the New Zealand Public Service. It provides guidance for government agencies across all their functions and operations, with no specific focus on other economic sectors beyond public administration.

Legislative Status

Soft Law

Legislative Status Summary

This is non-binding guidance using voluntary language ('recommend', 'encourage', 'suggest') with no formal enforcement mechanisms or legal penalties. It is interim advice from system leaders to support agencies in making informed decisions about GenAI use.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Data, digital, privacy, procurement and security System Leaders; Government Chief Privacy Officer (GCPO)
• Summary: The document is authored by System Leaders representing data, digital, privacy, procurement and security functions across the New Zealand Public Service, providing collective guidance on GenAI use.

Target

• Entity Types: AI_Governance_Actor, AI_Deployer
• Entities: New Zealand Public Service agencies; public service procurement, data, digital, privacy and security leaders; public servants
• Summary: The guidance explicitly targets New Zealand Public Service agencies and their functional leaders who are considering using or deploying GenAI tools in government operations.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Government Chief Privacy Officer (GCPO); agency senior leaders
• Summary: The GCPO receives privacy impact assessments and policies for oversight purposes, while agency senior leaders are responsible for approving GenAI decisions and governance within their organizations. However, enforcement is advisory rather than punitive.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Government Chief Privacy Officer (GCPO); agency governance systems; Te Tiriti partners
• Summary: The GCPO monitors through receiving PIAs and policies to identify support needs. Agencies are expected to establish their own governance and monitoring systems, with involvement of Te Tiriti partners where Māori data or interests are affected.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document covers multiple lifecycle stages with primary focus on Deploy and Operate and Monitor stages. It addresses planning considerations, data handling, model use, validation requirements, deployment decisions, and ongoing monitoring. The guidance emphasizes governance throughout the lifecycle but is particularly detailed on deployment safeguards and operational monitoring.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Generative AI

Technical Scope Summary

The document explicitly focuses on Generative AI (GenAI) as its primary scope, with detailed definitions and examples. It mentions AI more broadly in context but does not explicitly address frontier AI, general purpose AI, task-specific AI, foundation models, predictive AI, open-weight models, or compute thresholds. The scope is clearly GenAI tools and systems used within the New Zealand Public Service.