This year Tuanz sat down with the technology leaders of ANZ, Transpower, Kiwibank, Freightways, Zespri, AA Insurance, Turners and Tourism Holdings, and published what they collectively think New Zealand should do about AI.
Two things in it stopped me.
The first: these leaders rate New Zealand’s technology adoption at six out of ten, and Tuanz’s chief executive describes the country as stuck — bouncing around the low twenties in international rankings, not moving up, not moving down.
The second: they name unsanctioned AI use inside their own organisations as a major security issue. These are companies with security teams, procurement functions and written policies. They have all of the infrastructure a small business is told it lacks, and their people are still using whatever they like.
That should tell you something about how much of this problem is solved by having a policy.
The two recommendations worth the whole report
At the end, the report offers five implementation recommendations. Two of them are, I think, the most useful paragraphs published about AI in New Zealand this year.
The first says to establish an internal clearing house — a cross-functional group that reviews and approves AI requests — and gives a reason that’s easy to skim past. It reduces shadow AI by giving employees safe, sanctioned alternatives. Not by banning things. By providing something better than what they’d find on their own.
The second says that static IT policies are “no longer sufficient”, and calls for continuous, human-in-the-loop training — teaching people to prompt effectively, to recognise when the machine is confidently wrong, and to make sure a human ratifies anything that affects customers or core operations.
Read that again as a New Zealand business owner. The country’s most senior enterprise technologists are saying that a policy document is not a plan, and that capability has to be built continuously rather than issued once.
Now try doing it with 40 staff
You don’t have a cross-functional council. You have a leadership team of four, three of whom are also doing the actual work. You cannot stand up a clearing house — you’d be the clearing house, on top of everything else you do on a Thursday.
You don’t have a training budget line with an owner. You have a person who’s good with computers and already has a job.
So the brief is right and, as written, unexecutable. Which is, I suspect, exactly why almost nobody outside the enterprise has acted on it.
This is where most good practice goes to die in New Zealand. Not because the advice is wrong, but because it silently assumes scaffolding that a forty-person business doesn’t have and isn’t going to build.
The interesting work is the translation.
What each one becomes at SME scale
Clearing house → one named person and one clear boundary. Not a committee. Someone who decides, and a short, genuinely understandable statement of what’s in bounds and what isn’t. If it can’t be said in a sentence at a team meeting, it won’t be followed.
Continuous capability → not a course. Small, repeated, on real work, at each person’s own pace. The enterprise version has a budget and an owner. The SME version has to be woven into the work itself or it simply won’t happen — there is nobody free to run it. This is the hardest translation and the one that matters most.
Agentic zero-trust → habits now, for systems later. The report’s second recommendation is about treating autonomous AI agents as network users with identity, least-privilege access and logging. Most New Zealand SMEs aren’t deploying agents yet. You will be, and soon — and the habits you set while AI is just drafting text are the habits you’ll have when it starts taking actions.
Pragmatic deployment → exhaust what you already pay for. The report is blunt that businesses should use the AI already sitting inside their existing software before buying anything new. I’d go further: most New Zealand SMEs are paying for AI capability twice and using neither properly.
The uncomfortable bit
I want to be fair to the report, including where it cuts against people like me. It explicitly tells businesses to exhaust what they already own before spending on something new, and to chase hyper-specific, measurable use cases rather than grand programmes.
That’s good advice and I’d give it myself. If a vendor — including one selling capability building — can’t tell you which specific, measurable bottleneck they’re aimed at, they’re selling you a programme, and programmes are what produced a national score of six out of ten.
The test the report sets is a good one to hold anyone to. Including us.