NZ First's AI national interest test and where your data sits

What NZ First has put on the table

On 2 November, Stuff reported that NZ First's technology spokesperson, David Wilson, has floated a "national interest test" for foreign frontier AI models and AI infrastructure projects. Any model or project that broke the test's rules on sovereign data or security would likely be banned. Wilson wants domestic AI infrastructure built before any central AI office is set up. According to the same report, NZ First hadn't yet released a dedicated AI policy, and Wilson left the timing of one to the party leadership.

The proposal arrived five days before New Zealand votes on 7 November, and several other parties had already set out positions on who controls New Zealand data. Labour's AI in New Zealand's Interests plan says Labour would look at how to strengthen the country's control over its data. Labour would also work with iwi and hapū on how Māori data is collected and governed, and it would put an Office of AI inside the Department of the Prime Minister and Cabinet. That office would set expectations for government procurement. The Greens' policy, as the NZ Herald reported on 12 October, calls for stronger data protection and explicit consent standards for AI training data. A University of Auckland commentary notes that the Green policy also backs research into locally built language models to cut reliance on foreign vendors. A Law News comparison of party AI policies records NZ First supporting local storage of citizens' personal information held by public agencies. The same comparison records Te Pāti Māori's proposal for a Māori governance entity with authority over Māori data.

Why private businesses should pay attention

None of these proposals is law yet. Each one would have to survive coalition negotiations after Saturday's vote. Even so, the party positions point the same way: more scrutiny of where data goes when New Zealand organisations use foreign AI services.

Most of the sovereignty commitments target the public sector. Private firms will still feel them through procurement. A software vendor, contact centre or professional services firm that handles government data could find new hosting or model requirements written into its contracts once an incoming government sets procurement expectations. A ban on a named foreign model would reach further still. Any business whose quoting, support or document workflows call that model through an API would need a replacement, possibly at short notice.

Under current law, New Zealand has no general data localisation rule. The Office of the Privacy Commissioner's guidance on disclosing information outside New Zealand explains that when a cloud provider holds personal information purely as an agent, the law treats the customer as the holder. In that arrangement the overseas cross-border rule doesn't apply. The position changes when the provider uses or discloses the information for its own purposes, and an AI vendor training its models on customer prompts is the obvious example. In that case Information Privacy Principle 12 applies. An organisation can then send personal information offshore only under set conditions, such as the individual's informed authorisation or a reasonable belief that the recipient faces comparable privacy protections.

Data residency and data control are separate questions

Keeping a server in Auckland answers one question about your data and leaves another open. The University of Auckland commentary points out that the US CLOUD Act can require American providers to hand over data they control even when the data is stored outside the United States. The Law News analysis makes a related point: a server's New Zealand location doesn't establish who controls access or authorises reuse.

An October essay published by the University of Auckland's ALTeR centre covers the same gap from the buyer's side. Its author, Deborah Manning, observes that a European model provider gives no sovereignty guarantee by default, because its models are also served through Azure, AWS and Google Cloud. Calling such a model through a US cloud puts the data in reach of US law. The essay also notes that compliance with the Privacy Act 2020 doesn't stop a foreign legal process. Manning suggests firms plan for losing a key cloud or AI service in the same way they plan for fire or ransomware, and she accepts that replacing Microsoft 365 outright isn't realistic for most New Zealand organisations.

What we'd draw from the week's news

A national interest test would put a political judgement over individual AI suppliers. Firms that can't say which model handles which workload, or which country's law governs the processing, would struggle to respond if one of those suppliers were restricted. Most organisations can fix that gap with an inventory and some contract reading. A full rebuild isn't needed.

Sorting workloads by sensitivity is the useful exercise. Routine marketing copy sent to an offshore model carries little exposure. Client files, health information and anything covered by government contracts carry much more. Firms that keep the high-exposure work on a privately hosted model can keep using commercial AI services for the rest and still answer a procurement questionnaire with confidence.

Practical next steps

• List every AI service your staff use, including features built into Microsoft 365, CRM or ERP systems. Record the model provider, the hosting region and the company that operates the infrastructure.
• Read each provider's terms on prompt retention and model training. A provider that trains on your data is using it for its own purposes, and IPP 12 then applies.
• Classify your AI workloads by data sensitivity, and decide which of them need onshore processing under a provider you control.
• Check government and enterprise customer contracts for hosting or sovereignty clauses, and note which ones are up for renewal in 2027.
• Write a fallback for your most important AI-dependent process, naming the alternative model or manual procedure you'd switch to if a supplier became unavailable.
• Watch the coalition agreements after 7 November for any commitment on AI procurement, a national interest test or an Office of AI. Those agreements will show which proposals have a chance of becoming policy.

For help weighing hosted, onshore and private options against your own risk profile, our AI consultancy team works through these trade-offs with NZ and Australian organisations.