Sovereign AI in NZ: model access and data control are two risks

What happened

On 10 November, Māori data governance specialist Karaitiana Taiuru published a Te Tiriti critique of Good Ancestors New Zealand, a Wellington policy group that launched in 2026. Good Ancestors' policy recommendations ask the incoming government to set up an AI Safety Institute and to assess how exposed New Zealand is to losing access to leading AI models. Taiuru argues that the group uses "sovereignty" to mean keeping access to offshore frontier models. According to the critique, the group's work makes no reference to Te Tiriti o Waitangi, Māori data sovereignty or tangata whenua. The sentence from the critique most relevant to business is this one: "A model trained offshore on scraped te reo Māori and mātauranga stays under foreign control, wherever it is hosted."

The exchange looks like a policy argument, but it describes two failure modes found in most AI setups we see in New Zealand organisations. One is the risk that a model you depend on stops being available to you. The other is the risk that your data, or knowledge drawn from it, ends up under someone else's control. Each risk needs its own controls, and a fix for one leaves the other untouched.

Why the access argument has weight

Good Ancestors points to a real event. On 12 June 2026, the US government sent Anthropic a letter prohibiting access to Mythos 5 and Fable 5 for any non-US national, regardless of location, on national security grounds. Anthropic then revoked access to both models for all customers. Al Jazeera reported that Anthropic said the letter didn't explain the government's security concern in detail. The Department of Commerce lifted the restrictions on 30 June, and access returned on 1 July.

In the group's AI election scorecard release on 19 October, executive director Dylan Chambers noted that New Zealand builds none of its own leading models and lost access to one of the most capable models for almost three weeks without notice. The scorecard found that the Opportunity Party was the only party formally committed to maintaining access to leading models. National had agreed to a Five Country statement committing to timely access to frontier models.

The June episode matters for private firms as much as for government. The directive applied to non-US nationals wherever they were located. An Auckland company running a US model on onshore infrastructure would still have lost access, because the restriction applied to the users and the model, whatever the hosting location.

Why the control argument has weight

Taiuru's point runs in the other direction. Hosting a foreign model in New Zealand changes where processing happens. The foreign vendor still controls the model's training data, its weights and the decision to keep offering it. The critique also cites the Waitangi Tribunal's WAI 2522 report, which found risks to Māori interests in the CPTPP e-commerce provisions. Taiuru argues that the trade agreement routes Good Ancestors proposes for securing model access raise the same risks.

Amazon Bedrock shows both sides of the problem. Since 26 March 2026, New Zealand customers have been able to call Claude models from the Auckland region. Under the Australian geographic inference profile, requests from Auckland go to Auckland, Sydney or Melbourne. Under the global profile, requests can go to any supported commercial AWS region worldwide, and AWS describes the global option as intended for organisations without strict data residency requirements. The Australian profile keeps processing in Australasia, which helps with Privacy Act obligations. The Australian profile doesn't change who owns the model or who can switch it off.

Law firm Simpson Grierson makes a related point in its guidance for boards. Storing data in New Zealand doesn't by itself prevent foreign legal access. A hyperscaler's signed Data Processing Addendum also doesn't automatically satisfy Information Privacy Principle 12 on overseas disclosure. The firm also notes that prompts, logs, embeddings and fine-tuning datasets create secondary-use risk when provider terms allow training on customer data.

What it means for NZ businesses

Most New Zealand organisations using AI depend on one or two US providers through Microsoft 365, ChatGPT, Claude or a SaaS product with a model built in. For routine drafting, a three-week outage would be an inconvenience. For a claims triage workflow, a customer service agent or a document extraction pipeline that replaced manual steps, an outage of that length could mean a backlog and staff who no longer remember the old process.

The control risk affects some sectors more than others. Iwi organisations, health providers, education providers and government suppliers often hold te reo Māori content, mātauranga or data about Māori individuals and communities. Sending that material to an offshore model can conflict with the expectations of the people it came from, even when the vendor's contract says it won't train on customer data. Taiuru's critique is a useful prompt to ask who governs that data once it's inside a model pipeline.

Open-weight models running on hardware you control address both risks to a degree. A foreign government can't revoke a downloaded model, and your prompts stay on your premises or with a New Zealand host. The trade-off is capability. Open-weight models a business can realistically run usually trail the strongest hosted models on hard reasoning tasks, so most firms will end up with a mix. We cover the hardware and model options on our private AI server page.

The incoming government's position on model access and Māori data sovereignty hasn't been announced. Good Ancestors frames its recommendations for that government, and the coalition parties' scorecard positions point to a reactive approach. Businesses shouldn't wait for national policy before managing their own exposure.

Practical next steps

• Map your model dependencies. List each workflow that calls an AI model, which vendor and model it uses, and what staff would do if the model were unavailable for three weeks. Rank the workflows by business impact.
• Build for portability. Route model calls through a single internal layer instead of hard-coding one vendor's API. Keep a test set of real prompts and run the set against a second model each quarter, so switching becomes a configuration change.
• Set up a fallback tier. For the two or three highest-impact workflows, test an open-weight model on a local server or with a New Zealand host. Record where the fallback model falls short so the gap is known before you need the fallback.
• Classify data before it reaches a model. Mark Māori data, health information and commercially sensitive material, and set rules for which classes may go to offshore models. Check overseas disclosures against IPP 12 instead of relying on the vendor's processing addendum.
• Check routing settings. If you use Bedrock, confirm that residency-sensitive workloads use the Australian geographic profile and that nobody has switched those workloads to the global profile to get more throughput.
• Put AI vendor risk on the board risk register. Record export controls, sudden policy changes and price changes as named risks with owners. Our AI consultancy team can help set up that governance.

The debate between Taiuru and Good Ancestors won't be settled soon. The June cut-off showed that access can disappear overnight, and Taiuru's critique shows that onshore hosting doesn't settle who controls a model. Firms that plan for both risks now will have more options when the next disruption comes.