Practical guide / AI governance
For New Zealand organisations using or developing AI, MBIE’s voluntary business guidance and ISO/IEC 42001 serve different purposes. This guide connects selected themes to practical management-system decisions, without treating either document as a substitute for applicable obligations.
Prepared by Aegentra · Source references checked
Start with the distinction
MBIE’s business guidance is voluntary and does not remove relevant legal requirements. Its governance and accountability section explicitly points readers to ISO/IEC 42001 among useful risk-management resources. A reference is not a government requirement to certify, or approval of Aegentra’s services.
ISO describes ISO/IEC 42001:2023 as a requirements standard for an AI management system covering organisations that provide or use AI. The planning connections below are our interpretation of how related work can be organised. They do not reproduce the standard or demonstrate conformity with its clauses.
Six working questions
Use the source links to read MBIE’s advice in context. Each card adds an original Aegentra question and a suggested evidence record. Adjust these to your AI use and responsibilities; they are not a mandatory document list.
AIMS planning connection: Management-system scope and objectives
Which specific task will use AI, who is affected, and which decisions must stay outside its scope?
Evidence to consider: A one-page use-case record with an owner, intended benefit, exclusions and a review trigger.
AIMS planning connection: Governance and risk-management arrangements
Who can approve this use, accept the remaining risk or stop it when circumstances change?
Evidence to consider: An approval record linking the risk decision, responsible person and unresolved actions.
AIMS planning connection: Resources and operational controls
What must the supplier demonstrate, and what must users be able to do before access is granted?
Evidence to consider: Supplier questions, an access decision and a role-specific training check, rather than attendance alone.
AIMS planning connection: Information and feedback arrangements
Who needs an explanation, and where can they challenge an AI-assisted result?
Evidence to consider: An explanation appropriate to the audience, a feedback owner and an example of a resolved concern.
AIMS planning connection: Controls for intended AI use
What information may enter the tool, and what does a person check before an output is used?
Evidence to consider: An allowed-input rule, a documented review step and retained examples showing corrections.
AIMS planning connection: Monitoring and continual improvement
What event would make the approval unsafe or out of date, and who reassesses it?
Evidence to consider: A change log and review record covering incidents, feedback, supplier changes and the decision to continue or stop.
A fictional worked example
Consider a fictional New Zealand professional-services business testing an AI tool to draft routine client emails. The initial proposal is to save writing time. Before a pilot, the owner needs a narrower decision: which emails, which input information, who checks the draft and what would stop the trial?
Illustrative planning choices, not a client case study, tested outcome or legal recommendation. They must be adapted to the organisation and application.
Free original resource
The CSV contains all six planning prompts, source links and blank fields for your use case, owner, evidence location, unresolved issue and review trigger. No registration is required. Keep sensitive evidence in your approved systems; the worksheet can hold references rather than the underlying records.
Download the AI governance worksheet (CSV)An Aegentra planning cross-reference, not an official MBIE or ISO mapping, a clause-by-clause checklist, legal advice or a compliance determination.
For broader risk-management context, use the NZ ISO 31000 cross-reference worksheet (CSV and PDF). It is also a planning aid, not a list of every New Zealand obligation.
Before you use it
MBIE describes its business guidance as voluntary and links ISO/IEC 42001 as a useful resource. That is not a blanket certification requirement or an endorsement of a provider. Assess applicable law, contracts and sector requirements separately.
No. The worksheet records decisions and evidence gaps. Its connections are Aegentra’s interpretation, not an official equivalence between the guidance and ISO 42001. A requirements assessment needs the current standard, the actual scope and appropriate evidence.
Yes. ISO describes ISO 42001 as applicable to organisations providing or using AI products and services. Start with the use you control, the supplier information you need and your responsibility for decisions; buying a tool does not make its governance your supplier’s responsibility alone.
This guide has no course-purchase requirement. Begin by identifying the AI use, owner and decision to be made. Training can address a defined knowledge gap, while implementation and independent internal audit are separately scoped activities.
Choose the work you need
If the priority is building a working system, explore ISO 42001 implementation. If it is evaluating an existing system against agreed criteria, discuss an independently scoped internal audit. Auditor impartiality and prior involvement need to be checked separately.
For individual learning, compare ISO 42001 Foundation, Lead Implementer and Lead Auditor. A course purchase does not implement or certify your organisation’s management system.
Sources and method
Aegentra prepared the planning questions and fictional example by comparing the cited MBIE themes with ISO’s public description of its AI management-system standard. No named external reviewer, government endorsement or official clause-level mapping is claimed. Check the current publications and the standard before deciding applicability.