From informal AI use to governed, productive, insurable AI.
Your staff are already using AI. The question is not whether to adopt it – it is whether you are getting the real productivity from it, whether the right controls are in place, and whether your board and insurer have the visibility they need.
Most NZ businesses are somewhere between experimenting informally and building real workflows. The gap between those two stages is not technology. It is a clear plan, the right guardrails, and someone who knows what they are doing.
NSP’s AI services help NZ businesses move from informal AI use to governed, productive, insurable AI – at a pace that works for your business. We could start with a Snapshot that shows you exactly where you stand and where the real opportunities are. From there, we build the programme around your priorities.
The goal is not compliance for its own sake. The goal is AI that actually works for your business and that your board, your insurer, and your clients can have confidence in.
How NSP Helps You Move Forward with AI
AI Roadmaps & Strategy
Before you build an AI strategy, you need to know where you actually are. NSP starts with a structured discovery of what AI tools your staff are already using, what data those tools are touching, and where the real productivity opportunities sit.
From that baseline, we design a practical, staged AI roadmap tailored to your business – not a generic framework. It maps where AI can save your team time right now, which workflows to build first, and what governance needs to be in place before each stage goes live.
The roadmap is something you can present to your board and act on with your team. It is not a document that sits in a folder.
AI Governance Frameworks
NSP aligns your AI use with the frameworks your board, auditor, and insurer will increasingly reference. Not to add compliance burden but to give your governance programme the credibility it needs with the people who matter.
We work with OECD AI Principles, the NIST AI Risk Management Framework, ISO/IEC 42001, and the EU AI Act risk categories – applied practically to your NZ business environment, not delivered as a consultancy report full of framework jargon.
For most NZ SMEs, the practical output is an AI acceptable use policy, a documented risk register, staff training records, and a governance structure that maps to what your insurer is starting to ask for.
Compliance & Risk Management
AI use creates compliance obligations most NZ businesses have not mapped yet. The Privacy Act 2020 applies the moment an AI tool handles personal information – which most of them do. Sector-specific obligations in legal, finance, and healthcare add further requirements.
NSP maps your current AI usage against your actual compliance obligations. We identify where your existing controls apply, where the gaps are, and what needs to change. The output is a risk register your board can read and act on and that your insurer can reference at renewal.
If your staff are using ChatGPT, Microsoft Copilot, or any other AI tool with client data, customer information, or anything personal – this is where you need to start.
Responsible AI Development Support
If your business is moving from using AI tools to building or integrating AI – embedding it into a product, automating a workflow, or developing an AI-driven service – NSP can provide hands-on technical and governance support.
This covers secure API integration, data handling and privacy compliance, model governance, bias and output review, and the documentation required to demonstrate responsible AI development to clients, partners, or regulators.
Most NZ businesses are not at this stage yet. If you are, get in touch – this work is scoped specifically to what you are building.
Where Does Your Business Sit on the AI Journey?
Most NZ businesses are at one of five stages when it comes to AI. Understanding where you are is the starting point for making progress safely.
Stage 1 – Adhoc AI use. Staff are using AI individually – ChatGPT for drafting, AI tools for research, personal productivity apps. Usage is informal and often invisible to leadership. Data leakage, inconsistent outputs, and no audit trail.
Stage 2 – Basic AI awareness. The business recognises AI as important. Some basic guidelines are set. Early use cases are being identified. Staff avoid AI or use it inconsistently outside approved channels.
Stage 3 – Controlled productivity use. Approved AI tools are used for everyday tasks – meeting notes, document review, internal search. Guardrails are in place. The limiting factor is data governance and permissions.
Stage 4 – Business process enablement. AI supports repeatable business processes across sales, customer service, finance, and operations. The risk is automation errors and unclear accountability when AI gets it wrong.
Stage 5 – Governed AI-enabled business. AI is embedded in the operating model. Strong governance, data quality, security, and leadership oversight drive sustainable value.
Most NZ SMEs are at Stage 1 or 2. The NSP Secure AI Accelerator is designed to move you from wherever you are to Stage 3 and beyond – safely, in 12 months, with governance and productivity improving together.
NSP Secure AI Accelerator
A 12-month programme that helps NZ businesses get real productivity from AI, control their cyber risk, and give their board and insurer the confidence they need.
Built for NZ SMEs. Delivered by NSP’s team. Starting with a Snapshot.
The Snapshot is a focused diagnostic – completed before the programme begins – that identifies your AI opportunity (where AI can save your team time right now), your AI exposure (which tools staff are using, with what data, and what governance gaps exist), and your three priorities (what to fix first, why it matters, and what to do about it).
The Snapshot gives you and NSP the information needed to build a programme that actually reflects your business, rather than a generic framework.
Every month throughout the programme: one hour with your dedicated NSP expert, a monthly risk report, and a quarterly advisory session.
At the end of 12 months: AI working in your business, a maturity scorecard showing how far you have come, and a cyber insurance evidence pack your insurer can rely on.
How the NSP Secure AI Accelerator Works
Q1: Know Your Risk
We start with a full AI audit, a cyber security assessment, an M365 security and AI readiness review, and your AI acceptable use policy drafted. You also get your 90-day action plan – the specific things to do in the first quarter, in the right order. Outcome: You know exactly where your AI and cyber risk sits, what staff are doing with AI, and what needs to change first.
Q2: Build Safely
AI workflows are built and piloted with your team. Staff receive AI awareness and safe-use training. Data hygiene is addressed. Your 12-month AI roadmap is produced – the specific workflows, tools, and timelines for the year ahead. Outcome: AI is working in your business. Staff are confident. The workflows are saving real time.
Q3: Prove It Works
NSP builds your cyber insurance readiness report, your evidence pack, and a board-ready risk summary. Your AI governance policy, staff training records, and risk register are formatted for your insurer. Outcome: You have everything you need for your next renewal conversation – evidence your broker and insurer can rely on.
Q4: Test and Mature
A cyber incident tabletop exercise tests your response capability. Your maturity scorecard shows how far you have come since Q1. Your year two improvement plan is produced. Outcome: You finish the programme with proof of progress, a tested team, and a clear direction for what comes next.
What NSP Delivers Across the AI Journey
AI Readiness Snapshot
A structured diagnostic that identifies where your business sits on the AI maturity spectrum, what your staff are already using AI for, where the real productivity opportunities are, and what governance gaps need to be addressed before you go further. The starting point for everything that follows.
AI Policy & Governance Framework
A practical AI acceptable use policy written for your business – not a legal document, but something your staff will actually read and your board can present. Covers approved tools, data handling rules, what staff can and cannot do with AI, and how breaches of the policy are handled.
Secure AI Implementation
Building and piloting real AI workflows with your team – meeting automation, document review, internal search, customer communications. Workflows are tested, staff are trained, and the data governance required to run them safely is addressed before anything goes live.
Shadow AI & Risk Assessment
Identifying the AI tools your staff are already using – formally or informally – and assessing the risk each one creates. Shadow AI is the biggest AI governance gap in most NZ businesses. Most leadership teams have no visibility of what is happening. NSP maps it, rates it, and gives you a plan.
Staff Training & Awareness
Practical AI awareness and safe-use training for your team. Not a compliance tick-box exercise – actual training that helps staff use AI tools effectively, understand what they should not put into a public AI model, and recognise when AI output needs human review.
Ongoing Monitoring & Assurance
Monthly risk reports, quarterly advisory sessions, and a maturity scorecard at 12 months. AI risks change as tools, data, and business processes change. NSP monitors your AI governance posture on an ongoing basis so your controls keep pace with your usage.
The AI Tools Your Staff Are Already Using
Most NZ businesses do not have a single AI tool to govern. They have several – some approved, many not. NSP helps you govern the tools your staff are actually using.
Microsoft Copilot. If your business runs Microsoft 365, Copilot is either already deployed or being considered. NSP assesses your M365 environment for Copilot readiness – permissions, data classification, access controls, and the governance policy required before Copilot goes live across your team.
ChatGPT and OpenAI tools. The most widely used AI tool in NZ workplaces and the least governed. NSP’s AI policy and training work establishes clear rules for what staff can use ChatGPT for, what data must never enter it, and what review process applies to AI-generated outputs.
Google Gemini. Increasingly embedded in Google Workspace. If your business uses Google tools, Gemini is likely already part of your environment. NSP reviews your Google Workspace configuration for AI readiness and data governance.
Claude and other models. AI tools are proliferating faster than most governance programmes can keep up with. NSP’s ongoing monitoring keeps track of what tools are entering your environment and ensures your policy and training stay current.
The goal is not to block AI tools. It is to make sure the right tools are approved, configured correctly, and used with the right guardrails in place.
Frameworks We Align With
NSP AI governance work is aligned with the frameworks your board, auditor, and insurer will increasingly reference – applied practically to your NZ business, not delivered as a thick consultancy report.
– OECD AI Principles – the internationally adopted framework covering accountability, transparency, safety, and human oversight of AI systems. The foundation of most national AI governance approaches including New Zealand’s.
– NIST AI Risk Management Framework (AI RMF) – a practical framework for identifying, assessing, and managing AI risk across four functions: Govern, Map, Measure, and Manage. NSP uses the NIST AI RMF as a structure for the risk assessment and ongoing monitoring work in the Secure AI Accelerator.
– ISO/IEC 42001 – the international standard for AI management systems. For businesses pursuing formal AI governance certification or preparing for audit, NSP can align programme delivery to ISO 42001 requirements.
– NZ Privacy Act 2020 – AI tools that process personal information trigger Privacy Act obligations. NSP’s governance work maps your AI usage against these obligations specifically.
– EU AI Act risk categories – increasingly referenced by NZ businesses working with European clients or partners. NSP can assess your AI tools against the Act’s risk classification approach.
AI in your Industry
AI in the Legal Industry
AI can transform legal research, contract review, and client communications but it also raises questions of confidentiality, data protection, and ethical use. Governance ensures lawyers adopt AI tools without breaching professional or privacy obligations.
AI in the Real Estate Industry
From automating property valuations to enhancing customer engagement with chatbots, AI can streamline real estate operations. However, compliance with advertising standards, data privacy, and unbiased recommendations is critical.
AI in the Education & Training Industry
AI can personalise learning, automate administration, and support digital classrooms. Governance ensures fair and transparent use, especially in protecting student data and avoiding bias in grading or admissions systems.
AI in the Financial Services & Insurance Industry
AI enhances fraud detection, risk analysis, and customer service in banking and insurance. Yet regulatory compliance (AML/CFT, Privacy Act) means AI adoption must be carefully governed to avoid breaches or bias.
AI in the Startups & Tech Industry
AI offers agility and competitive advantage for startups, but without a governance framework, risks around IP, customer trust, and compliance can derail growth. Governance ensures scalable, investor-friendly adoption.
AI in the Manufacturing Industry
AI can optimise production lines, demand forecasting, and logistics. But poorly governed adoption can cause operational disruptions and cybersecurity vulnerabilities. Governance keeps innovation secure and efficient.
AI in the Agriculture and Agritech Industry
From crop monitoring to predictive analytics, AI is reshaping agriculture. Governance ensures that AI adoption respects sustainability goals, data ownership, and biosecurity compliance in NZ’s vital agri sector.
AI in the Retail & E-Commerce Industry
AI can personalise shopping experiences, optimise stock, and power chatbots. But retailers must balance innovation with consumer trust, ensuring data protection and compliance with privacy laws.
Download your FREE AI Readiness Checklist >
AI Digital Transformation for NZ SMEs
Frequently Asked Questions
What is AI Governance?
AI Governance is the structure, policies, and processes that guide how AI is designed, adopted, and used responsibly. It ensures AI delivers business value without introducing unnecessary risk.
How is this different from cybersecurity?
Cybersecurity protects your systems from threats. AI Governance ensures your AI use is ethical, transparent, compliant, and accountable. They work hand-in-hand to protect your organisation.
Do SMEs really need AI Governance?
Yes. Many SMEs are already using AI without realising it (in Office 365, CRMs, chatbots, analytics). Without governance, risks around data misuse, compliance breaches, or reputational damage increase significantly.
What frameworks do you use?
We work with international standards such as the OECD AI Principles, NIST AI RMF, and ISO/IEC 42001 (AI Management System), applying them in a practical way for SMEs.
Can NSP help us build AI tools?
Yes. While governance and roadmapping are our focus, we can support the secure development and integration of AI systems into your business processes.
What is shadow AI and why does it matter for NZ businesses?
Shadow AI is the use of AI tools by staff without the knowledge or approval of their employer. It is the most common AI governance problem in NZ businesses right now. Staff using ChatGPT, Gemini, or other public AI models with client information, internal documents, or personal data creates real risk – data leakage, privacy breaches, and outputs that cannot be verified or traced. NSP’s AI Readiness Snapshot identifies what AI tools your staff are actually using before your governance programme begins.
Do NZ businesses need an AI policy?
Yes and most do not have one yet. If your staff are using any AI tool in the course of their work, you need a policy that covers what tools are approved, what data can be entered into AI systems, how AI-generated outputs should be reviewed, and what the consequences of policy breach are. The Privacy Act 2020 applies the moment an AI tool handles personal information, which most business AI tools do. NSP writes practical AI acceptable use policies as part of the Secure AI Accelerator programme.
What is ISO 42001 and does my business need it?
ISO/IEC 42001 is the international standard for AI management systems – the AI equivalent of ISO 27001 for information security. It provides a framework for governing how AI is developed, deployed, and monitored in an organisation. Most NZ SMEs do not need formal ISO 42001 certification, but aligning your AI governance programme to its principles gives you a credible structure that your board, insurer, and clients will recognise. NSP can align Secure AI Accelerator delivery to ISO 42001 requirements for businesses that need that alignment.
How do I govern Microsoft Copilot in my business?
Microsoft Copilot governance starts with your Microsoft 365 environment – specifically your permissions model, your data classification, and your access controls. Copilot surfaces data based on what a user has access to in SharePoint, Teams, and Exchange. If your permissions are not set correctly, Copilot can expose information that users should not see. NSP’s M365 Security and AI Readiness Review – part of Q1 of the Secure AI Accelerator – assesses your environment for Copilot readiness and identifies what needs to change before deployment.
How does AI governance relate to the Privacy Act 2020?
The Privacy Act 2020 requires NZ businesses to protect personal information. When an AI tool processes personal information – customer data, employee records, health information – the Privacy Act applies. This means you need to know what data is going into AI systems, where that data is processed and stored, whether it is being used to train the AI model, and whether individuals whose information is used have consented. NSP’s AI governance work maps your AI usage against these obligations specifically and identifies where your current practice creates Privacy Act exposure.
What does an AI governance framework actually include?
A practical AI governance framework for a NZ SME covers five things: an AI acceptable use policy that staff can actually follow, a risk register documenting your AI usage and the risks it creates, a list of approved AI tools with the data handling rules that apply to each, staff training records showing that people have been trained on safe AI use, and an ongoing monitoring process that keeps track of new tools entering the environment. NSP’s Secure AI Accelerator produces all five across the 12-month programme.
How long does it take to implement AI governance?
The NSP Secure AI Accelerator runs across 12 months, but meaningful progress is visible within the first quarter. Q1 delivers your risk register, your AI acceptable use policy, your staff training, and your 90-day action plan. By the end of Q1 you have a documented governance baseline. The remaining three quarters build the workflows, the board reporting, the insurance evidence pack, and the maturity scorecard that demonstrates ongoing progress. For businesses that need a faster starting point, the AI Readiness Snapshot is a standalone diagnostic that can be completed in two to four weeks.
View more
Learn more about NSP's Cybersecurity solutions
vCISO Strategy Services
vCISO Strategy Services
AI governance works best alongside a security leadership programme. NSP's vCISO service provides the ongoing oversight your board needs - covering AI risk, cyber risk, compliance, and board reporting in one engagement.
Cyber Security Assessments
Cyber Security Assessments
Your AI governance programme needs a clear picture of your overall security posture. An NSP security assessment gives you exactly that - a risk register and remediation roadmap that feeds directly into your AI governance work.
Microsoft Copilot
Microsoft Copilot
If your business is deploying Microsoft Copilot, NSP can assess your M365 environment for readiness - permissions, data classification, identity controls - before Copilot goes live across your team.
Managed IT Services
Managed IT Services
I works best when your underlying IT environment is well managed. NSP's managed IT services provide the foundation - monitored, patched, and secure - that AI adoption builds on.
Top Headlines With The Latest News
Stay up to date with our resources on Modern Workplace, AI, Cloud, Managed services and Cybersecurity.
Cyber Insurance
What Cyber Insurance Covers in NZ | NSP
What a Cyber Insurance Claim Costs NZ Businesses - And What Your Policy Won't Cover
July 14, 2026
IT Risk
IT Maturity for NZ SMBs - What Good Looks Like | NSP
IT Maturity for NZ SMBs - What Good Looks Like Most New Zealand small and medium businesses are further along than they think in some areas of IT and further behind than they realise in others.
July 14, 2026
AI
Shadow AI: Why Visibility Comes Before AI Governance
Shadow AI: Why Visibility Comes Before AI Governance
July 6, 2026
Cloud
What Is Microsoft Entra ID: Why Does It Matter for NZ Businesses | NSP
What Is Microsoft Entra ID and Why Does Every NZ Business Using Microsoft 365 Need to Understand It? If your business runs on Microsoft 365, you're already using Microsoft Entra ID. You may not know it by that name. You may not know it's running at all. But every time one of your staff logs into Outlook, opens a Teams meeting, or accesses a SharePoint file, Entra ID is the system deciding whether to let them in.
June 22, 2026
Cloud
Cloud Drift Management: Why Security Doesn't Stay Fixed in the Cloud
Your Cloud Was Secure Six Months Ago. Is It Still?
June 22, 2026
Let’s stay in touch!
Enter your details below to stay up-to-date with the latest IT solutions and security measures.