© John Stroh
Drafted with AI assistance, then checked and revised by the author. The judgements and the errors are the author’s. How this site is written sets out what is declared on every piece, who checks it, and where the per-piece record lives.
What government can actually do, and why most of what it does changes nothing.
Series part J · Version 0.1 · August 2026
Most argument about technology policy is about what the rule should say. Almost none of it is about what happens after the rule says it.
That is the wrong emphasis, and New Zealand has a domestic demonstration of why.
The Privacy Act 2020 was presented as strengthening privacy protection and enhancing the Commissioner’s role. It has a complete enforcement chain, and each link works:
Nothing in that chain is missing. It was carefully drafted. It reaches overseas companies doing business here, which is more than many countries’ laws manage. And at the end of it sits a number that a firm with revenue in the hundreds of billions would process as an administrative cost.
The Act does not fail because it is badly written. It fails because the last link is not heavy enough to hold the chain.
That is the lesson worth taking into any AI policy. Enforceability is not a property of the text. It is a property of the mechanism sitting behind the text, and the mechanism has to be examined link by link, because the chain is only as strong as the weakest one — which is nearly always the last one, and occasionally the first.
For any obligation a government is considering, six questions. If any one of them has no clean answer, the obligation is decorative.
Who exactly is obliged? Not “providers” or “agencies” — a class of person a lawyer could serve papers on.
Who checks? A named body, with a budget line, and the technical capacity to know what it is looking at. An audit right exercised by nobody is a form.
What can they compel? Documents, systems access, a demonstration, an expert’s report. A regulator who may ask questions and cannot compel evidence is dependent on the goodwill of the party under investigation.
What happens when the answer is no? Not what may happen. What has happened, in comparable cases, on average.
Who bears the cost of finding out? If detection depends on a harmed party noticing, complaining, and persisting through a tribunal, the obligation binds only where someone is willing to spend two years on it.
And how would we know it is working? A published number. Notices issued, proceedings brought, outcomes. Where nobody counts, nobody knows, and an unenforced duty is indistinguishable from a well-observed one.
Applied to the Privacy Act, that walk terminates at question four. Applied to New Zealand’s current AI instruments — a Cabinet paper, a strategy, a public service framework — it terminates at question one, because none of them creates an obligation on anyone.
Government has three distinct levers here, and confusing them is why capable people produce policy that does nothing.
Creating obligations that bind. The hard part is not drafting; it is the consequence at the end of the chain, and the will to set it at a level that changes a commercial calculation rather than registering disapproval.
Two obligations in this domain would matter more than the rest:
A prohibition on public-sector data entering vendor training, rather than a disclosure regime. The reasoning is irreversibility: data used to train a model cannot be withdrawn from it. Where harm cannot be undone, remedies applied afterwards are decoration, and only a constraint applied beforehand does any work. This is not contested by anyone technical.
A declaration requirement for AI in the software supply chain — whether a product performs inference, which model, operated by whom, in which jurisdiction, under what data terms, with notice on material change. This is a bill of materials extended from security to the inference path, and the security equivalent went from novel to standard within a few years.
This is the underweighted lever and it needs no legislation.
A supplier who wants Crown revenue meets the Crown’s conditions. That is faster than statute, cheaper than a regulator, and it reaches the private sector indirectly because suppliers do not maintain two product lines.
New Zealand already has the instruments. Cloud First is live and refreshed in 2023, and it carries provisions that would do real work if they were sharpened:
None of that requires a bill. Two of them are the government’s own commitments, unenforced.
There is also a restriction working directly against the grain of this series: public service agencies and some Crown entities may not invest in on-premise infrastructure without meeting specified criteria or obtaining approval. That rule predates affordable local inference. Infrastructure meeting a sovereignty test should not count as on-premise investment for its purposes.
The things only government can do, because they need either independence or a mandate longer than any company’s life.
The clearest example is a timestamp authority. A timestamp proves that a record existed in a particular form at a particular time — and it is worth nothing unless issued by a party with no interest in the record. That makes it infrastructure rather than a product: any company operating one for its own customers has recreated the problem it claims to solve.
This is not speculative. The New Zealand Information Security Manual has carried post-quantum guidance since January 2022, and version 3.9 records that quantum developments can undermine all widely used public key algorithms for digital signatures, and that historical and archived data may be at risk. Migration protects records written from now on. Records already signed become retroactively forgeable — and cannot be re-signed, because the people and organisations that signed them may no longer exist.
Archives New Zealand holds the Public Records Act mandate for the digital record of government, and its own long-term strategy anticipates that not all records of enduring value will be transferred to the archive, and that technology will provide methods of assuring authenticity of records whether archived or in current use. That is a description of what a timestamp authority does. The strategy names the requirement; nothing published names the mechanism.
A timestamp authority is small. It receives fingerprints and returns signed tokens; it holds no records and sees no content. The difficult parts are institutional: key custody, a published renewal policy, continuity across decades, and standing in evidence — because a timestamp nobody is obliged to accept is a service nobody will use. The legislative work and the operational work have to move together.
The reflex answer to any capability gap is that the Crown should build it. It should not, and the reason matters.
Sovereignty achieved by dependence on the Crown is dependence that has been re-domiciled, not removed. A 2029 government can defund it. An agency can deprioritise it. The organisations relying on it have exchanged a foreign vendor they cannot refuse for a domestic one they cannot vote out between elections.
Where capability is needed, the better instrument is anchor tenancy: a multi-year service commitment open to any operator meeting the standard. More bankable than a grant, ordinary procurement rather than novel structure, survives a change of government better than a line item, and it leaves the Crown out of the governance of the things it buys from.
Where capital is genuinely required, it should be redeemable, time-limited, and carry no special governance rights.
Not fund it. Not found it. Not prefer it.
The blueprint in this series is published for anyone to build from, and it is worth exactly as much as its independence. A commons pattern that quietly asks for support has stopped being a commons pattern.
What government can usefully do is make the conditions under which anyone can build it: define the test, make jurisdictional risk bind, remove the on-premise obstacle, establish the timestamp authority, and buy from whoever meets the standard.
That is a smaller ask than a programme, and it is the one that survives an election.
New Zealand has an AI strategy from MBIE that emphasises adoption over foundational development, a 2024 Cabinet paper reasoning that existing law provides guardrails and that a standalone AI Act is not preferred, and a public service framework. All three are deliberately light-touch. There is no AI-specific legislation and none has been tabled.
None of that is a failure of intent. It is what happens when the question being asked is what should the rule say rather than what happens after it says it.
The Privacy Act chain above is drawn from the Act and from published legal analysis; section references should be checked against the Act itself before anyone relies on them.
Three things we could not establish and did not assume. Whether a transfer prohibition notice has ever been issued — that power is the strongest cross-border provision in the Act and, if it has never been used, that fact is more telling than anything else in this essay. How many compliance notices have been issued since 2020 and how many reached the Tribunal. And how New Zealand’s penalty ceiling compares with other jurisdictions’ — the comparison is the obvious rhetorical move and we have not verified the numbers, so we have not made it.
If you can supply any of the three, this essay is better corrected than defended.
Published under CC BY 4.0.
What this publication does not claim, and what is outstanding against it in the register.
A question this rests on is parked: Does NZ domicile actually resist foreign compulsion?
We do not claim that a New Zealand entity is beyond foreign compulsion. We claim only that its exposure differs from that of a foreign-parented operator, and that the difference is untested.
Alongside: slides