This article explores how New Zealand AI and technology companies, looking offshore for growth, are preparing to scale globally, balancing innovation with evolving international regulatory requirements. For AI and tech firms, this opportunity is amplified by the inherently borderless nature of digital products, which are easier to export and adapt globally. This is evidenced by New Zealand’s burgeoning SaaS (Software as a Service) market. However, to enter international markets, organisations must also align with evolving global regulatory landscapes.
Members of the AI Forum’s Governance Working Group interviewed executives from a range of New Zealand companies across various industries to understand the challenges and opportunities of international expansion with AI products.
Key findings reveal that while most firms do not yet see AI-specific regulations as a barrier, they are proactively embedding governance into product development, leveraging compliance to build trust, and designing for flexibility to adapt to future standards. Early alignment with globally recognised benchmarks, combined with strong networks and local advisors, is emerging as a critical enabler for credibility and market access.
The Opportunity and the Challenge
New Zealand’s burgeoning SaaS (Software as a Service) ecosystem shows how digital products can travel. Yet entering international markets requires aligning with varied and changing regulatory regimes.
Companies we interviewed described four themes:
- Adapt to regional requirements where relevant.
- Leverage in-market advisors and partners to navigate local nuances.
- Balance innovation speed with future compliance to avoid costly retrofits.
- Use compliance as a trust signal with customers and regulators.
Balancing Innovation and Meeting Regulation
At present, none of the companies we spoke to viewed specific regulations (e.g. the 2024 EU AI Act) as a barrier to entering international markets. They are not being asked by their overseas customers to plan to be compliant with any AI specific regulations and their focus is on innovative product development rather than AI regulatory compliance. Global expansion, however, brings direct encounters with different regulatory regimes across different markets.
Some market regulators have now added specific questions about AI products to their approval requirements and are looking at items like datasets, model training, and validation processes against market sub-populations.
Other market regulators are focused more on internal quality management processes used by the company to obtain their approval. The US Food and Drug Administration (FDA) is responsible for enforcing laws and regulations that protect US public health and consumer interests. They asked one company to supply extensive documentation about their AI product and its model training against specific market sub-populations to secure their approval. The company invested in this process and used external consultants to support them at a significant cost, but the company felt this was a worthwhile investment, as the US FDA approval allowed them to position their AI product as the first US FDA-approved AI tool of its kind in the market.
In some cases, meeting regulations are only part of the decision to change their product offering. For example, one AI product originally retained all its customer data, but then evolved into allowing their retail client to take control of this customer data. The reasoning behind this move was threefold: it removed EU General Data Protection Regulation (GDPR) data responsibilities from the AI company, it improved the end-to-end consumer experience, and then allowed their retail client to use the customer data to market additional products.
Executives consistently raised the tension between protecting innovation and managing regulation. Under-regulation can allow immature competitors to ship and fail, while over-regulation risks slowing market entry. Interviewees noted that mandatory regulations in overseas markets, such as International Standards Organisation (ISO) certification requirements, could be a barrier for smaller NZ companies and AI start-ups due to the costs of meeting compliance.
A few companies were blunt in their assessment that mandatory government AI compliance would likely add cost and complexity without necessarily creating value. Their view was that client-driven standards and current regulatory transparency requirements already exist and are sufficient.
The main approach to regulation to date from the company executives we spoke to has been to “do what’s required but don’t overdo it”.
Different Customers in Different Sectors
The New Zealand AI companies we interviewed are currently focused on meeting their customer requirements across markets, noting that while their customers require certain capabilities and features, they also need solutions to be compliant in their operating jurisdictions.
Many built out their product to comply with customer-requested in-market legislation. For example, one company achieved European Disability Act compliance following a customer request. This Act, formally known as the European Accessibility Act (EAA), came into effect in June 2025 and the company we spoke to believes that their compliance is a potential future differentiator and selling point for their product. These types of requirements are dependent on the sector where a company operates – for example: AI products in the US medical device sector might require US FDA approval. Solutions using personally identifiable information such as biometrics or licence plate recognition also face different barriers in different jurisdictions.
Companies providing solutions to financial institutions recognise that working with these clients requires robust governance and data practices to pass their strict internal and external approval processes. Principles like demonstrating high data anonymisation and privacy standards apply to the adoption of any system for these organisations, not just AI systems.
Requirements also depend on the specific profile of their customers. One executive noted that meeting some customers’ global marketing and brand standards can be more restrictive than local laws. Companies who are ultimately providing a branded end-to-end consumer experience must fully understand AI products so they can understand where it fits into their offering, manage their reputation, and ensure that they are upholding their principles around working with AI (e.g. transparency). For example, providing transparency to customers in the security threat detection business, might require significant and detailed documentation of AI usage to build the required trust.
Another executive emphasised that many barriers can be less about regulation itself, and more about the risk appetite of the clients. They discussed their experience with more conservative corporations simply rejecting external AI components due to their perceived current risk-reward profile. This risk appetite may change over time as others in their sector move and the perceived risk-reward equation changes.
Compliance as a Market Enabler
While some see compliance as a ‘necessary burden’, others see it as a way to build customer trust. For example, gaining ISO 27001 certification (an international standard for information security management systems) was seen as beneficial as a globally recognised standard to build trust with clients. Because of this, some companies are building existing ‘gold’ or high compliance standards into their platform from inception as a baseline.
The EU’s GDPR is recognised as the highest data protection standard today: one EdTech company we spoke to benchmarked their product against the GDPR as a way to ensure future compliance in Europe and future-proof them against expensive governance retrofitting as they target other global markets, including Asia. This proactive stance is helping them build credibility with the government and institutional partners they have, and they believe it will open doors to new opportunities where their customers can have confidence that the solution will be compliant with even the most strict standards and regulations.
Strategic compliance accelerates trust, lowers friction in procurement, and positions companies for multi-market expansion.
Local Contractual Landscape
As with other products, legal departments in client companies and in-market legal advisors provide the detailed obligations for all parties and the information needed for regulatory compliance for market entry and expansion. They know that the US and Europe cannot be treated as large uniform entities for these purposes, but operate in a fragmented regulatory landscape across many jurisdictions. For example, in addition to EU wide legislation, every European country has items that are subject to more nuanced local laws. This also plays out in the difference in AI regulations between US states.
In addition to regulation and in recognition of the specific environment, exact liabilities on all parties are normally contained within detailed contractual arrangements in overseas jurisdictions. Some companies build features into their AI products to protect their liabilities in certain markets, from simple disclaimers regarding the scope of their product (e.g. not intended as medical advice) to mechanisms that explicitly require an accountable ‘human-in-the-loop’.
Regulation as Part of the AI Product Development Approach
The main approach has been to treat governance or regulatory compliance as part of normal product development, integrated from the beginning, rather than a separate function tacked on. It is typically built into development costs and operations, rather than having a separate budget.
Companies are also building platform-agnostic systems that allow quick switching between providers to minimise vendor lock-in, provide the ability to turn AI features on and off where needed, and deliver robust documentation to support compliance processes and audits. This is seen to provide companies with flexibility and reduced regulatory and commercial risk for the long term.
The Role of New Zealand Support Ecosystem
Interviewees indicated that New Zealand businesses with AI products have no ‘de facto’ place to go to get help with overseas AI compliance. When faced with challenges, many use their own networks and seek out someone or a company in their network who’s done this before, or who is on the ground.
Many interviewees spoke positively about key early supporters and the networks, including institutions like NZTE, Callaghan Innovation, and research and innovation focussed partners such as Uniservices at University of Auckland. These organisations, and sometimes key individuals, significantly helped them navigate market access and secure approvals.
Securing and effectively leveraging this funding and associated networks has been critical to enabling their international expansion, providing the resources needed for product development, regulatory compliance, and market entry.
Future Regulatory Developments: Risks and Opportunities
Looking ahead, there are both risks and opportunities in AI global regulatory evolution for companies.
Risks:
- Mandatory certifications could disproportionately burden small firms
- Divergent rules (e.g. state-level regulation in the US) can complicate scaling for some companies
- Meeting regulatory requirements for particular markets can consume resources and slow product development
Opportunities:
- Early compliance with stringent regimes (e.g. GDPR, EU AI Act) can position firms for credibility across many markets
- Regulation can as a potential market filter, raising barriers to entry for less-prepared competitors
If AI standards follow a similar journey to privacy legislation, companies should:
- assume distinct AI governance will come and be part of the future contractual landscape with overseas clients e.g. GDPR 2018 and 2021 to operate in Europe.
- certain global AI benchmark standards will emerge over time that may be mandatory in some markets and desirable for many other markets.
- keep an eye on general themes of the likely contenders for any new ‘de facto’ AI benchmark standards and build future compliance along the way.
Information for New Zealand AI Firms Going Global
These collective experiences suggest some practical guidance for companies starting the journey to build AI products for international markets:
- Embed governance early – treat responsible AI as part of core development, not an afterthought
- Build platform flexibility – design systems that can switch models or providers quickly in response to regulatory change.
- Balance speed and compliance – avoid over-engineering but don’t cut corners that erode customer trust.
- Use existing global standards as benchmarks to future-proof products
- Rely on local expertise – invest in legal and compliance advisors in each jurisdiction.
- Leverage partnerships to build relationships and new networks in both New Zealand and international markets.
Conclusion
This work indicates there are no single AI regulatory standards at present and it is unclear where or whether such standards will emerge. In the meantime, New Zealand AI firms are proving adept at navigating the complexities of international regulation while scaling their innovations.
From financial services to healthcare, retail, and early childhood development, strategies across different sectors reflect a balanced approach to meeting compliance, building trust, and remaining agile.
While evolving rules in the EU, US, and Asia could pose future challenges, businesses demonstrate that aligning early with high standards driven by demanding overseas customers, embedding existing known best practice and leveraging trusted existing partnerships can help maintain a long term competitive advantage.
New Zealand AI firms are proving that global success depends not just on innovation but trust, adaptability, and early alignment with international standards. By embedding compliance into product design and leveraging strategic partnerships, these companies are positioning themselves to compete and thrive on the world stage.
