A New Zealand training provider needs custom AI development only when a job depends on its own scope, data or operating model and no product covers it. Common work, like drafting content, usually suits an off-the-shelf or vocation-specific tool. Either way, the Privacy Act 2020 applies and qualified staff stay accountable.
Key takeaways
- Decide job by job, not tool by tool. Common tasks suit products; work tied to your own scope, data or operating model is where a custom build earns its cost.
- The Privacy Act 2020 applies equally to custom and off-the-shelf AI. Check IPP 5 (security) and IPP 12 (disclosure outside New Zealand), especially for offshore hosting.
- NZQA is reportedly asking PTEs about generative AI, but we couldn't confirm that on NZQA's own site. Plan for questions in self-review.
- No certification scheme or independent benchmark shows custom or packaged AI is cheaper or better. Ask for a pilot on your own data.
- AI assists; named, qualified people decide, and outputs still go through your moderation.
Which job, which route?
There is no regulator definition of custom AI development for training providers, so the category descriptions come from vendors. In practice there are three routes.
- General-purpose generative AI. Good for everyday productivity and first drafts. It knows nothing about your scope or standards unless you supply them.
- Vocation-specific products. These are built for the sector. Vacademy is an LMS marketed to NZ PTEs. VETos generates training and assessment content and maps it to a provider's scope.
- Custom builds. NZ studios such as Igloo Studio describe agents, retrieval systems and AI features built around a client's own workflows. Igloo itself notes that a full custom system is a bigger engineering project than a single AI feature.
A three-question test
- Is the job common to most providers, such as drafting, summarising or general admin? Start with a product.
- Does it depend on your own data, scope or operating model, such as recognition of prior learning (RPL) at scale, compliance reporting, or running several providers on one system? A custom build may be justified.
- Does a product already do 80% of it? Buy it, and only build the gap.
Illustrative example: a PTE wants faster assessment drafting. That is a common job, so trial a vocation-specific tool first. The same PTE wants one view of audit evidence across three campuses and two legacy systems. That is specific to its operating model, so a custom build is worth scoping.
What do the Privacy Commissioner, NZQA and MBIE expect?
The answer is largely the same for custom and off-the-shelf tools.
- Privacy Act 2020. No separate NZ AI law was found. The Office of the Privacy Commissioner says the Act applies to everyone using AI tools in New Zealand, including tools supplied by overseas organisations. Check IPP 5 (securing personal information, including prompts and training data) and IPP 12 (disclosure outside New Zealand).
- Privacy Impact Assessments. Sources conflict on whether a PIA is mandatory. The OPC recommends doing one before you start and updating it regularly. Treat it as strongly expected.
- NZQA. Per a secondary source, NZQA's iQAF thematic question for July 2026 to July 2027 is reportedly generative AI in delivery and assessment. The Private Training Establishment Rules 2026 reportedly came into force on 19 January 2026. We couldn't confirm either on nzqa.govt.nz, and one source found no binding NZQA rule specific to PTE use of AI.
- MBIE. The Responsible AI Guidance for Businesses is voluntary and risk-based. It recommends human review and disclosure of AI use, and says businesses remain responsible for their decisions.
- Biometrics. If a feature uses face or voice recognition or AI proctoring, the Biometric Processing Privacy Code 2025 may apply. It started on 3 November 2025 for new processing and takes effect on 3 August 2026 for processing already underway.
Questions to ask before you sign
These work for a custom developer and a vocation-specific vendor alike.
- Data and hosting. Where is data hosted? Are prompts or learner data used to train models? How are IPP 5 and IPP 12 handled, and will they support your PIA?
- Security evidence. Ask for the certificates or audit reports behind claims like ISO 27001 or NZISM-aligned controls, not the marketing copy.
- NZQA assessment fit. Do outputs map to unit standards and qualifications on the NZQF? Unit standard assessment is typically Achieved / Not Achieved, so feedback and rubrics must suit a binary outcome. How is content updated as unit standards convert to skill standards, without orphaned assessments?
- Human oversight. Are important decisions made by named, qualified staff? Can you show AI use in your quality management system and self-review? Are outputs still moderated under your own processes?
- Accuracy and fairness. Has it been tested for your intended purpose? Have Māori data considerations and the representativeness of training data been addressed?
- Cost and ownership. Is it a build fee, managed service or licence? What do you own, who maintains it, and how do you exit?
- Proof. Ask for named NZ references and a pilot on your own data before full commitment.
Is there independent evidence on cost or outcomes?
Not that we found. There is no reliable public NZ benchmark comparing cost, adoption or outcomes for custom versus off-the-shelf AI in PTEs, and no government or NZQA scheme certifying an AI tool as 'NZQA-aligned'. That phrase is a vendor's self-description.
Treat case studies as claims to test. One example: Supahuman's case studies describe Mast Academy using a custom AI workspace trained on its own materials, with a reported 80% cut in course authoring time and content still passing through the provider's own moderation. That is vendor-reported, and the site is inconsistent on whether it was a bespoke build or the VETos product. It's an illustration, not evidence of typical results.
Where Supahuman fits, and where it doesn't
Supahuman separates products from custom work. VETos is a product providers use to design, validate and deliver programmes. The AI Studio builds custom AI, run as a managed service, for work no product covers: compliance and audit intelligence, RPL at scale, sector-scale reporting and provider-group operating systems. If a product covers your job, you may not need a build. No pricing is published.
The Studio describes starting by deciding which steps and decisions AI should and shouldn't take on, then running a two-to-six-week pilot on real data. It also describes AWS hosting in Australia with ISO 27001 / NZISM-aligned controls. Those are vendor statements. Test the offshore location against IPP 12 and ask to see the audit evidence, as you would with anyone.
Our take
The 'custom versus off-the-shelf' framing is usually the wrong first question. Most providers should buy for the common jobs and keep custom budget for the one or two that carry their real operating risk. And whichever route you pick, the hard part isn't the model. It's showing your accountable people can explain, moderate and defend every output.
FAQ
When does a NZ training provider need custom AI development?
When the job is tied to your own scope, data or operating model, such as RPL at scale, compliance reporting or running multiple providers on one system, and no product covers it. For common tasks like drafting content, an off-the-shelf or vocation-specific tool is usually enough.
Do the rules differ for custom and off-the-shelf AI?
Not materially. The Privacy Act 2020 and its 13 Information Privacy Principles apply to both, and MBIE's voluntary guidance says you remain responsible for your decisions. NZQA is reportedly asking PTEs about generative AI, but that is unconfirmed on NZQA's site.
What should I ask a vendor before signing?
Ask about hosting and IPP 12, whether prompts or learner data train models, audit evidence for security claims, mapping to unit standards and the skill standards transition, human oversight, total cost and exit options. Ask for a pilot on your own data.
Is there independent evidence on which route costs less or works better?
No reliable public NZ benchmark or certification scheme was found. Vendor case studies are claims to test, not typical results.
Next step
Before talking to any vendor, list your five most time-consuming jobs and run each through the three-question test. If one needs a build, the Supahuman team will walk you through a pilot on the book a demo page, and you can compare the answers with any other vendor's.
