New Zealand should move from voluntary cyber security guidelines to enforceable legislation, including mandatory reporting of major cyber attacks, according to a new policy push that would shift responsibility for digital safety from individuals to the systems and platforms they rely on.
The Tech Users Association of New Zealand (TUANZ) released its Trust and Safety position paper on 30 June, alongside a discussion paper on social media age assurance, as part of its 2026 policy programme. The release is at tuanz.org.nz.
With New Zealanders losing an estimated NZ$200 million annually to scams, TUANZ warns that generative AI is amplifying risks by making sophisticated, highly personalised attacks easier to execute and harder to identify.
"Expecting individuals and small businesses to carry the burden of managing these risks is no longer tenable," said Paul Littlefair, Chair of TUANZ. "We need to design systems that are secure by default, not secure only for those with the time, expertise or resources to protect themselves."
TUANZ acknowledges progress, citing better coordination through the National Cyber Security Centre and initiatives such as Malware Free Networks. But it points to escalating scam losses and declining confidence among small businesses, with a rising proportion of smaller organisations reporting insufficient cyber resilience.
The association calls for four priority actions: enforceable national cyber security legislation with mandatory breach reporting and stronger investigation powers; tax rebates or direct grants to help SMEs adopt security basics such as multi-factor authentication and secure cloud backups; regulation requiring telecommunications and social media platforms to proactively detect and block fraudulent activity and deepfakes; and mandatory technology upskilling in the school curriculum.
The accompanying discussion paper, Navigating the Social Media Age-Gating Debate, sets out principles for age assurance policy - proportionality, practicality, privacy and equity - rather than advocating a single solution.
"Trust is fundamental to digital adoption," Littlefair said. "If people don't feel safe online, they will not fully engage with new technologies, including AI. Getting this right supports innovation, productivity, and the long-term competitiveness of our digital economy."