New Zealand’s critical infrastructure is about to run a two-year experiment in going without. The country’s cyber agencies have warned that AI-powered attack capability could be in criminal hands by early 2027. The department writing the rules to defend hospitals, banks, power companies and water networks says it will only brief ministers around then. Its own draft also allows a further year of grace before anyone is penalised.
Priority work on a slow clock
Officials told RNZ that cyber protection of critical infrastructure “remains priority work”. They also said DPMC intends to “provide advice to ministers early in the next term of government”. Submissions from a consultation that closed in April won’t be published until around the same time in 2027. Asked what had been achieved, officials listed better incident reporting, more guidance and closer collaboration with industry. Those are process outputs, not binding obligations. Catalyst IT’s Don Christie, a frequent critic, said the government “needs to be much more engaged”. DPMC’s critical infrastructure programme page still carries submissions from three years ago.
The maths is unforgiving. The February 2026 discussion document proposed a one-year grace period between requirements taking effect and enforcement starting. First comes advice in 2027, then drafting and legislation, then the grace period. Nothing mandatory touches a hospital, bank or generator before 2028, and possibly later.
What the rules would demand
The proposal is not trivial. In March 2026, BusinessDesk reported a two-tier regime. Critical infrastructure entities would need minimum risk management aligned to frameworks like NIST CSF or ISO 27001. Entities of “national significance” would face extra duties. The definitions would capture hospitals with ICUs, deposit-takers handling domestic payments, electricity producers and transmitters, and water systems with at least 25,000 connections. Proposed penalties ran to 2% of annual turnover for companies and $500,000 for individual directors, plus a ministerial power of direction.
BusinessNZ’s April 2026 submission argued that any regime should allow for collaboration rather than operate as a punitive process. That is a fair point. Director liability and ministerial directions deserve scrutiny. But the case against heavy-handed rules does not justify having no baseline at all.
The attackers are on a shorter clock
In June, the Five Eyes agencies warned that frontier AI would reshape cyber offence and defence. Their message was blunt: “The timeline is not years, it is months.” In September, the NCSC said malicious actors may gain frontier-level AI capabilities by early 2027. It added that attacks could come with little warning.
The NCSC’s latest numbers show why that matters. Total incident reports fell to 4,673 in 2025/26 from 5,995, and recorded losses dropped to $23.8 million. But incidents triaged for potential national significance rose to 369 from 331. Within that group, the share linked to criminal actors grew from 41% to 44%. The trend is fewer attacks, but more serious ones, and more of them driven by money.
Starting from 62nd
In April 2026, Kordia noted New Zealand ranked 62nd on the National Cyber Security Index, against Australia’s 21st. Australia has had mandatory obligations for years. Threat notifications there rose 111% to 190 in 2024-25, partly because reporting rules forced problems into view.
The physical plant is ageing too. The 2026 discussion document found roughly 35% of SCADA and operational technology assets were at or nearing end of life. Fortinet research reported by the NZ Herald found only 14% of operators had full visibility of their OT environments. You cannot defend systems you cannot see, and you cannot easily take a water plant offline to patch it.
Last Friday was the trailer
The 12 November Microsoft 365 outage was not an attack, but it showed what happens when there are no resilience rules. Hospitals fell back on faxes, phone calls and hand-delivered prescriptions. MBIE paused visa processing entirely. PSA national secretary Fleur Fitzsimons says the country is vulnerable to global outages and needs proper backup systems.
Insurance offers thinner protection than many boards assume. NZ cyber policies typically carry waiting periods of eight to 12 hours before business interruption cover responds.
Boards can’t wait for Wellington
This is not an argument for rushed regulation. It is an argument for a government that sets clear minimums quickly and then gets out of the way. Back in 2025, Aura Information Security’s then-general manager Patrick Sharp warned in IoD’s Boardroom that waiting for frameworks leaves organisations exposed. That warning has only aged better.
For operators and their suppliers, the practical answer is the same one Kordia gave in April: start now. Benchmark against NIST or ISO 27001, map your OT, test your fallbacks and read your policy wording. Whichever party wins next year inherits a file that was meant to be urgent. The attackers will not wait for the grace period to end.
Sources
- RNZ: Cyber protection of critical infrastructure is ‘priority work’ but taking at least a year (2026-11-15)
- DPMC: Enhancing the cyber security of New Zealand’s critical infrastructure system (discussion document) (2026-02)
- BusinessDesk: Critical infrastructure company directors could be fined under proposed cyber-security regulations (2026-03-22)
- BusinessNZ: Cyber Security on Critical Infrastructure submission (2026-04-01)
- Kordia: What can NZ learn from Australia about cyber security threats? (2026-04-14)
- NZ Herald: Critical infrastructure cybersecurity, New Zealand has no mandatory rules (2026-08-19)
- The Post: Faxes, phone calls and printers, NZ hospitals, prisons and other services hit by global Microsoft 365 outage (2026-11-12)
- Insurance Business Mag: Microsoft outage puts New Zealand cyber policy wordings to the test (2026-11-12)
- IoD Boardroom: Act before attackers do (2025-07-07)
Join the discussion
Add useful context, ask a good question, or challenge an idea — keep it specific and respectful.