The next phase of public sector AI: practical steps for leaders

Ensure agentic AI assurance before deployment  

If you run, or plan to run, agentic AI pilots, you should commission an explicit agentic assurance review before production deployment. This review should cover tool-use boundaries, transaction-level auditing, reversibility design, agent identity and authorisation, human-in-the-loop checkpoints and the failure-mode containment plan. KPMG recommends treating this as non-negotiable for any agentic deployment in regulated environments. 

Role-specific AI training will help embed it 

AI training over the next 12 months should be tailored to specific roles: policy analysts, case workers, clinicians, procurement officers, contact-centre staff and senior leaders. A single organisation-wide masterclass is the wrong unit of intervention. Training should be role-specific, task-specific and scenario-based.  

Prioritise getting your data in order 

Business cases this year should treat data foundations as a precondition for AI value rather than a back-office hygiene activity.  

Organisations that have deferred metadata standardisation, master data management and data quality investment will not capture the value of agentic and hybrid AI over the next two years. This investment can no longer be deferred. 

Decide now how you will measure AI value 

By 2027, the public sector should have moved from cataloguing use cases to measuring realised value. The cross-agency AI survey should be extended to include a consistent benefits framework that captures time saved, improvements in quality, equity outcomes and indicators of citizen experience. Without this, the system cannot tell good AI from busy AI. 

Move beyond agentic AI pilots 

Agentic AI should move from isolated pilots to a small number of carefully scoped production deployments, concentrated in workflows where the value case is strongest and the cost of failure is manageable. 

Benefits processing in social services, clinical documentation and administrative coordination in health, asset condition triage in infrastructure, and structured citizen query handling in central agencies are all credible candidates. 

Build shared knowledge graph capability 

Hybrid AI architecture should be made an explicit design pattern in organisational reference architectures. This includes building, or partnering to access, the knowledge graph infrastructure that hybrid systems depend on. 

Depending on the nature of the organisation, this will look different. For health, for example, it means a Health New Zealand Te Whatu Ora-grade clinical knowledge graph capability. For central government, it means a legislative and policy knowledge graph capability shared across agencies. 

Neither exists at production grade today – both should by 2028. 

Design for sovereignty in high-value cases 

Sovereign-by-design architecture should become a standard line item in business cases worth more than $5 million. (For projects exceeding $5 million, the cost of retrofitting sovereign controls or losing access to critical data due to legal changes can easily dwarf initial investment costs). 

The four sovereignty layers – data, operational, governance, and capability – should each have explicit, named decisions. 

Procurement standards should ask the questions Te Mana Raraunga and Te Kāhui Raraunga have been asking for years: who governs the data, where is it held, and how have iwi, hapū and Māori data subjects been engaged? 

Make public assurance routine  

Public assurance statements, voluntary today, should become standard for every organisation above the size threshold by the end of this two-year period. Public assurance should provide accountable transparency without becoming regulation through the back door. 

What could this mean for Aotearoa? 

By 2028, better delivery could have moved Aotearoa off the bottom of the OECD trust table. 

It would have a public sector in which agentic AI is routine in defined, governed contexts, and not a novelty. It would have hybrid AI systems running in health, justice, social services and infrastructure, with auditability as a design property rather than a bolted-on report.  

It would have a domestic AI capability base – in industry, research institutions and Crown entities – that gives the country meaningful capability sovereignty. And it would have a Māori data sovereignty operating practice that other jurisdictions look to as a reference, because the work was done in partnership rather than performed in foreword paragraphs. 

Aotearoa is a small country with a credible policy architecture, transparent telemetry, world-leading thinking on indigenous data sovereignty, an unusually responsive public service, a health system that has just demonstrated it can scale a sovereign-aware AI deployment in months, and a tradition of figuring out how to do hard things on its own terms. 

The work of the public sector is to convert that into delivery. The work of those who advise government is to be useful while it happens.

Dr Abtin Maghsoodi is an Associate Director at KPMG New Zealand and the firm’s AI and Data Science Chapter Lead. He has spent nearly a decade in the New Zealand health sector and holds a Senior Research Fellowship at the University of Waikato. His current work focuses on the intersection of AI, data, and the infrastructure, government and healthcare sectors across Aotearoa and the wider South Asia-Pacific.