AI Is Being Deployed Faster Than It's Being Assured.
The three AI assurance gaps that expose NZ organisations to operational, reputational, and regulatory risk.
Hallucination and Accuracy Risk in Production
Generative AI systems produce confident-sounding outputs that are factually wrong — and most organisations have no systematic testing regime to measure accuracy, consistency, or boundary behaviour before deployment. An AI system that gives incorrect advice in a government service or financial product creates real harm. Independent functional accuracy testing is the baseline requirement.
Bias and Fairness Gaps Go Unmeasured
AI models trained on historical data inherit the biases of that data. Decision-support systems that disadvantage particular demographic groups create legal exposure under the NZ Human Rights Act and erode public trust. Without independent bias and fairness evaluation — across the protected characteristics relevant to your use case — you don't know what your system is actually doing to different groups of users.
Governance and Audit Trail Failures
The NZ Government's Algorithm Charter and the emerging AI governance requirements under the Public Service Act require documented evidence of how AI decisions are made, reviewed, and challenged. Most AI deployments lack the audit trail, explainability documentation, and human override mechanisms that governance requires. This isn't an IT problem — it's a programme governance gap.
How Resync Approaches AI Testing & Assurance
AI systems assurance at Resync starts from the premise that the assurance team must be independent from everyone who builds, sells, or operates the AI — because conflicts of interest in AI assurance produce the same risks as conflicts of interest in any other form of audit. We assess your AI system against the NZ Government Algorithm Charter, ISO/IEC 42001, and the NIST AI Risk Management Framework, using a structured methodology that covers functional accuracy, bias and fairness, adversarial robustness, and governance documentation.
Every engagement produces a programme-ready assurance report that maps findings to governance requirements — not just a technical vulnerability list. Programme leadership, risk committees, and agency governance boards need evidence of independent oversight, not just a developer's self-assessment.
As NZ regulatory requirements for AI systems continue to evolve, independent assurance from a firm with no model or vendor relationship is the credible evidence your governance framework requires.
What We Assess
Full AI systems assurance from functional accuracy through bias evaluation, adversarial testing, and governance documentation review.
Functional Accuracy Testing
Systematic evaluation of AI output accuracy, consistency, and boundary behaviour — including hallucination rate measurement for generative systems, classification accuracy across demographic groups, and regression testing against known correct outputs.
Bias & Fairness Evaluation
Assess AI system outputs for differential impact across protected characteristics — age, gender, ethnicity, disability status — relevant to your use case and the NZ Human Rights Act. Produce quantified fairness metrics across demographic subgroups.
Adversarial & Robustness Testing
Test AI system behaviour under adversarial inputs — prompt injection for LLMs, adversarial examples for image classifiers, edge-case inputs for decision systems — to understand failure modes and boundary behaviour under attack or unusual conditions.
Human Oversight Assessment
Evaluate whether your AI system's human oversight mechanisms — override workflows, escalation paths, monitoring dashboards, and review queues — are fit for purpose and actually used. The NZ Algorithm Charter requires meaningful human oversight, not just a theoretical override button.
ISO/IEC 42001 Alignment
Map your AI governance framework against ISO/IEC 42001 (AI Management Systems) requirements — identifying gaps in risk management, impact assessment, data governance, and monitoring that need to be closed before certification or regulatory review.
Explainability Review
Assess whether AI system decisions can be explained to affected individuals and oversight bodies in terms they can understand and challenge — as required by the Privacy Act 2020 for automated decision-making and the NZ Algorithm Charter for government systems.
Independence From the Model Stack
We Don't Build, Sell, or Run AI.
That's Why Our Assurance Is Credible.
AI vendors, model providers, and implementation partners all have commercial interests in the AI systems they're assuring. Resync has no AI platform, no model to promote, and no vendor relationship that biases our findings. Our assurance is independent of the entire model stack — structured against NZ Government requirements and international AI governance frameworks.
Why Resync for AI Systems Assurance?
Independent of the model stack. Structured for NZ governance requirements.
No AI Vendor Relationship
Resync doesn't build, sell, or operate AI systems. Our assurance team has no financial relationship with any AI platform, model provider, or implementation partner. That independence is what makes our findings credible to governance boards and regulatory bodies.
NZ Governance Framework Expertise
Our AI assurance methodology maps to the NZ Government Algorithm Charter, the Public Service Act's AI transparency obligations, and ISO/IEC 42001 — producing documentation that programme governance and risk committees can use directly.
Risk-Quantified Findings
AI assurance findings at Resync are reported in business-risk terms — accuracy failure rates, affected user populations, governance gaps — not just technical observations. Programme directors and risk committees get what they need to make informed go/no-go decisions.
Frequently Asked Questions
What programme directors and agency CIOs ask before engaging Resync for AI systems assurance.
Q.What types of AI systems does Resync assess?
Resync provides assurance for decision-support AI (benefits eligibility, credit scoring, risk classification), generative AI deployments (chatbots, document drafting, content generation), and AI-assisted automation (process automation with model-driven decisions). We assess systems regardless of the underlying model or platform — including systems built on commercial APIs and open-weight models.
Q.Is AI assurance required for NZ government agencies?
The NZ Government Algorithm Charter commits signatories to transparency, human oversight, and regular review of algorithmic systems. The Public Service Act 2020 creates accountability obligations for automated decision-making that affects individuals. While there is no single mandatory AI audit standard yet, independent assurance provides the evidence of due diligence that the Algorithm Charter and Treasury guidance recommend — and that procurement requirements increasingly require from suppliers.
Q.How is AI assurance different from a standard IT security assessment?
An IT security assessment focuses on infrastructure, access control, and vulnerability exploitation. AI assurance focuses on what the model itself does — its accuracy, fairness, robustness, and explainability. These are entirely different risk domains. An AI system can pass every IT security control and still produce biased decisions, hallucinate harmful outputs, or lack the human oversight mechanisms that governance requires. Both are needed; they answer different questions.
Q.How long does an AI assurance engagement take?
A focused AI system assessment covering functional accuracy, bias evaluation, and governance documentation review typically takes 3-6 weeks. A full AI assurance engagement including adversarial testing, ISO 42001 gap analysis, and programme governance documentation takes 6-12 weeks depending on system complexity and documentation maturity. We scope based on your AI use case, risk profile, and governance requirements.