Under The Hood: Definitional Grounds

21/07/2026

I look at how the Public Service AI Framework defines AI, why that definition is too broad for setting priorities and too unstable across the wider debate, and why public administration changes the question to one of where discretion and public power have moved.

Under the Hood is about public administration, data, information, analysis, institutions, artificial intelligence and the machinery beneath the slogans. This first post starts with the word doing much of the work in the current debate: artificial intelligence, or AI.

The first problem is definitional because a definition sets the scope of governance. Governance is about direction and control: setting purpose, monitoring performance, seeking assurance, and making sure risk is identified, managed, and mitigated.

A public service document that provides guidance on how AI will be governed, therefore, has to tell agencies, with some precision, which forms of artificial intelligence are in scope, which risks deserve attention, and what form of control those risks require.

A definition set too loosely can send agencies toward the wrong target. A definition set too abstractly can pull business-as-usual, ordinary administrative tools into the same governance frame as processes that classify people, assess risk, match identities, recommend actions, and ultimately shape access to public services. A definition set too narrowly around current products can lead agencies to focus on the newest tools while missing older processes that already carry significant risk and, therefore, public consequences.

The Public Service AI Framework (the Framework) takes its definition from the OECD. The OECD describes an AI system as a machine-based system that, for explicit or implicit objectives, infers from inputs to generate outputs such as predictions, content, recommendations, or decisions that may affect physical or virtual environments (Government Chief Digital Officer, 2025; OECD, 2024).

That definition has value because it travels globally and across technologies. It gives nations and public agencies room to address artificial intelligence that predicts, classifies, generates, recommends, and makes decisions.

But it also creates a control problem. Read broadly, that definition applies to many, if not most, automated processes already in place within the state, including some pretty ordinary administrative support, for example, stationery procurement, leave rostering, room booking, invoice coding, document filing, development-plan reminders, or workflow prompts inside corporate tools.

At the same time, that same definition can also reach into processes closer to the exercise of statutory power over the public: intelligence tools that sort signals and risk; defence tools that classify threats, assets, logistics, or readiness; foreign affairs tools that screen information, translate material, or triage consular demand; immigration tools that match identity, assess risk, or flag travel; child protection tools that rank vulnerability or order cases by priority; housing tools that allocate, score, or queue need; benefit tools that detect anomalies, calculate entitlement, or create debt; building tools that process consent information, flag compliance issues, or model risk.

Some of these processes may need very little governance beyond ordinary management control, and some may deserve close control from the start. The OECD definition, which the Framework leans on, can capture all of them (Government Chief Digital Officer, 2025; OECD, 2024). That breadth may in fact be a problem, because it does not help public servants rank risk when, under the OECD definition, almost every automated process looks like AI. Eventually, all that means is more busyness, more paperwork, and higher costs, while the actual processes bearing the sharpest public consequences and harm may still fail to receive the attention they need.

The word itself slips

The broad OECD definition is only the first part of the problem. The definition for AI is also unstable across research, industry, law, ethics, Indigenous data sovereignty, and public understanding.

Researchers tend to define AI by technical function. In that setting, AI may refer to tools that learn from data, classify information, detect patterns, make predictions, infer relationships, or generate outputs from models. A fraud-detection model, a predictive risk tool, and a large language model can all fall under the term, even though they perform different kinds of work and carry different risks (Krafft et al., 2020).

Industry tends to define AI in terms of capability, productivity, scale, autonomy, and product development. The language of industry often moves toward tools that can perform useful work across tasks, replace or reduce human labour, act with increasing independence, or contribute to wider ambitions such as artificial general intelligence. I will return to that productivity story later in the series, because it has become one of the main ways AI is sold into institutions (OpenAI, 2018).

Law tends to define AI through regulatory reach. The European Union’s AI Act is a good example: it uses a risk-based structure that classifies some uses as prohibited, some as high risk, and others as carrying lighter obligations, because the legal question is how the technology should be controlled once it enters social and institutional life (European Union, 2024).

Ethics scholars often begin with power, rights, transparency, accountability, and harm. In that literature, the problem is not only what artificial intelligence can do, but who is affected by it, who can understand it, who can challenge it, and who carries the consequences when it goes wrong (Chatham House, 2023; Zerilli et al., 2019).

Indigenous data sovereignty begins with authority over data and the relationships data carries. In Aotearoa, that shifts the AI question again, because artificial intelligence that gathers, sorts, ranks, matches, infers from, or acts on data about Māori raises questions of rangatiratanga, collective interest, whakapapa, consent, benefit, and control. That makes AI governance a constitutional question as well as a technical one (Kukutai & Taylor, 2016; Te Mana Raraunga, 2018).

Public understanding is narrower and less settled again. Gallup found that nearly all Americans use products involving AI features, while nearly two-thirds do not realise it (Gallup, 2025). Pew Research Center found that many Americans recognise some common uses of AI in daily life, but only three in ten adults could correctly identify all six uses tested in its survey (Kennedy et al., 2023). Pew’s later comparison between the public and AI experts also shows how differently AI is understood by people working close to the field and by the wider public (Pew Research Center, 2025).

That instability around the definition of AI matters because governance relies on shared focus. The same word can arrive at one governance table as a broad public policy category, at another as a technical method, at another as a productivity tool, at another as a category for legal control, at another as an ethical problem, at another as a constitutional question, and in the public mind as a chatbot. The word shifts as it moves between those tables.

That instability should make public administrators cautious. Policy buzzwords can catch fire before their practical value is clear, leaving people charged with delivering public value to manage the ambiguity those words carry (Richardson et al., 2025). AI is beginning to carry that risk in public administration. It is broad enough within the Framework and, at the same time, unstable enough across the wider debate to become too porous for control.

Public administration needs more than a buzzword that travels. It needs enough precision to know what is being governed, what risk is being carried, and what form of control is required.

Public administration changes the question

I want to shift the argument from the definition of “AI” to the context in which AI is used. If the Framework starts with a definition that is too broad for prioritisation and unstable enough to travel like a buzzword, then the public service likely needs a more operational definition. To imagine what that more operational definition might be, one needs to ask how the definition relates to the context of public administration in Aotearoa.

In the context of public administration, the question changes because the state does not operate or use AI under the same conditions as a private-sector firm. Allison’s old question, whether public and private management are “fundamentally alike in all unimportant respects”, remains useful because it reminds us that similar tools can sit inside very different institutional worlds (Allison, 1983).

A firm may approach AI through productivity, scale, customer service, market advantage, labour substitution, or profit. Those are real and legitimate concerns in the context in which firms operate. A firm can be governed through its board, its owners, its customers, its contracts, its regulators, and its market position. Those controls matter, though they are not the same as public accountability.

Public accountability is different because it is attached to the exercise of public power. Accountability is central to democratic governance in Mulgan’s account, including the ways public power is held to account through political, legal, administrative, and networked arrangements (Mulgan, 2003). Bovens, for his part, treats accountability as a relationship in which an actor must explain and justify conduct to a forum that can question, judge, and impose consequences (Bovens, 2007). That is a different discipline from disclosure to a board or a market.

The difference matters because the state can do things that a firm cannot. It can grant, refuse, pay, recover, tax, classify, investigate, enforce, incarcerate, recognise identity, doubt identity, and demand proof. It can make a person visible to the system, or leave them stuck outside it. It can advise ministers in ways that shape what ministers believe they can lawfully and practically do. These are uses of public authority, and public authority carries a standing problem of control: how to make state power lawful, answerable, and non-arbitrary (Mashaw, 2006; Pettit, 1997).

Scrutiny in the public sector is therefore more than disclosure. Work on transparency and accountability is useful here because it shows that the two ideas can support each other but are not the same thing (Hood, 2010). A firm may disclose information to shareholders, regulators, or the market. A public agency may have to account to ministers, Parliament, courts, auditors, Ombudsmen, affected people, Iwi, communities, media, and the wider public. Those forums can ask whether power was exercised lawfully, fairly, reasonably, and for proper public purposes, which is a very different thing from telling the market your balance sheet is likely at risk.

Moreover, in a public administration context, an official or an agency is also more interdependent than the private-sector story usually allows. A public agency is rarely a single organisation pursuing a single corporate strategy. It is part of a wider administrative field comprising departments, Crown entities, statutory offices, regulators, local government, contracted providers, Iwi, Hapū, NGOs, professional groups, and communities. Rhodes’ account of governance and policy networks remains useful because it shows how public work often happens through interdependent actors rather than through a single hierarchy (Rhodes, 1997).

That interdependence changes what AI governance has to notice. An AI tool used in one agency can affect another agency’s work. A data match in one part of the system can affect eligibility elsewhere. A risk score can travel through a service setting. A vendor product can become embedded in public decision-making before the public service has fully understood what discretion has moved, where it has moved, and who now controls it. Equally, the organisational culture in one agency can completely change an entitlement when seen through the prism of another agency.

That is why the public service cannot treat AI only as a tool for productivity or innovation. Those uses may matter, and they will be part of the story. But in a public administration context, the more pressing question is what artificial intelligence is doing to authority, discretion, decision-making, delegation, evidence, explanation, accountability, and repair.

A tool like Copilot that summarises internal drafts is part of the daily work of public administration. But a tool that shapes eligibility, enforcement, identity, risk, advice, or access to services is altogether different. Those tools are risk creators and risk exacerbators, embedded with significant public consequences and harm.

And it is at these points in the public sector that the Framework and AI governance become more than technology governance. It becomes governance of public power as it moves through data, models, vendors, officials, advice, and decisions. And that bridges into a much older public administration problem: what happens when discretion moves into machinery and black boxes where it is harder to see.

When discretion moves from the front-line into a black box

More than twenty years ago, Bovens and Zouridis gave public administration a way to see into the black boxes. Their account of the shift from street-level to system-level bureaucracy showed how computerisation changes the location of discretion inside public agencies: when a process is automated, discretion moves rather than disappears (Bovens & Zouridis, 2002).

That shift matters for the Framework and AI governance because discretion is one of the places where public power becomes real. A frontline official may once have interpreted a rule, weighed evidence, recognised context, or exercised discretion in a person’s case. Once that work is built into an information process, discretion can move into data fields, business rules, model design, procurement choices, vendor assumptions, project governance, and code.

This creates a tension for any government that talks about strengthening the frontline. More support for the frontline is not the same as more discretion there. A digital tool may provide staff with more prompts, flags, dashboards, scripts, and generated recommendations. At the same time, it may shift discretion elsewhere: to information analysts, co-designers, IT shops, programme boards, third-party, often offshore-contracted vendors, and central decision-makers who set the rules before the frontline worker ever opens the case.

That is the quiet administrative shift. The public may still see a frontline officer, a case manager, an immigration official, a social worker, or a fisheries officer. The minister may still be told that services are being brought closer to people. But the discretion that shapes the encounter is likely to have moved upstream into the tool’s design and sideways into the institutional arrangements around it. That, my friends, is the crux of the problem. Since the 1980s reforms, decision-making has been slow and has moved from the front lines to managerial spaces, where people with little capability or experience in the specific issue, or with the citizen in front of them, are making the decisions.

If you do not believe me, read Cave Creek, Pike River, or the Royal Commission into Abuse in Care. Cave Creek showed what happens when resourcing and risk decisions are pulled away from the front line and lost somewhere in head office, leaving locally visible risks with no clear route to someone accountable for fixing them (Noble, 1995). Pike River showed the same pattern in a more lethal form: specialist knowledge sat low in the organisation, while decision-making sat elsewhere, in the second and third tiers (Royal Commission on the Pike River Coal Mine Tragedy, 2012). In child protection, the same problem appears through centralised intake and call-centre logic, which may look efficient from Wellington’s point of view but can strip the front line of the situated knowledge needed to understand a particular child, family, street, or community (Brown, 2000; Waldegrave & Coy, 2005; Royal Commission of Inquiry into Historical Abuse in State Care and in the Care of Faith-Based Institutions, 2024). In my view, these failures are examples of the same administrative habit: moving discretion away from the place where consequences are lived.

This is where black-box language becomes useful, but I want to use it carefully. In public administration, the black box can be more than a mysterious model that nobody can explain: it can be the wider arrangement that makes a decision hard to understand, challenge, or undo. It may include AI, but it also includes data, rules, interfaces, workflow, contracts, assurance processes, advice, and the institutional culture and habits around it.

That wider black box matters because affected people rarely encounter a model on its own. They encounter a letter, a debt, a refusal, a delay, a risk flag, a demand for proof, or an official explanation that does not explain enough. They encounter the state through an administrative pathway, and burden, already shaped by machinery they may never see.

The governance problem therefore goes beyond whether AI is accurate or efficient to whether the public service knows where the discretion and decision-making rights have actually moved, who is responsible for it, who is accountable for it, how it can be tested, how it can be challenged, and how harm can be repaired. Those questions are part of governing public power rather than optional extras.

That is why older failures matter in this series. Although Horizon, Robodebt, Novopay, and INCIS were not all AI in the current public sense of the word, their relevance runs deeper than that, because they show what can happen when public institutions trust computational machinery that they do not adequately understand, control, question, or correct (Carney, 2019; Post Office Horizon IT Inquiry, 2025; Royal Commission into the Robodebt Scheme, 2023; Small, 2000; Wevers & Jack, 2013).

What this first post gives us

This is the first piece I promised in the series: the one on definitional grounds. In the original post, I framed the problem as AI being defined too narrowly. Having worked through the literature more slowly, I think the problem is sharper than that. In public debate, AI is often understood too narrowly. In public policy and public administration, it is often treated too broadly. Across all the fields now using it, the term has become unstable at exactly the moment governments are relying on it.

That definitional work has helped me see two things at once. In Aotearoa, the Framework and its OECD definition are broad enough to take in ordinary administrative support, as well as artificial intelligence that may classify people, assess risk, match identities, recommend actions, shape advice, or affect access to public services. Outside the Framework, the term shifts again across research, industry, law, ethics, Indigenous data sovereignty, and public understanding. That is the problem this first post has tried to make visible: AI is too broad in the official frame, too unstable across the wider debate, and too easily turned into a travelling buzzword unless governance gives it firmer edges.

Public administration changes the question because the state is not a firm. It acts through lawful authority, public accountability, interdependent institutions, and powers that can grant, refuse, investigate, enforce, classify, record, and repair. Once artificial intelligence enters that setting, the question becomes less about whether a tool looks new or productive, and more about what public power it touches.

The point about discretion follows from that. Digital and system-level approaches have already moved discretion away from the frontline and into data fields, business rules, procurement choices, vendor assumptions, programme boards, and code. AI may intensify that shift. That is why the black box in this series is an administrative problem, as well as a technical metaphor, about where discretion has gone and who can see it.

That is enough for a first post. It gives us the starting question for the rest of the series: what does AI governance have to govern when artificial intelligence enters the machinery of the state?

Those questions are reasons to govern AI and digitisation properly rather than to reject them outright. Some uses will be ordinary, some will be useful, and some will deserve close control from the start. The work is to know the difference before harm travels too far through the system. That is what AI governance has to govern.

Series Note

Over the next eight months, I will work through the outline I promised when I introduced the series: Te Tiriti, tino rangatiratanga, and the data question; the ethics we already have; Aotearoa’s IT record; the friction problem; street-level algorithms; the accountability chain, interrupted; and, finally, what adequacy would look like. I will also take one short detour before the next instalment. I have been reading Pope Leo XIV’s recent encyclical, Magnifica Humanitas: On Safeguarding the Human Person in the Time of Artificial Intelligence, and I have been struck by the force of it: by its treatment of AI as a question of human dignity, by its concern about concentrated power, and by its insistence that technology has to remain subject to responsibility, public control, and the common good (Leo XIV, 2026). In a couple of weeks, I will offer a short reading of that piece and what it might help us see when we think about public administration, discretion, digitisation, and AI.

References

Allison, G. T. (1983). Public and private management: Are they fundamentally alike in all unimportant respects? In J. L. Perry & K. L. Kraemer (Eds.), Public management: Public and private perspectives (pp. 72–92). Mayfield Publishing.

Bovens, M. (2007). Analysing and assessing accountability: A conceptual framework. European Law Journal, 13(4), 447–468. https://doi.org/10.1111/j.1468-0386.2007.00378.x

Bovens, M., & Zouridis, S. (2002). From street-level to system-level bureaucracies: How information and communication technology is transforming administrative discretion and constitutional control. Public Administration Review, 62(2), 174–184. https://doi.org/10.1111/0033-3352.00168

Brown, M. J. A. (2000). Care and protection is about adult behaviour: The ministerial review of the Department of Child, Youth and Family Services. Report to the Minister of Social Services and Employment.

Carney, T. (2019). Robo-debt illegality: The seven veils of failed guarantees of the rule of law? Alternative Law Journal, 44(1), 4–10. https://doi.org/10.1177/1037969X18815913

Chatham House. (2023). Recalibrating assumptions on AI: Artificial “intelligence”: A problematic definition. Royal Institute of International Affairs. https://www.chathamhouse.org/2023/04/recalibrating-assumptions-ai/02-artificial-intelligence-problematic-definition

European Union. (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng

Gallup. (2025). Americans use AI in everyday products without realizing it. https://news.gallup.com/poll/654905/americans-everyday-products-without-realizing.aspx

Government Chief Digital Officer. (2025). Public Service AI Framework. Digital.govt.nz. https://www.digital.govt.nz/standards-and-guidance/technology-and-architecture/artificial-intelligence/public-service-artificial-intelligence-framework

Hood, C. (2010). Accountability and transparency: Siamese twins, matching parts, awkward couple? West European Politics, 33(5), 989–1009. https://doi.org/10.1080/01402382.2010.486122

Kennedy, B., Tyson, A., & Saks, E. (2023). Public awareness of artificial intelligence in everyday activities. Pew Research Center. https://www.pewresearch.org/science/2023/02/15/public-awareness-of-artificial-intelligence-in-everyday-activities/

Krafft, P. M., Young, M., Katell, M., Huang, K., & Bugingo, G. (2020). Defining AI in policy versus practice. In Proceedings of the 2020 AAAI/ACM Conference on AI, Ethics, and Society (pp. 72–78). https://doi.org/10.1145/3375627.3375835

Kukutai, T., & Taylor, J. (Eds.). (2016). Indigenous data sovereignty: Toward an agenda. ANU Press. https://doi.org/10.22459/CAEPR38.11.2016

Leo XIV. (2026). Magnifica Humanitas: On safeguarding the human person in the time of artificial intelligence. Holy See. https://www.vatican.va/content/leo-xiv/en/encyclicals/documents/20260515-magnifica-humanitas.html

Mashaw, J. L. (2006). Accountability and institutional design: Some thoughts on the grammar of governance. In M. W. Dowdle (Ed.), Public accountability: Designs, dilemmas and experiences (pp. 115–156). Cambridge University Press.

Mulgan, R. (2003). Holding power to account: Accountability in modern democracies. Palgrave Macmillan.

Noble, G. S. (1995). Commission of inquiry into the collapse of a viewing platform at Cave Creek near Punakaiki on the West Coast. Department of Internal Affairs.

OECD. (2024). Explanatory memorandum on the updated OECD definition of an AI system. OECD Publishing. https://doi.org/10.1787/623da898-en

OpenAI. (2018). OpenAI Charter. https://openai.com/charter/

Pettit, P. (1997). Republicanism: A theory of freedom and government. Oxford University Press.

Pew Research Center. (2025). How the U.S. public and AI experts view artificial intelligence. https://www.pewresearch.org/internet/2025/04/03/how-the-us-public-and-ai-experts-view-artificial-intelligence/

Post Office Horizon IT Inquiry. (2025). Report: Volume 1. https://www.postofficehorizoninquiry.org.uk/volume-1-post-office-horizon-it-inquirys-final-report

Rhodes, R. A. W. (1997). Understanding governance: Policy networks, governance, reflexivity and accountability. Open University Press.

Richardson, L., Durose, C., Cairney, P., & Boswell, J. (2025). How should policy actors respond to buzzwords? Three ways to deal with policy ambiguity. Policy Sciences, 58, 819–834. https://doi.org/10.1007/s11077-025-09596-3

Royal Commission into the Robodebt Scheme. (2023). Report. Commonwealth of Australia. https://robodebt.royalcommission.gov.au/publications/report

Royal Commission of Inquiry into Historical Abuse in State Care and in the Care of Faith-Based Institutions. (2024). Whanaketia: Through pain and trauma, from darkness to light.

Royal Commission on the Pike River Coal Mine Tragedy. (2012). Royal Commission on the Pike River Coal Mine Tragedy: Volume 1.

Small, F. (2000). Ministerial Inquiry into INCIS. New Zealand Government.

Te Mana Raraunga. (2018). Principles of Māori data sovereignty. https://www.temanararaunga.maori.nz/

Waldegrave, S., & Coy, F. (2005). A differential response model for child protection in New Zealand: Supporting more timely and effective responses to notifications. Social Policy Journal of New Zealand, 25, 32–48.

Wevers, M., & Jack, M. (2013). Report of the Ministerial Inquiry into the Novopay Project. New Zealand Government. https://www.beehive.govt.nz/release/ministerial-inquiry-report-novopay-released

Zerilli, J., Knott, A., Maclaurin, J., & Gavaghan, C. (2019). Transparency in algorithmic and human decision-making: Is there a double standard? Philosophy & Technology, 32(4), 661–683. https://doi.org/10.1007/s13347-018-0330-6