Overview
Tax Management New Zealand was already using AI in production and investing in new data and analytics capabilities. As adoption grew, TMNZ needed secure, reusable foundations that could support more use cases while meeting the governance, security and auditability requirements of a regulated financial services organisation. Arinco worked with TMNZ to establish modern Microsoft Fabric and Azure AI foundations, creating shared platform patterns for data, analytics and AI workloads. These foundations are helping TMNZ put its governance framework into practice, scale new capabilities more consistently and adopt emerging AI services without rebuilding its environment for each use case.
About TMNZ
Tax Management New Zealand (TMNZ) is New Zealand’s leading tax payment platform and an Inland Revenue Digital Services Provider. Trusted by more than 2,000 accounting firms and 100,000 taxpayers, TMNZ provides flexible tax payment solutions that help businesses manage cashflow, reduce interest costs and meet their Inland Revenue obligations.
TMNZ operates in a regulated and reconciliation-heavy environment where transactions must be traceable and decisions auditable. The organisation also has a strong social purpose, with all profits invested in Whakatupu Aotearoa Foundation to support New Zealand’s long-term prosperity, communities and environment.
Business challenge
TMNZ had moved beyond early AI experimentation and was already running AI workloads in production. As adoption grew across internal tools, services and automation, its AI spend increased roughly tenfold year on year, while overall technology costs decreased. This growth reinforced the need for shared, governed foundations that could support continued adoption efficiently.
Alongside its growing use of AI, TMNZ was modernising its data and analytics capability. It needed a platform that could support scalable reporting, advanced analytics and future AI use cases, with consistent patterns for ingesting, transforming, validating and governing data.
As a regulated financial services organisation handling taxpayer information, TMNZ needed these capabilities to be secure and auditable by design. Sensitive and non-sensitive data needed to remain appropriately separated, access needed to follow clearly defined roles, and platform activity needed to be observable. TMNZ had already developed an AI governance framework covering policies, system ownership, risk classification and evaluation, and now needed technical foundations that could put those requirements into practice. This included establishing:
- A governed data platform that could scale beyond individual reporting requirements.
- Shared AI infrastructure with security, identity, safety and observability built in.
- Automated evaluation processes that could prevent unsuitable AI changes from reaching production.
- A controlled way for AI agents to interact with approved business systems and Azure resources.
- Reusable engineering patterns that internal teams could operate and extend.
TMNZ needed a Microsoft partner that could bring together data, cloud, AI, integration and security expertise while working collaboratively with its internal technology and governance teams.
Solution
TMNZ partnered with Arinco across a series of data and AI engagements to design and implement secure, reusable foundations on Microsoft Azure.
The work combined TMNZ’s existing knowledge of its business, regulatory obligations and AI governance requirements with Arinco’s Microsoft architecture and engineering expertise.
A governed data platform
Arinco worked with TMNZ to establish a Microsoft Fabric foundation for reporting, analytics and future AI use cases.
Arinco established reusable patterns for moving data from operational systems through ingestion, transformation, validation and reporting. These patterns give TMNZ a more consistent way to manage data quality and retain the information needed for business and regulatory reporting.
Arinco also created infrastructure-as-code and deployment patterns across development, testing, staging and production. This reduced manual configuration and established a repeatable path for promoting changes between environments.
Microsoft Entra ID was integrated to support identity and role-based access, while the platform design separates sensitive and non-sensitive workloads. Arinco also implemented source-controlled templates, automated deployment pipelines and platform monitoring to improve consistency, auditability and visibility over performance and capacity.
Shared infrastructure for production AI
Arinco applied its Azure Done Right™ approach to establish an Azure AI foundation aligned with Microsoft’s Cloud Adoption Framework and Well-Architected Framework.
Arinco configured Azure AI Foundry as a shared AI layer that can support a growing range of TMNZ applications. New use cases can connect to established model hosting and endpoints, rather than implementing separate security, safety and monitoring controls for each application.
The platform includes private connectivity where appropriate, Microsoft Entra ID integration, secrets management through Azure Key Vault, content safety controls and centralised monitoring.
Arinco defined the AI resources and their supporting network and identity configurations through infrastructure as code and automated deployment pipelines. This gives TMNZ a reproducible and reviewable environment that its teams can extend as new use cases emerge.
Governance built into delivery
Arinco worked with TMNZ to translate AI governance requirements into platform controls and delivery practices. The architecture supports different levels of testing, monitoring and approval according to the risk classification of each AI system.
Arinco also helped establish evaluation patterns across the AI delivery lifecycle:
- During development, to identify quality and safety issues early.
- Within deployment pipelines, where defined checks can prevent unsuitable changes from reaching production.
- In production, to identify changes in quality, safety or model performance over time.
Alongside standard quality, groundedness and safety testing, TMNZ has developed controls for risks specific to its business. These include verifying tax information against source data, checking customer-facing content for fair-dealing risks and preventing information from being exposed across customer boundaries.
Controlled access to business systems
Arinco and TMNZ also designed a repeatable architecture for Model Context Protocol (MCP) use cases, giving AI agents a controlled way to interact with approved Azure resources and business APIs.
Arinco designed Azure API Management as the governed access layer, providing consistent authentication, authorisation, routing, throttling and logging. This allows backend services to remain protected rather than being exposed directly to the public internet.
The architecture supports internal MCP services for approved engineering and business use cases. Arinco and TMNZ also designed a client-facing pattern for potential future external integration scenarios.
Arinco delivered baseline code, infrastructure templates, deployment pipelines, guidance and a runbook for adding future MCP services. TMNZ can now introduce new integrations using an established pattern rather than designing each connection from scratch.
Arinco also delivered knowledge transfer and handover sessions covering the environments, repositories, pipelines and documentation needed for TMNZ’s teams to operate and extend the platforms.
Outcomes
The engagement has given TMNZ a secure and repeatable foundation for expanding its data, analytics and AI capabilities. Key outcomes include:
- Governed AI infrastructure: New AI use cases can inherit established controls for networking, identity, secrets, content safety, monitoring and evaluation.
- Governance enforced through delivery: TMNZ’s AI policies, system register and risk classifications are supported by technical controls and automated evaluation processes.
- Stronger data capability: Microsoft Fabric provides reusable patterns for governed ingestion, transformation, data quality, reporting and advanced analytics.
- Security built into the platform: Sensitive workloads can be separated, access is managed through defined roles and platform configurations are reproducible through infrastructure as code.
- More controlled integration: Azure API Management provides a governed access point for approved AI interactions with Azure resources and business systems.
- Faster future delivery: Reusable templates, pipelines, code and runbooks reduce the effort required to introduce new environments, workspaces and MCP services.
- Greater visibility and cost control: Centralised monitoring helps TMNZ understand platform activity, AI usage, performance and capacity as adoption grows.
- Stronger internal ownership: Joint design, documentation and knowledge transfer have enabled TMNZ’s teams to operate and extend the platforms over time.
What's next?
TMNZ can continue building on these foundations as it expands its use of data, analytics and AI. Future priorities include introducing additional AI use cases, extending governed MCP adoption, growing Microsoft Fabric reporting and analytics capabilities, and continuing to mature evaluation and development-to-production processes. The shared platform approach gives TMNZ the flexibility to adopt new models and AI services while maintaining consistent expectations for security, governance, quality and auditability.
