Bill to sharpen emergency management

Legislation to sharpen Aotearoa New Zealand’s capacity to prepare for, respond to, and recover from local, regional and national emergencies has now had its first reading and been referred to Select Committee.

The Emergency Management Bill (Bill) has potentially significant implications, particularly for providers of critical infrastructure.

Emergency Management Minister Kieran McAnulty has signalled that the Government regards the Bill as a work in progress, to be shaped in response to submissions.

The Select Committee is now inviting submissions on the Bill, which are due by 3 November 2023.

Key features

The Bill sets out an amended legal framework which will replace the Civil Defence Emergency Management Act 2002 (CDEM Act). It proposes a more “flexible” regulatory framework for setting standards and managing the emergency management system across the “4 Rs” of risk reduction, readiness, response, and recovery.

The Bill will:

Clarify roles and responsibilities across the emergency management system and create a new role for “approved providers of warnings and notifications”;
Recognise and enhance the role of Māori in emergency management (including by establishing a new National Māori Emergency Management Advisory Group);
Promote greater engagement with communities likely to be disproportionately impacted by emergencies;
Require critical infrastructure entities to share more information and establish new “planning emergency levels of service”; and
Increase accountability of critical infrastructure entities, including through compliance reporting.

New “critical infrastructure” regime

The CDEM Act provides for “lifeline utilities”, defined by reference to specific entities and businesses. These include Radio NZ, TVNZ, certain airports and ports, and road network, gas, electricity, water and telecommunications entities. The performance standards of the lifeline utilities that are required by the CDEM Act are somewhat vague.

The Bill replaces “lifeline utilities” with a more flexible, and potentially less certain, “critical infrastructure” regime. This new regime allows the Minister for Emergency Management, subject to certain criteria, to recognise a “critical infrastructure” entity or sector by notice in the Gazette.

The criteria are that:

The entity’s or sector’s assets, systems, networks, and services are essential for the effective functioning of the economy, public safety and security, or the provision of basic public services or other critical infrastructure; and
Any loss of or damage to the entity or sector is likely to severely prejudice such matters as basic public services, public safety and security, or the functioning and stability of Aotearoa New Zealand.

Critical infrastructure entities (including those caught by virtue of operating in a “sector”) will have increased obligations (as compared with the “lifeline utility” regime). These include:

Reviewing and updating three yearly the entity’s plans for functioning during and after an emergency;
Pro-actively sharing information before, during and after emergencies with key government agencies and Emergency Management Committees;
Establishing, reviewing and publishing planning emergency levels of service in respect of their critical infrastructure; and
Reporting annually to the Director of Emergency Management regarding compliance with the entity’s obligations under the legislation.

Potential implications for critical infrastructure sectors

The Bill’s provisions raise a number of questions for critical infrastructure stakeholders:

Which entities might the Minister target for becoming “critical infrastructure” entities? For example, will entities in the food or IT sectors be candidates?
Are the criteria and factors to be applied by the Minister in determining critical infrastructure entity status fit for purpose?
Is the process for subjecting new entities and sectors to the “critical infrastructure” regime appropriate? For example, there is no express obligation for the Minister to consult with the entities being considered for recognition. Should there be?
How will commercially sensitive information be protected within the proposed requirements of the Bill relating to the publishing of planning emergency levels of service?
Is the two-year period to allow for transitioning to the new regime sufficient? And what are the initial and ongoing costs of compliance?
Will the proposed requirements for establishing and publishing plans materially improve emergency management in a co-ordinated manner across Aotearoa New Zealand?
How will these requirements take account of existing regulatory or commercial frameworks for resilience and system security?
How will the proposed reporting obligations avoid overlapping with existing lifeline utility reporting obligations? For example, the climate change adaptation reporting obligations under the Climate Change Response Act?
How do these reforms fit with other work being progressed by the Government? For example:
- The work of the Department of the Prime Minister and Cabinet (DPMC) on strengthening the resilience of Aotearoa New Zealand’s critical infrastructure system. Consultation is currently open on DPMC’s discussion document on this topic;
- The work on resilience being carried out by the Ministry of Business, Innovation and Employment (MBIE); and
- The development of infrastructure policies and rules in the national planning framework, which is anticipated to be advanced following passage of the Natural and Built Environment Bill.

The Bill suggests some important details will be captured in later regulations, including around how mandatory reporting and planning emergency levels of service will work. In particular, the Bill will necessitate changes to the 2015 National Civil Defence Emergency Management Plan which is set out in regulation, and which includes details of the roles and responsibilities for emergency management across the 4 Rs.