A Transport Accident Investigation Commission report said the state-owned air traffic controller also had not prepared for the scenario which led to scores of flights being grounded and hours of disruption in June 2015.
"The controllers had trained for scenarios in which they lost radio communications or surveillance systems, but not both simultaneously."
During the outage, air traffic sector controllers in the national air traffic management centre at Christchurch lost radar and radio contact with the aircraft under their control.
Although the sector controllers had alternative radio frequencies and standby radios to contact aircraft, not all of these systems worked as expected, the commission found.
The telephone system was also disrupted by the outage, which prevented normal communication between the sector controllers and the airport control towers around New Zealand.
"This incident could have presented a significant risk to the safety of air transport if the network had not recovered after a few minutes," the report said
It was fortunate the outage occurred in daytime while the weather across the country was good and before the evening peak.
"These factors minimised the potential consequences," the report said.
The report also found Civil Aviation Authority rules were not suited to new technology used to control air traffic. Both Airways and the CAA had bought in new measures or hired new staff to try to avoid a repeat of the incident.
The report says radar, radio and telephone services of the national air traffic control system were integrated in a digital data network.
The interruption of services occurred when activities during an upgrade programme to migrate remaining services on another part of the digital data network inadvertently caused a "broadcast storm".
This prevented normal digital data traffic from reaching the control centre and thereby interrupted radar surveillance and communication systems.
There were 42 aircraft flying under air traffic control at the time of the outage. Three were delayed in landing and 49 scheduled departures were delayed. Nineteen flights were cancelled and it took hours for the air transport system to get back to normal.
The commission has recommended that the Secretary for Transport update and restructure Civil Aviation rules which define how an aeronautical telecommunications network is to be managed.
"The incident was a reminder that effective risk management is a continuous process that applies to all aspects of an organisation's activities. From major projects to minor tasks, consideration must be given to the context of the activity within the organisation's purpose."
The report says the CAA has changed its approach by implementing a learning and development training for regulatory staff, revision of position descriptions and recruitment or secondment of new staff.
A new auditor had been found for rules covering digital data networks.
In response Airways had engaged an external specialist organisation to critically review its digital data network and how it was managed. Airways has since implemented many of the recommendations made by the external reviewer, the commission said.
Airways' chief operating officer Pauline Lamb said at no point was the safety of the travelling public compromised.
''Air traffic controllers are trained for such events and used established back up processes to ensure airborne aircraft continued to their planned destinations safely.''
The outage was caused by a software code error on a device that was introduced to the network at the end of a complex 18-month upgrade project to transition its network from analogue to digital technology.
''While this device behaved in a way it was not designed to, Airways also did not have the highest level of protection in place, as we would normally expect,'' she said.
