Your team uses AI. Write down the rules.
A short AI policy tells your staff which tools they can use, what must never go in, and who checks the output. Here's what to include, how the NZ Privacy Act fits in, and a template outline you can use.
01 · Why it matters in New Zealand
The Privacy Act 2020 applies to personal information whether it's in a filing cabinet or pasted into ChatGPT. If staff put client details into an AI tool, your business is responsible for what happens to them.
The Office of the Privacy Commissioner has published guidance on AI and the Information Privacy Principles. It expects businesses to understand how the AI tools they use work, consider a privacy impact assessment, have leadership approve the tools, and check AI outputs for accuracy. An AI policy is how a small business puts that into practice.
02 · Template outline
1. Purpose and scope
Who the policy applies to (staff, contractors) and which work it covers.
2. Approved AI tools
The tools staff may use for work, on which accounts. Ideally a business plan rather than personal accounts. Anything not on the list needs approval first.
3. What must never go in
For example: client personal information unless the tool is approved for it, health or financial details, passwords, and anything covered by a confidentiality agreement.
4. Checking the output
AI can be confidently wrong. A person checks anything that goes to a client, gets published, or informs a decision, and stays responsible for it.
5. Being open about AI
When you tell clients or customers that AI is involved, for example a chatbot or an AI receptionist, and when a person takes over.
6. Privacy and where data goes
Where each approved tool stores data, and how you handle requests from people to see or correct their information.
7. Who to ask, and reviews
Who owns the policy, who staff ask when unsure, and how often you review it. AI tools change fast, so every six to twelve months is sensible.
03 · Make it stick
A policy only works if the approved tools are actually set up. We set up private, secure AI for your team on a business plan, with the policy written alongside it.
Questions
Does my small business need an AI policy?
If anyone in your business uses AI tools for work, a short policy is worth having. It tells staff which tools they can use, what information must never go in, and who checks the output, which protects your clients and your business.
Is an AI policy a legal requirement in New Zealand?
There's no law that says you must have one. But the Privacy Act 2020 applies to personal information you put into AI tools, and the Privacy Commissioner expects businesses using AI to understand the tools, assess privacy risks and check outputs. A policy is the simplest way to show you've done that.
How long should an AI policy be?
For a small business, one or two pages is plenty. Short policies get read; long ones don't.
Can I get a template?
Yes. Ask us and we'll send you our editable AI policy template for NZ small businesses. It's a starting point, not legal advice: adapt it to your business, and get advice if you handle sensitive information.
Next step
Want the editable AI policy template? Tell us a little about your business and we'll send it over.