AI Policy Template NZ: Free Download for Businesses

An AI use policy is a short document that tells your team which AI tools they can use at work, what they can use them for, and what information must never go into them. New Zealand has no AI-specific law as at October 2026, so for most businesses the policy is really about meeting the Privacy Act 2020 when staff use tools like ChatGPT, Copilot or an AI receptionist. You can download our free template below and adapt it in an afternoon.

Download the template: AI use policy template NZ (Word, .docx) or plain text version (.md). Free, no sign-up.

The rest of this guide covers why you need one, the NZ rules it has to fit, and how to fill in each section. Sources were checked on 28 October 2026.

Why your business needs an AI policy now

Your team is probably already using AI. Someone drafts emails with ChatGPT on their phone. Someone else pastes a customer complaint into a free tool to get a polite reply. Your accounting software, CRM and email have quietly added AI features. None of that is a problem on its own. The problem is that nobody has decided where the lines are.

The Office of the Privacy Commissioner makes the same point in its AI guidance: it is critical to understand how people in your organisation may already be using AI, because they "may be unknowingly putting people's privacy at risk". A written policy turns a lot of individual judgement calls into one set of rules everyone can follow.

A good policy also makes it easier to say yes. Once you've decided which tools are approved and what information can go into them, staff can use AI with confidence instead of guessing, or avoiding it altogether.

Does New Zealand regulate AI?

Not with a dedicated AI law. Here is where things stand as at 28 October 2026:

No AI Act. The Government's position, set out in the Public Service AI Framework on digital.govt.nz, is that Cabinet has agreed to "a light-touch, proportionate and risk-based approach to AI regulation". Existing, technology-neutral law applies instead.
New Zealand's AI Strategy. MBIE released New Zealand's AI Strategy: Investing with confidence in July 2025. It deliberately emphasises AI adoption and application by businesses rather than foundational AI development.
Responsible AI Guidance for Businesses. Released alongside the strategy in July 2025, MBIE's Responsible AI Guidance for Businesses is a voluntary resource for businesses of every size, including sole traders and non-profits.
The Privacy Act 2020 applies in full. The Office of the Privacy Commissioner's guidance, Artificial intelligence and the Information Privacy Principles (September 2023), is blunt: the Privacy Act applies whenever you collect, use or share personal information, and that includes using AI tools.
IPP3A is new. The Privacy Amendment Act 2025 brought in a new information privacy principle 3A from 1 May 2026. If you collect someone's personal information from another source, you generally have to tell them, unless an exception applies. That matters if an AI tool pulls in information about people from other places.

Other law still applies to what you do with AI too: the Fair Trading Act if AI-written marketing makes misleading claims, the Human Rights Act if an AI tool helps make discriminatory decisions, and copyright if you publish content that copies someone else's work. So "no AI law" doesn't mean "no rules". It means the rules you already have apply to AI.

What the Privacy Commissioner expects

The OPC's September 2023 guidance lists what it expects from organisations using AI tools. Paraphrased, they are:

Senior leadership approval, based on a full look at the risks and how you'll manage them.
A check that the AI tool is necessary and proportionate, and whether a different approach would do.
A privacy impact assessment before you start.
Being transparent with people about how, when and why you use the tool.
Engaging with Māori about potential risks and impacts to their information.
Procedures for accuracy, and for people to access their information.
A person reviewing AI output before anyone acts on it.
Making sure personal information is not kept or disclosed by the AI tool.

For smaller businesses, the OPC's practical advice is simple: if you're not sure, the safest approach is to keep personal information out of AI tools and make sure everyone knows that. Our template is built around those eight expectations, scaled for a small or mid-sized business.

What an AI use policy should cover

The template has 15 short sections. Here's what each one does and how to fill it in.

Purpose and scope

State why the policy exists and who it covers. Include contractors and temps, and make it clear the policy covers personal accounts and free tools used for work, not just tools the business pays for. That's where most of the risk sits.

Owner and Privacy Officer

Name one person who owns the policy. Every NZ organisation already has to have a Privacy Officer under the Privacy Act 2020; in a small business it is usually the owner or office manager. Set a review date. AI tools change fast, so every six or twelve months is sensible.

Approved tools register

This is the heart of the policy. List every AI tool people may use for work, the plan you're on, what it's approved for, and the most sensitive information it can handle. Appendix A of the template has a ready-made register.

One check matters more than most: whether the provider uses your inputs to train its models, and whether you can turn that off. Check the provider's terms for each plan, because the answer can differ between a free personal account and a paid business plan of the same tool.

What staff can and can't do

Spell out the everyday uses you're happy with (drafting, summarising, brainstorming, formulas) and the hard lines. The template's list of "must nots" includes entering restricted information into the wrong tool, letting AI make final decisions about people without human review, deepfakes of real people, and pretending to customers that an AI is a person.

Information classes

A simple table of what can go where does more good than pages of principles. The template uses five classes: public, internal, confidential, personal information and sensitive personal information. Public information can go into any approved tool. Sensitive personal information, such as health details, needs written approval for a specific use.

Privacy Act requirements

This section maps the policy to the Information Privacy Principles: purpose, transparency (including IPP3A), security, access, accuracy and overseas disclosure. Most AI tools used by NZ businesses are run by overseas companies, so the IPP12 check on cross-border disclosure belongs in your approval process.

Human review and accuracy

AI tools produce confident mistakes. The OPC guidance warns that "generative AI tools produce confident errors of fact and logic", and that most public-facing AI tools were developed overseas on training data that may not be relevant or reliable for Aotearoa New Zealand. Your policy should name a person as responsible for anything sent, published or acted on, whoever (or whatever) drafted it.

Being open with customers

If customers talk to an AI chatbot or an AI voice agent, tell them, and give them a way to reach a person. The OPC guidance also suggests a sensible first step for small organisations: tell your customers you're looking at using AI tools and see if they're comfortable with that. If you record or transcribe calls with AI, say so at the start of the call.

Approving new tools, incidents and training

The template includes a checklist for approving any new tool (purpose, data, training settings, data location, access, cost, exit plan) and a short incident process. Under the Privacy Act, if a privacy breach has caused or is likely to cause serious harm, you must notify the Privacy Commissioner and the affected people as soon as practicable. Pasting a customer list into the wrong tool can be exactly that kind of breach.

How to roll the policy out

A policy nobody reads doesn't protect anyone. Here's a practical rollout for a small team:

Find out what's already in use. Ask the team, without blame, which AI tools they use and for what. You'll be surprised.
Fill in the register. Approve the tools that make sense, set them up on business plans with training turned off where possible, and retire the rest.
Do a privacy impact assessment for any tool that touches personal information. The OPC has free PIA guidance and templates on privacy.org.nz.
Update your privacy statement so customers know how you use AI with their information.
Walk the team through it in a 30-minute session, then have everyone sign the acknowledgement page.
Diary the review. Put the next review date in someone's calendar now.

If you'd like help with steps 1 to 3, our AI Readiness Audit looks at how your business actually runs and where AI is worth using (and where it isn't), which gives you most of what you need for the tools register. For larger rollouts, where you're bringing staff along and building AI into core processes, our AI consulting team works through the plan, the build and the governance with you.

Frequently asked questions

Is there an AI law in New Zealand?

No. As at October 2026 New Zealand has no AI-specific statute. The Government has agreed to a light-touch, proportionate and risk-based approach, and existing law applies to AI, especially the Privacy Act 2020, the Fair Trading Act and the Human Rights Act.

Does a small business need an AI policy?

If anyone in your business uses AI tools for work, yes. It doesn't need to be long. A one or two page policy that lists approved tools and says what information must never go into them covers most of the privacy risk the Privacy Commissioner is concerned about.

Can staff put customer information into ChatGPT?

Only if the tool and plan are approved for personal information in your policy and you've done a privacy impact assessment. The Privacy Commissioner's guidance says that if you're not sure, the safest approach is to keep personal information out of AI tools entirely.

Do I have to tell customers I use AI?

The Privacy Act requires you to be open about how you use people's personal information, and the Privacy Commissioner expects organisations to tell people how, when and why AI tools are used. If customers talk to an AI chatbot or voice agent, tell them and offer a way to reach a person.

Is this AI policy template free to use?

Yes. Download the Word or plain text version, change anything you like and use it in your business. It's a practical starting point, not legal advice, so get your own legal or privacy advice if you work in a regulated sector or use AI to make decisions about people.

AI Policy Template NZ: Free AI Use Policy for Your Business