# AI Use Policy: [Business name]

Template version 1.0, October 2026. Published by Automate AI (automateai.co.nz).

How to use this template: replace everything in square brackets, delete any clause that does not apply to your business, and keep the policy to what your team will actually follow. This template is a practical starting point, not legal advice. If you work in a regulated sector (health, finance, legal, education) or use AI to make decisions about people, get your own legal or privacy advice before adopting it.

## 1. Purpose

This policy sets out how people at [Business name] may use artificial intelligence (AI) tools at work. It exists so we can get the benefits of AI while protecting our customers' personal information, our confidential business information and our reputation, and so we meet our obligations under the Privacy Act 2020 and other New Zealand law.

## 2. Who and what this policy covers

- Everyone who works for or with [Business name]: employees, contractors, temps and volunteers.
- Any AI tool used for work, on any device, including free and personal accounts. Examples: chat assistants (ChatGPT, Claude, Gemini, Microsoft Copilot), AI features inside software we already use (email, accounting, CRM, design tools), meeting transcription and note-taking tools, AI voice agents and chatbots that talk to customers, and image, audio or video generators.

## 3. Policy owner and review

- Policy owner: [Name, role]. Questions about this policy go to them.
- Privacy Officer: [Name, role]. Every New Zealand business must have one under the Privacy Act 2020.
- This policy is reviewed every [6 / 12] months, and whenever we adopt a new AI tool that handles personal information. Next review date: [date].

## 4. Approved AI tools

Only the tools listed in the AI tool register (Appendix A) may be used for work. Using a tool that is not on the register for work purposes is a breach of this policy. To add a tool, follow the approval process in section 12.

Where an approved tool offers a business or team plan that stops our inputs being used to train the provider's models, we use that plan and that setting. Staff must not use a personal account of an approved tool for work unless the register says so.

## 5. What you can use AI for

You may use approved AI tools to:

- draft and edit emails, documents, proposals and social posts, which a person then reviews
- summarise long documents, meeting notes or research that do not contain restricted information (section 7)
- brainstorm ideas, outlines and options
- write or check spreadsheet formulas, scripts and code
- translate or simplify text
- [Add uses specific to your business, for example answering after-hours phone calls with an approved AI voice agent]

## 6. What you must not do

You must not:

- enter restricted information (section 7) into any AI tool that is not approved for that class of information
- present AI output as checked fact without checking it yourself
- use AI to make or recommend a final decision about a person (hiring, firing, credit, pricing for an individual, service eligibility, discipline) without a person reviewing the decision and the reasons for it
- use AI to create content that impersonates a real person, or deepfake images, audio or video of a real person
- use AI to get around our security controls, or connect an AI tool to our systems (email, files, CRM, accounting) without approval
- tell a customer they are dealing with a person when they are dealing with an AI tool

## 7. What information can go into AI tools

| Class | Examples | Can it go into an AI tool? |
| --- | --- | --- |
| Public | Published website content, public price lists, marketing copy | Yes, any approved tool |
| Internal | Internal procedures, templates, non-sensitive meeting notes | Yes, approved tools only |
| Confidential | Financials, contracts, supplier terms, unreleased plans, passwords, source code | Only tools the register approves for confidential information |
| Personal information | Anything that identifies a person: names, contact details, addresses, phone recordings, photos, customer records, staff records | Only tools the register approves for personal information, and only after a privacy impact assessment |
| Sensitive personal information | Health, financial hardship, criminal history, ethnicity, information about children | No, unless the policy owner and Privacy Officer approve it in writing for a specific use |

If you are not sure which class something is, treat it as the higher class, or remove the identifying details first.

## 8. Privacy Act 2020 requirements

When an AI tool handles personal information, the Information Privacy Principles (IPPs) still apply. In practice that means:

1. **Privacy impact assessment first.** Before we use an AI tool with personal information, the Privacy Officer completes a privacy impact assessment (PIA). The Office of the Privacy Commissioner has PIA guidance and templates at privacy.org.nz.
2. **Purpose (IPP1 and IPP10).** We only use personal information in an AI tool for the purpose we collected it for, or a directly related purpose.
3. **Transparency (IPP3 and IPP3A).** Our privacy statement tells people when and how we use AI tools with their information. Where we collect personal information about someone from another source, we tell them unless an exception applies (IPP3A, in force from 1 May 2026).
4. **Security (IPP5).** We check how each provider stores and protects data, including prompts and uploaded files, and we limit who can access each tool.
5. **Access and correction (IPP6 and IPP7).** If someone asks for their information, that includes information we hold in or produced with AI tools.
6. **Accuracy (IPP8).** We take reasonable steps to check AI output is accurate before we use it about a person (section 9).
7. **Overseas disclosure (IPP12).** We check where each provider processes and stores data, and whether the provider uses our data for its own purposes such as training its models. If personal information would be disclosed overseas, the Privacy Officer confirms IPP12 is met before the tool is approved.

## 9. Human review and accuracy

AI tools produce confident mistakes. A named person is responsible for anything we send, publish or act on, whether or not AI helped make it.

- Check facts, figures, names, dates, links and quotes against a reliable source.
- Check that the output makes sense for New Zealand: our law, our spelling, our place names, te reo Māori.
- Customer-facing AI tools (chatbots, voice agents) must be tested before launch and spot-checked every [week / month]. Keep a record of the checks.

## 10. Being open with customers

- Customers must be told when they are talking to an AI chatbot or AI voice agent, and must have a way to reach a person.
- If we record or transcribe calls or meetings with an AI tool, we tell the people involved at the start.
- We do not publish AI-generated images of real people, products or places as if they were real photographs.

## 11. Confidentiality, intellectual property and fairness

- Do not enter information we have promised to keep confidential, such as client data under an NDA, unless the contract allows it and the tool is approved for confidential information.
- Check that AI-generated content does not copy someone else's work. Do not ask AI tools to reproduce another business's content, logo or style.
- Watch for bias. If an AI tool is used in anything that affects people, check whether its output treats groups of people unfairly, including Māori and other communities that overseas-built tools may not represent well.

## 12. Approving a new AI tool

Before a new tool is added to the register, the policy owner checks:

- [ ] What it will be used for, and whether a tool we already have does the job
- [ ] Which information classes (section 7) it will handle
- [ ] Whether the provider uses our inputs to train its models, and whether we can turn that off
- [ ] Where data is stored and processed, and how long it is kept
- [ ] Who in our business will have access, and whether it supports individual logins and multi-factor authentication
- [ ] Whether it connects to other systems (email, files, CRM, accounting) and what access it gets
- [ ] Whether a privacy impact assessment is needed (always, if it handles personal information)
- [ ] The cost, and who approves the spend
- [ ] How we would export our data and stop using it

## 13. Incidents and privacy breaches

If you think personal or confidential information has gone into the wrong AI tool, or an AI tool has produced or exposed something it should not have, tell [Name / Privacy Officer] straight away. Do not try to fix it quietly.

The Privacy Officer will assess the incident. Under the Privacy Act 2020, if a privacy breach has caused or is likely to cause serious harm, we must notify the Office of the Privacy Commissioner and the affected people as soon as practicable.

## 14. Training

Everyone covered by this policy reads it when they start and when it changes. [Business name] provides practical training on approved tools and safe use [at induction / every 12 months].

## 15. Breaches of this policy

Breaches of this policy are handled under our [code of conduct / disciplinary procedure]. Deliberate or repeated breaches involving personal information may be serious misconduct.

## Acknowledgement

I have read and understood the [Business name] AI Use Policy and agree to follow it.

Name: ______________________

Signature: ______________________

Date: ______________________

## Appendix A: AI tool register

| Tool and plan | Approved uses | Highest information class allowed | Training on our data turned off? | Data location | Owner | Date approved |
| --- | --- | --- | --- | --- | --- | --- |
| [e.g. ChatGPT Team] | [Drafting, summarising] | [Internal] | [Yes] | [Region] | [Name] | [Date] |
| [e.g. Microsoft 365 Copilot] | [Email and document drafting] | [Confidential] | [Yes] | [Region] | [Name] | [Date] |
| [e.g. AI voice agent] | [After-hours call answering] | [Personal information, PIA done on date] | [Yes] | [Region] | [Name] | [Date] |

## Appendix B: Useful New Zealand sources

- Office of the Privacy Commissioner, Artificial intelligence and the Information Privacy Principles (September 2023): privacy.org.nz
- Office of the Privacy Commissioner, IPP3A guidance (in force 1 May 2026): privacy.org.nz
- MBIE, Responsible AI Guidance for Businesses (July 2025): mbie.govt.nz
- MBIE, New Zealand's AI Strategy: Investing with confidence (July 2025): mbie.govt.nz