An AI use policy template for New Zealand businesses.

01Why a policy, and why it is not enough on its own

Most New Zealand businesses use AI without one. The EMA's survey of more than 300 member businesses, published in July 2026, found 83 percent use AI and 13 percent have an AI policy. In 18 percent of the businesses surveyed, AI is used without a clear owner.

A policy tells people what is allowed. It cannot tell anyone what is actually running. Write the policy, then keep a record of the AI in use with an owner for each item, which is what the Government's Responsible AI Guidance for Businesses, published in July 2025, recommends. The two together are a governance position. Either alone is a document.

02The eight sections

1. Purpose and scope. Why the business uses AI, who the policy covers (staff, contractors, anyone acting for the business), and which tools count: chat assistants, AI features inside licensed software, and agents that act on the business's behalf.
2. Approved tools. The list of AI tools approved for work use, how to request a new one, and how quickly a request is answered. A fast yes is the best defence against unapproved tools.
3. Data. What may and may not go into an AI tool: personal information, client confidential information, commercially sensitive material, and credentials. Tie each rule to the tool's data handling, including where it stores data and whether inputs are used for training.
4. Checking outputs. Who is responsible for an AI output before it is relied on, sent to a client or used in a decision about a person.
5. Agents. What an AI agent may do without a person confirming, who owns each agent, and the approval it needs before it runs.
6. Records and ownership. The register of AI in use, who owns each entry, and who in the business is accountable for AI overall.
7. Incidents. What counts as an AI incident, how to report it, and how it connects to the business's privacy breach process.
8. Review. When the policy is reviewed, and what triggers an early review: a new class of tool, a change in law, or an incident.

03The Privacy Act principles each section answers to

The Privacy Act 2020 sets out the information privacy principles in section 22, and the Privacy Amendment Act 2025 added a new one from 1 May 2026. The ones a staff AI policy most often has to address:

• Principle 1, purpose of collection. Personal information is collected for a lawful purpose connected with the business's functions. Putting it into an AI tool for an unrelated purpose needs a second look.
• Principle 3, collection from the individual. People are told what is collected and why. If AI processes their information, the privacy statement should say so.
• Principle 3A, collection from someone else. In force since 1 May 2026: when personal information is collected from a third party, take reasonable steps to make the individual aware of it, its purpose and their rights. An AI tool that enriches records from another source engages it.
• Principle 5, storage and security. Reasonable safeguards against loss and misuse, which includes knowing where an AI tool stores what it is given.
• Principle 8, accuracy. Reasonable steps to check information is accurate before it is used. AI outputs about a person are information about them.
• Principle 10, limits on use. Information obtained for one purpose is not used for another, subject to the Act's exceptions.
• Principle 11, limits on disclosure. Giving personal information to an AI provider can be a disclosure.
• Principle 12, disclosure outside New Zealand. Sending personal information to a provider overseas needs comparable safeguards in place.

The Office of the Privacy Commissioner's guidance, Artificial intelligence and the Information Privacy Principles, published in September 2023, applies the principles to AI tools. Its expectations for generative AI, published in June 2023, go further than the law requires. The Commissioner expects senior leadership to approve a generative AI tool explicitly, a privacy impact assessment before it is used, and a person to review its outputs before the organisation acts on them. Build all three into the policy.

04Clauses to adapt

• Approved tools: 'Use only the AI tools on the approved list for work. To request a tool, use the request form; requests are answered within five working days.'
• Personal information: 'Do not put personal information into an AI tool unless the tool is approved for that class of information.'
• Confidential information: 'Do not put client confidential or commercially sensitive information into an AI tool that uses inputs for training or stores them outside our approved locations.'
• Outputs: 'You are responsible for any AI output you rely on, send or use in a decision. Check it as you would check work from a new colleague.'
• Approval: 'A new AI tool that will handle personal information is approved by [named senior leader] after a privacy impact assessment.'
• Agents: 'An AI agent that can act on our behalf needs an owner, an approved scope and a budget before it runs. Its approval is reviewed when its model, tools or data change.'
• Incidents: 'Report any AI incident, including personal information entered into an unapproved tool, to the privacy officer the same day.'

05Keeping it alive

The policy lasts as long as the approved list stays current. Review the list monthly, answer requests quickly, and record every approved tool and agent with an owner. When staff can get a tool approved in days, fewer of them use tools nobody approved.