An AI policy for your NZ business

Why a small business needs one

Staff are likely using AI already, often on personal accounts. A short policy tells everyone which tools are fine, keeps customer information out of the wrong places and shows customers you take the Privacy Act 2020 seriously. It doesn’t need a lawyer to start, though it is worth a review if you handle sensitive information.

The template

1. Purpose. “We use AI to save time on drafts, research and admin. People stay responsible for everything we send, post or pay.”
2. Approved tools. List each tool and what it is for, for example: JENA for drafts, follow-ups and research; Mini NOVA for help with software; a chat assistant for one-off questions.
3. Information rules. “Share only what a job needs. Never put in passwords, bank details, health information or anything a customer told us in confidence.”
4. Approval. “A person reads and approves anything that goes to a customer, is posted publicly or spends money.”
5. Checking. “Check every price, date, name and claim before it is used. AI can be wrong.”
6. Accounts. “Use work accounts with two-step sign-in. No personal accounts for work data.”
7. Te reo Māori and names. “Check macrons and the spelling of names and places in anything AI writes.”
8. Telling people. “If a customer asks, we tell them how we use AI.”
9. Problems. “Report a mistake or a leak to [name] straight away.”
10. Review. “We review this policy every six months.”

Make the tools enforce it

A policy works best when the software backs it up. In JENA, approvals are on for anything that sends, posts or pays, each AI employee can use only the apps you choose, and an audit log records every action. For more on the security side, see the AI security checklist, and for privacy, the Privacy Act checklist for AI tools.