AI security for New Zealand businesses
What can go wrong when a business uses AI, and a practical checklist to stay safe.
What can go wrong
- Too much shared. Customer lists, payroll or health details pasted into a tool that didn’t need them.
- A wrong answer acted on. A price, date or legal point that sounded right and wasn’t.
- AI acting alone. An email sent, a post published or a payment made without anyone checking.
- Hidden instructions. An email or web page can contain text written to steer an AI that reads it, known as prompt injection.
- Better scams. AI makes phishing emails and fake invoices more convincing.
- Account takeover. A stolen password gives someone your AI tool and everything it can reach.
The checklist
| Check | Why |
|---|---|
| Turn on two-step sign-in | A stolen password alone is no longer enough |
| Give each AI tool only the apps it needs | Limits what a mistake or takeover can reach |
| Keep approval on for send, post and pay | A person sees everything before it leaves |
| Share only what a job needs | Less to leak, and the Privacy Act 2020 expects it |
| Know where each tool keeps data | You can answer customers and plan for a breach |
| Check facts, prices and dates | AI can be confidently wrong |
| Verify bank detail changes by phone | Fake invoices are easier to write with AI |
| Keep a log of what AI did | You can see what happened and fix it |
| Write a short AI policy | Staff know which tools are allowed and for what |
| Know how to export your data and leave | You are not locked in |
Our AI policy template covers the last few in one page.
How NOVA’s apps handle this
JENA has two-step sign-in, lets you choose which apps each AI employee can use, waits for approval before anything is sent, posted or paid, keeps an audit log and lets you download all your data. Mini NOVA takes one screenshot only when you send a question, and its server keeps no screenshot, question or answer. Gnomon checks an AI’s rewrite for changed prices, dates and names before it is used.
If something goes wrong
Change passwords and remove the tool’s access to other apps first. If personal information was involved and the breach has caused, or is likely to cause, serious harm, the Privacy Act 2020 requires you to tell the Privacy Commissioner and the people affected as soon as practicable. Cyber security incidents can be reported to the National Cyber Security Centre, which CERT NZ is now part of.
Questions
Is it safe for a business to use AI?
Yes, with care: give AI tools only the access they need, keep a person approving anything that goes out, turn on two-step sign-in and check facts before acting on them.
What is prompt injection?
Text hidden in an email, document or web page that tries to steer an AI reading it. Keeping approvals on means a person sees any action before it happens.
Do I have to report an AI data leak in New Zealand?
If personal information was involved and the breach has caused or is likely to cause serious harm, the Privacy Act 2020 requires you to notify the Privacy Commissioner and affected people.
AI that asks before it acts.
JENA keeps approvals on, logs every action and supports two-step sign-in. Free for 7 days.