New Zealand small-business questions centre on whether staff may use ChatGPT or Copilot, what can be pasted in, and whether a business plan is 'safe'. The Privacy Commissioner's expectations and IPP 3A are asked about less, but they are what an auditor or customer will check.
What's changing
When the underlying framework last moved and what is scheduled next. Each entry links to the official source. Separate from when we last reviewed this guide (2026-10-08).
- 1 May 2026 Commenced
IPP 3A — notification when personal information is collected from a source other than the individual — came into force.
Relevant where an AI tool infers, compiles or collects personal information about people indirectly. Does not apply to information collected before 1 May 2026.
Office of the Privacy Commissioner — Privacy principles ↗ - 24 January 2024 Guidance
NCSC co-issued 'Engaging with Artificial Intelligence' — joint international guidance for organisations using AI systems securely.
Issued with the Australian Cyber Security Centre and twelve other agencies; focused on using AI securely, not building it; includes mitigations for self-hosted and third-party-hosted AI.
NCSC — Engaging with Artificial Intelligence ↗ - 21 September 2023 Guidance
Privacy Commissioner published 'Artificial intelligence and the Information Privacy Principles', extending the generative-AI expectations to AI tools generally.
States the Privacy Act applies to organisations of all sizes using AI tools and maps the IPPs to the AI lifecycle.
Office of the Privacy Commissioner — Artificial intelligence ↗ - 15 June 2023 Guidance
Privacy Commissioner issued eight expectations for agencies using generative AI.
Senior approval, necessity and proportionality, privacy impact assessment, transparency, Māori engagement, accuracy and access procedures, human review, and no personal or confidential input unless not retained or disclosed.
Office of the Privacy Commissioner — Generative artificial intelligence ↗
What is a responsible AI use policy, and why does a New Zealand business need one?
A responsible AI use policy is the staff-facing rule set for generative and other AI tools: which tools are approved, what may and may not be entered, how outputs are checked, and what to do when something goes wrong. It is distinct from an AI governance framework (a leadership-level document about roles, risk assessment and approval) and from technical controls. The Privacy Commissioner's starting point is that the Privacy Act 2020 applies to everyone using AI tools in New Zealand — business, government and community organisations of all sizes — and the Office has published eight expectations for agencies using generative AI, including senior approval, a privacy impact assessment, transparency, human review and not entering personal or confidential information unless the provider has confirmed it is not retained or disclosed. The NCSC co-issued international guidance on engaging with AI securely in January 2024. If anyone in the business uses an AI assistant for work, this policy is how those expectations become rules people can follow.
- sole trader or very small team — Keep the approved-tool list to the one or two products you actually use and apply the same no-personal-information rule to yourself.
- business with employees, contractors or volunteers — One policy for everyone who can touch company information, including contractors on their own laptops.
- organisation aligned to the NZISM or NCSC guidance — The NZISM requires documented policies for system use; this document is the AI-specific one.
- business asked for SMB1001 by an Australian customer — SMB1001 is an Australian-origin private scheme, not a New Zealand framework; a responsible AI use policy is a reported Gold-tier control if a contract requires it.
Purpose and scope. This policy sets the rules for using artificial intelligence tools — including generative AI assistants, AI features inside approved software, and AI agents — in the course of work for [organisation name]. It applies to every employee, director, contractor, volunteer and other person who uses our systems, accounts, devices or information, on any device, including personal devices used for work. It exists to protect customer, staff and business information, to meet our obligations under the Privacy Act 2020 and our security commitments, and to make sure a person — not a tool — remains accountable for every decision and every piece of work we rely on.
A model clause — adapt the bracketed decisions to your organisation before you use it.
Which AI tools may staff use — and what is the AI Register?
Approval belongs to a named product on a named plan, in a named tenant and region, under the terms and configuration the organisation has actually checked — not to a brand. The Privacy Commissioner warns that a generative AI provider may retain prompts, disclose them or use them to train the model, and advises not entering personal or confidential information unless the provider has explicitly confirmed otherwise; the Office also notes that a provider acting solely as the organisation's agent under section 11 does not take over the organisation's Privacy Act responsibility. The practical mechanism is an AI Register: a short list of approved tools recording the plan, who approved it, the date the data terms were checked, whether training on inputs is off, where data is stored and retained, whether the provider acts as agent or may use information for its own purposes, and which uses are in scope. A tool that is not on the register is not approved, however many people already use it.
- business with employees, contractors or volunteers — Publish the register where staff can see it; an approved list nobody can find is treated as no list.
- ISO 27001 certified or preparing — The AI Register doubles as the asset-inventory evidence (A.5.9) and supplier record (A.5.19) for AI services.
Approved tools and the AI Register. Only AI tools, plans and features recorded as Approved in our AI Register may be used for work. Approval attaches to a specific product, plan, tenant, region and configuration — not to a brand or a company. The AI Register records, for each approved tool: the plan and account type, the business owner, the approver and approval date, whether our content is used to train the provider's models, whether the provider acts solely as our agent or may use information for its own purposes, data location, retention and deletion settings, connectors and plug-ins permitted, the uses that are in scope, and the date the provider's terms were last verified. Requests to add a tool go to [role] and are not approved by paying for a subscription.
A model clause — adapt the bracketed decisions to your organisation before you use it.
What must never go into an AI tool?
Three categories are off-limits by default. Personal information about customers, staff or anyone else — the Privacy Commissioner's expectation is that personal or confidential information is not entered into a generative AI tool unless the provider has explicitly confirmed it is not retained or disclosed, and IPP 5 requires reasonable security safeguards against unauthorised use or disclosure. Credentials, keys and anything that unlocks a system. And confidential or restricted material: commercial-in-confidence information, information held under contract or a non-disclosure agreement, and, for law firms and other regulated practices, anything that could be legally privileged — the Law Society warns that entering client details or privileged material into a public or external tool may breach privilege and confidentiality. The default is a prohibition with an exception path: a specific use of a specific category in an approved tool, documented in the AI Register, with the controls that make it acceptable confirmed rather than assumed.
- regulated or professional-services firm — Add privilege, client-restricted and court-suppressed material to the list, and route approvals through the supervising professional — see the AI and client data guide.
- sole trader or very small team — The simplest compliant habit: never paste a customer's details into a chat window, approved tool or not.
Prohibited inputs. Unless a specific exception is recorded in the AI Register, the following must not be entered into any AI tool, approved or otherwise: personal information about customers, staff, suppliers or any other individual, including names combined with contact, financial, health, identity or employment details; passwords, access keys, tokens, licence keys or security configurations; commercial-in-confidence information, information received under a non-disclosure or confidentiality obligation, and unpublished financial results; and any material that is or may be subject to legal professional privilege. 'Approved tool' does not mean 'approved for this information' — the exception must name both.
A model clause — adapt the bracketed decisions to your organisation before you use it.
How do we de-identify information before using AI on it?
Removing names is not de-identification. The Privacy Act defines personal information as information about an identifiable individual, not only information containing a name, and IPP 1 limits collection to what is necessary for a lawful purpose — which, applied to AI, means the minimum extract needed for the task. For everyday AI use that means: strip direct identifiers, but also distinctive facts, dates, locations, job titles and free-text details that would let a reader work out who is meant; use placeholders rather than real values; and keep the key to any placeholders outside the AI tool. Treat the result as personal information still if an individual could reasonably be identified, directly or by combining it with other information the reader has. De-identification does not remove a contractual confidentiality duty, so a de-identified client document is still confidential.
- business with employees, contractors or volunteers — Give staff a two-line placeholder convention ([Customer A], [Date 1]) and a rule that the mapping never leaves the organisation's systems.
De-identification before use. Where a task needs real-world material, the user must first remove or replace direct identifiers (names, addresses, contact details, account and identity numbers) and indirect identifiers (dates of birth, locations, job titles, distinctive events and free-text detail) that could reasonably identify a person, and must keep any key linking placeholders to real people outside the AI tool. Removing names alone is not de-identification. Material remains personal information, and remains confidential, wherever an individual or client could still be reasonably identified from it or by combining it with other information.
A model clause — adapt the bracketed decisions to your organisation before you use it.
Who checks the output — and what does the Privacy Commissioner expect about decisions?
A person is accountable for every output the organisation relies on. The Privacy Commissioner expects a human to review the outputs of a generative AI tool before the agency takes any action, to reduce the risk of acting on inaccurate or biased results, and expects agencies to develop procedures about accuracy and about individuals' access to their information. IPP 8 requires an agency to take reasonable steps to ensure personal information is accurate, up to date, complete, relevant and not misleading before using it — which squarely covers AI-generated or AI-inferred information about a person. For an SME the practical test is: does any AI tool score, rank, approve, price, shortlist or flag people? If so, a named person must review the decision, the use must be in the AI Register and privacy impact assessment, and affected people must be able to ask how the decision was made.
- business that screens, scores or ranks people — Recruitment filters, credit or pricing tools and complaint triage are the SME uses most likely to need a privacy impact assessment first.
- ISO 27001 certified or preparing — Document the human-review step as a control; auditors increasingly ask for it.
Human accountability and decisions about people. AI output is a draft, not a decision. A named person must check accuracy, sources, completeness and suitability before any AI-assisted work is relied on, sent to a customer or used in a decision. No AI tool may make or substantially determine a decision that significantly affects a person — including hiring, credit, pricing, eligibility, performance or complaints — without documented human review. Any such use must be recorded in the AI Register, covered by a privacy impact assessment, and explained to affected individuals on request.
A model clause — adapt the bracketed decisions to your organisation before you use it.
Personal accounts, free tiers, browser extensions — how do we stop shadow AI?
Most unsanctioned AI use is not malicious; it is a personal ChatGPT login, a free tier, or a browser extension that summarises pages — and each sends company information to a service on consumer terms the organisation never reviewed. The Privacy Commissioner's expectations assume the organisation knows which tools are in use and has assessed them; the NCSC's secure-AI guidance recommends access controls, segregation of environments holding sensitive data and transparency about data use. A written prohibition without technical controls, monitoring, approved alternatives and training is unlikely to be sufficient. The policy therefore does three things: forbids personal and free-tier accounts for work, requires work AI to run under organisation-managed logins, and gives people an approved tool so they have no reason to go around the rule. The technical side (DNS or proxy visibility, extension controls, data-loss prevention) is a separate control programme.
- business with employees, contractors or volunteers — Pair the rule with an approved assistant on a business plan — prohibition without an alternative drives use underground.
Personal and unapproved accounts. Work must not be performed through personal, free-tier, trial or otherwise unapproved AI accounts, browser extensions, chat plug-ins or 'AI features' switched on inside tools we have not approved for that purpose. AI tools used for work must be accessed through organisation-managed accounts and sign-in. Staff who need a capability that no approved tool provides must request it through [role] rather than use an unapproved service; we will maintain at least one approved general-purpose assistant so that a compliant option always exists.
A model clause — adapt the bracketed decisions to your organisation before you use it.
What do we tell customers and staff about our AI use?
Transparency is one of the Privacy Commissioner's eight expectations: people must be told how, when and why a generative AI tool is being used and how privacy risks are being addressed, before information is collected. IPPs 10 and 11 mean personal information collected for one purpose generally cannot be fed into an AI tool for an unrelated purpose, and since 1 May 2026 IPP 3A requires an agency that collects personal information from a source other than the individual — which can include AI tools that infer or compile information — to take reasonable steps to make the individual aware. For staff, transparency means telling them what AI use is logged or monitored and why. The practical minimum is a sentence in the privacy statement, a sentence in customer-facing terms where AI drafts or decides anything, and a line in the staff acceptable-use acknowledgement.
- business with a website privacy statement — The privacy statement is where the AI disclosure lands — update it alongside this policy, not after.
Transparency. Our privacy statement and relevant customer notices must describe how AI tools are used with personal information, including any use that makes or substantially informs decisions significantly affecting individuals. Personal information collected for one purpose must not be used in an AI tool for a different purpose unless the individual has authorised it or an exception under the Privacy Act applies. Where an AI tool collects or compiles personal information from a source other than the individual, we take reasonable steps to make the individual aware as IPP 3A requires. Staff will be told which AI use is logged or monitored, for what purpose and by whom, before monitoring begins.
A model clause — adapt the bracketed decisions to your organisation before you use it.
Something went into an AI tool that shouldn't have — what now?
Treat it as a security incident first and a possible privacy breach second. A privacy breach under the Privacy Act 2020 includes unauthorised access to or disclosure of personal information, and notification to the Privacy Commissioner and affected people is mandatory when it is reasonable to believe the breach has caused or is likely to cause serious harm. Pasting a customer list into a consumer chatbot can meet that definition, so the response runs through the organisation's privacy breach response plan: report immediately, record what was entered and where, use the provider's deletion or conversation-removal controls and capture evidence that they were used, assess serious harm, and notify where required. Staff who report promptly are not disciplined for an honest mistake; concealment is the breach of policy. The AI Register entry should record what the provider's retention and deletion terms actually allow, because that determines whether remediation is possible.
- business with employees, contractors or volunteers — Make the no-blame line real: the first time someone is punished for reporting, reporting stops.
Incidents and mistakes. Any entry of prohibited information into an AI tool, any suspected exposure of information through an AI tool, and any AI output that was relied on and later found to be wrong in a way that affected a person must be reported immediately to [role] and handled under our privacy breach response plan. The report must record the tool, account, date, what was entered or produced, and whether provider deletion controls were used. Prompt, honest reporting will not result in disciplinary action; concealment, delay or repeat use of a prohibited tool will.
A model clause — adapt the bracketed decisions to your organisation before you use it.
The common gaps and red flags — and when must this policy be reviewed?
The recurring failures: a policy that bans everything (so it is ignored), an approved list that is a brand name rather than a plan, a human-review step nobody performs, no register so no one knows what is in use, no privacy impact assessment, and a policy written in 2023 that has not noticed vendor terms, models or the law have moved. The Privacy Commissioner recommends conducting and regularly updating a privacy impact assessment; the NCSC's critical controls and the NZISM both assume documentation is reviewed and current. Review triggers for this policy specifically: a new tool or plan, a change in a provider's data or training terms, a new connector, plug-in or agent, a regulatory change (IPP 3A on 1 May 2026 is the most recent), an incident, and any new use of AI in decisions about people.
- organisation aligned to the NZISM or NCSC guidance — Assessors look for the review date, the register and the privacy impact assessment, not the prose.
Review cycle, triggers and red flags. This policy, the AI Register and the related privacy impact assessment are reviewed at least annually and whenever an AI tool, plan or connector is added or changed, a provider changes its data, training or retention terms, the law or the Privacy Commissioner's guidance changes, an incident occurs, or AI is proposed for a new use involving decisions about people. The following are not accepted as normal practice: approval by brand rather than plan; AI tools in use that are not on the register; human review recorded but not performed; personal information in prompts without a recorded exception; and AI involvement in decisions about people that is not covered by a privacy impact assessment or disclosed in our privacy statement.
A model clause — adapt the bracketed decisions to your organisation before you use it.
What's my next step?
- Download this template — it's part of the free starter pack.
- Nominate a policy owner and an approver.
- Complete the bracketed decisions and delete anything that doesn't reflect how your business actually operates.
- Compare the wording against your real systems and practices before you sign it.
- Get it approved and set a review date, normally within 12 months.
Common misconceptions
These are things people commonly get wrong — the statement itself is the myth, not the fact.
-
A paid or business AI subscription means the tool is approved for any information. likely myth
This is a misconception, not the fact — see the guide above and the sources appendix below for what actually applies.
-
If the provider says it does not train on our data, nothing we enter can be disclosed. confirmed myth
This is a misconception, not the fact — see the guide above and the sources appendix below for what actually applies.
-
Removing names before pasting a document into an AI tool makes it anonymous. confirmed myth
This is a misconception, not the fact — see the guide above and the sources appendix below for what actually applies.
-
A provider described as a 'processor' or 'agent' becomes responsible for the personal information instead of us. confirmed myth
This is a misconception, not the fact — see the guide above and the sources appendix below for what actually applies.
-
The Privacy Commissioner's AI expectations only apply to government agencies. confirmed myth
This is a misconception, not the fact — see the guide above and the sources appendix below for what actually applies.
-
Banning AI tools in a policy is a sufficient control on its own. likely myth
This is a misconception, not the fact — see the guide above and the sources appendix below for what actually applies.
-
Our AI use is nobody's business — the privacy statement does not need to mention it. confirmed myth
This is a misconception, not the fact — see the guide above and the sources appendix below for what actually applies.
-
Essential Eight or Australian privacy rules govern our AI use because the tool is Australian-hosted — New Zealand businesses answer to the Privacy Act 2020, the Privacy Commissioner and NCSC guidance. confirmed myth
This is a misconception, not the fact — see the guide above and the sources appendix below for what actually applies.
Obligations at a glance
The obligations most relevant to this guide, with the regulator, the trigger and the timeframe. Follow the source links in the appendix for the authoritative wording.
| OBLIGATION | REGULATOR | TRIGGER | TIMEFRAME | PENALTY |
|---|---|---|---|---|
| Assess the purpose and privacy impact of AI use | Office of the Privacy Commissioner | An AI tool is adopted, or an existing tool is applied to a new use involving personal information. | Before approval or deployment and again after material changes. | |
| IPP 5 reasonable security safeguards | Office of the Privacy Commissioner | Personal information is entered into, stored by or produced by an AI tool. | Continuously throughout collection, use, storage, access, retention and deletion. | |
| IPP 10 and 11 use and disclosure limits | Office of the Privacy Commissioner | Personal information collected for one purpose is used in or disclosed to an AI tool for another. | Before each materially new purpose, provider, model or disclosure. | |
| IPP 3A indirect-collection notification | Office of the Privacy Commissioner | An AI tool collects or compiles personal information from a source other than the individual. | Reasonable steps to make the individual aware; in force from 1 May 2026 for information collected from that date. | |
| IPP 12 disclosure outside New Zealand | Office of the Privacy Commissioner | An AI provider or sub-processor outside New Zealand receives personal information other than solely as the organisation's agent. | Before disclosure and after changes to location, recipient, purpose or safeguards. | |
| Notifiable privacy breach | Office of the Privacy Commissioner | Personal information is disclosed to an unapproved AI service and it is reasonable to believe serious harm has been or is likely to be caused. | Notify the Commissioner and affected individuals as soon as practicable. | Failing to notify the Commissioner without reasonable excuse is an offence under the Privacy Act 2020. |
Sources
- Office of the Privacy Commissioner — Generative artificial intelligence (expectations, June 2023) primary
- Office of the Privacy Commissioner — Artificial intelligence primary
- Office of the Privacy Commissioner — Artificial intelligence and the Information Privacy Principles (September 2023) primary
- Information Privacy Principle 5 — storage and security of personal information primary
- Information Privacy Principle 10 — limits on use of personal information primary
- Information Privacy Principle 11 — limits on disclosure of personal information primary
- Information Privacy Principle 12 — disclosure outside New Zealand primary
- Office of the Privacy Commissioner — Privacy principles (including IPP 3A) primary
- Privacy Act 2020 — latest version primary
- Office of the Privacy Commissioner — Working with third-party providers primary
- Office of the Privacy Commissioner — Privacy breaches primary
- NCSC — Engaging with Artificial Intelligence (joint guidance, 24 January 2024) primary
- NCSC — Guidelines for secure AI system development primary
- NCSC — Critical Controls summary primary
- New Zealand Information Security Manual primary
- New Zealand Law Society — Generative AI guidance for lawyers primary
This guide and its templates are a professionally drafted starting point, not legal advice. Your obligations depend on your industry, your contracts and your data. Have a qualified adviser review anything high stakes before you rely on it.