AI policy template for a small NZ firm

Why a one-page AI policy is worth having

Write down which tools staff may use, what they may paste in, and who checks the result. That is a practical place to start with AI governance: a named owner and rules people can refer to while doing the work.

MBIE's voluntary Responsible AI Guidance for Businesses, released in July 2025, recommends starting small with a real business problem, building the team's AI awareness, and choosing tools and providers that meet New Zealand's legal and ethical standards.

What the Privacy Commissioner expects

The Office of the Privacy Commissioner (OPC) says the Privacy Act applies to everyone using AI tools in New Zealand. Its 2023 generative AI expectations call for senior leadership approval, a privacy impact assessment before starting, and telling staff and customers how their information is used.

Do not put personal or confidential information into a tool unless the provider has confirmed it does not retain or disclose it. If in doubt, the OPC recommends leaving personal information out. Also, the Privacy Commissioner expects staff to check AI output before acting on it.

The privacy principles that apply to AI tools

Use the privacy principles as a checklist for each proposed tool and task. IPP3A came into force on 1 May 2026.

The policy

Replace every placeholder, name the people responsible and remove any use you have not approved. The sections run from everyday use through privacy and vendor checks to incidents and review.

AI USE POLICY: {{firm name}}
Owner: {{policy owner}}. Approved: {{approval date}}. Next review: {{review date}}.

1. Purpose and scope
Use AI for {{approved tasks}}. These rules apply to everyone doing work for the firm. Start with a small task and use only the tools and data approved below.

2. Approved tools and who approves them
{{approver name or role}} approves each tool, account and permitted use before staff use it. Approved tools and uses: {{tool, plan, account and permitted use}}. Ask before adding a tool or changing its use.

3. What may and may not go into a tool
Never put personal or confidential client information into free tools. Use fictional or stripped data for testing; check that stripped data cannot identify anyone. For other tools, use personal or confidential information only with approval and provider confirmation that it is not retained or disclosed. If unsure, stop and ask {{privacy contact}}.

4. Human review before acting
You check it, you approve it. {{reviewer role}} checks facts, sources, calculations and suitability before anyone acts on or shares output. Correct errors and keep a record of who checked what, and when.

5. Privacy
Complete a privacy impact assessment before a new tool and update it regularly. Check purpose (IPP1), telling people (IPP3 and IPP3A), security including prompts (IPP5), access (IPP6), correction (IPP7), accuracy (IPP8), limits on use (IPP10), disclosure (IPP11) and overseas disclosure (IPP12). {{privacy contact}} handles access and correction requests. Do not reuse information for another purpose without checking it first.

6. Vendor checks
{{vendor checker}} records whether training is on by default, retention terms, where data is stored, who can see inputs and outputs, and how deletion works. Confirm the provider's terms before approval; ask again when terms change.

7. Meetings and recordings
Tell attendees before an AI recorder or note-taker joins. No recorder in client meetings without consent. {{meeting owner}} checks consent and the approved storage and deletion arrangements before starting.

8. Telling clients when AI helped with their work
{{responsible person}} tells clients how their information is used and when AI helped prepare their work, using {{agreed wording and point of disclosure}}. Check client terms before using AI on their work.

9. Regulated work
AI does the admin and the professional keeps the judgement. {{responsible professional}} checks and approves the end product against professional rules and insurer requirements. Do not pass professional decisions to AI.

10. If something goes wrong
Stop the affected use and tell {{incident contact}} promptly. Record what happened without spreading the information further. {{decision maker}} decides who needs to be notified, with appropriate advice, and records the decision and response.

11. Training, record of use and review date
{{training owner}} explains these rules before staff use a tool. Keep {{record location}} up to date with the tool, task, data type, reviewer and approval date, without copying client information into the record. {{policy owner}} reviews this policy on {{review date}} and when tools, terms or work change.

How to fill in each section

1. Purpose: name the tasks you want help with, rather than approving every possible use.
2. Approved tools: record the plan and account as well as the tool name, and name the approver.
3. Inputs: give staff examples of information to leave out. Check test data before anyone pastes it.
4. Human review: assign a person who can check the work and approve it.
5. Privacy: name the privacy contact and complete the assessment before approving a new tool.
6. Vendors: keep the checked terms and settings with the approval record.
7. Meetings: decide who tells attendees, asks for consent and checks the recording arrangements.
8. Clients: agree what you will tell clients and when, before staff start using AI on their work.
9. Regulated work: name the professional who keeps responsibility for the final work.
10. Incidents: choose a contact staff can reach and a person to decide the response.
11. Training and review: choose where to keep the use record, who explains the rules and the next review date.

Tools and data: a simple traffic-light rule

Use these as house rules alongside the policy, then agree examples from your own work.

• Green: an approved tool drafting a generic checklist from fictional details. Check the output before using it.
• Amber: a proposed tool, a changed provider term or a task involving client information. Pause for the owner's privacy and vendor checks.
• Red: personal or confidential client information in a free tool, an unapproved recorder in a client meeting, or output sent without human review. Stop.

What a policy cannot do for you

A policy does not check a provider's terms, change a tool's settings or review a draft. Assign those jobs to people, and keep the record of who checked what, and when.

The NZ Law Society's Generative AI guidance for lawyers (updated 24 February 2026) warns that a provider may see inputs and outputs. It advises fictional data for testing and authorised staff use. The professional remains responsible for the end product. For regulated work, AI does the admin and the professional keeps the judgement.

Before adopting this template, check the Privacy Act, your professional body's requirements and your insurer's terms. Resolve any gaps before approving a tool or task.

Frequently asked questions

Sources: OPC AI guidance and MBIE business guidance.