Short answer
To create an AI policy for a small team, write one page covering eight things: purpose and scope, approved tools and accounts, data rules, what must be reviewed and by whom, when to tell clients, who owns the policy, what to do when something goes wrong, and a review date. Draft it from a brief, test it against real staff questions, and have the owner or directors approve it.
- One page that staff read beats twenty pages they do not.
- Name approved tools and account types; vague rules get ignored.
- Test the draft against five real questions staff have asked.
- The Privacy Commissioner expects senior leadership approval for generative AI use.
- Blanket bans tend to push use into personal accounts.
Someone in every growing team eventually gets asked to “sort out an AI policy”, usually an owner, operations manager, practice manager or HR lead. For New Zealand teams of roughly 5 to 50 people, this lesson produces a one-page policy that answers real staff questions, tested before anyone sees it and approved by the people accountable for it. Allow 45 minutes, and list the AI tools your team already uses, including the ones nobody officially approved.
Why small teams need a written AI policy
Your staff are already making AI decisions, one prompt at a time. Without a policy, each person decides what client information is safe to paste and whether to mention AI to a client. A short written policy makes those decisions once.
New Zealand guidance points the same way. The joint guide from the NCSC and Australian partners tells small businesses to “establish an internal AI use policy or process, and clearly define what data can’t be uploaded” (NCSC). The Privacy Commissioner expects senior leadership to explicitly approve generative AI use, transparency with customers, and human review before acting on outputs (OPC). MBIE’s quickstart adds a question most policies skip: what you will do if something goes wrong or you want to stop using a tool (MBIE).
The eight sections of a one-page policy
| Section | What it answers | Example rule |
|---|---|---|
| Purpose and scope | Who and what it covers | Applies to all staff and contractors using AI for company work |
| Approved tools | Which tools and which accounts | Copilot Chat with your work login; no personal AI accounts for client work |
| Data rules | What never goes in | No client drawings, reports or personal information unless de-identified |
| Review | What must be checked, by whom | Anything sent to a client is read in full by the author first |
| Disclosure | When clients are told | Tell the client when AI materially shaped advice or a deliverable |
| Ownership | Who owns it and approves new tools | Operations manager owns it; directors approve new tools |
| Incidents | What to do when something goes wrong | Tell the operations manager the same day; do not delete evidence |
| Review date | When it is revisited | Every six months, or when we add a tool |
Exercise: draft and test your policy
- Write a brief. Half a page: what the business does, team size, tools in use, the kinds of client and staff information you hold, and any client contract or professional rules on confidentiality.
- Ask AI for a first draft. Use the prompt in the worked example. Leave client names out of the brief.
- Cut what you will not enforce. Delete any rule nobody will check. Replace vague words such as “responsibly” with a specific action.
- Test it against five real questions. Collect questions staff have actually asked. For each, can someone find the answer in the policy alone in under a minute? Fix every gap.
- Get sign-off. The owner or directors approve it in writing, in line with the Privacy Commissioner’s expectation of senior leadership approval.
- Brief the team in 15 minutes. Walk through the scenarios, not the wording. Put the review date in a calendar.
Worked example: a Wellington engineering consultancy
Illustrative example: a 20-person civil and structural engineering consultancy in Wellington finds staff using four different AI tools, two on personal accounts. The operations manager writes a brief and runs this prompt:
Draft a one-page AI use policy for the business described in the brief below.
Use exactly these headings: Purpose and scope; Approved tools; Data rules; Review;
Disclosure; Ownership; Incidents; Review date.
Rules for the draft:
- Maximum 450 words. Plain New Zealand English. Short sentences.
- Every rule must be something a staff member can follow without asking.
- Do not use the words "responsibly", "appropriately" or "where possible".
- Engineering calculations and design judgement are never delegated to AI.
- After the policy, list five questions staff are likely to ask that the policy
does NOT clearly answer.
BRIEF:
[paste half-page brief]
Example output (illustrative and abridged):
Approved tools
Use Microsoft Copilot Chat signed in with your work account. Personal AI accounts
must not be used for any company or client work. To request a new tool, email the
operations manager; directors decide within five working days.
Data rules
Never enter into any AI tool: client drawings, geotechnical or structural reports,
calculations, fee proposals, or personal information about clients or staff.
You may enter our own templates, public standards text and de-identified notes.
Review
AI must not perform or check engineering calculations. Any AI-assisted text sent
outside the company is read in full by its author, who is accountable for it.
Questions this policy does not clearly answer:
1. Can I use AI to transcribe a site meeting with a client present?
The last section is the most valuable: it found the transcription question, which the team then added a rule for.
Where AI policies go wrong
- Copied from a corporate. A 15-page policy written for a bank will not be read by a 20-person firm. Keep yours to the eight sections.
- Blanket bans. Staff who find AI useful move to personal phones and accounts, which removes your control of data settings. Approve a safe option instead.
- No owner. Policies without an owner and review date go stale as tools change every few months.
- Policy as compliance. A policy does not make a use lawful or safe. It records decisions; the decisions still need the thinking in protecting customer information when using AI.
- Changing jobs without talking to people. If the policy changes how people do their work or how their work is monitored, discuss it with staff first; employers and employees must deal with each other in good faith (Employment New Zealand).
Our AI use policy template for NZ SMBs gives you a ready-made starting draft, and the AI risk register template tracks the risks the policy is meant to control. The incidents section links naturally to managing AI mistakes and escalation, and rolling out AI to a small team shows how to introduce the policy alongside training. For larger organisations, regulated sectors or policies that need board sign-off, our AI governance advisory can help.
Check your policy
- The policy fits on one page and uses the eight sections.
- It names approved tools and the account type for each.
- It says plainly what information never goes into AI tools.
- It answers five real staff questions without anyone needing to ask.
- The owner or directors approved it in writing.
- It has a named owner and a review date in the calendar.
Next lesson: Calculating time saved by AI shows how to measure whether the tools your policy approves are worth what they cost.
Sources
- Generative Artificial Intelligence, Office of the Privacy Commissioner, 15 June 2023
- Artificial intelligence for small business, ASD’s ACSC with NCSC New Zealand and COSBOA, 2025
- Quickstart: Businesses using AI tools, Ministry of Business, Innovation and Employment, accessed 19 October 2026
- Good faith, Employment New Zealand, accessed 19 October 2026
Written by the Levy Street team in Wellington. Last updated 19 October 2026.