Short answer
This AI use policy template gives New Zealand small and medium businesses a ready-to-edit policy covering approved tools, information rules, the Privacy Act 2020, human review, decisions about people, transparency, incidents and ownership. It reflects the 14 information privacy principles, including IPP 3A, and the Privacy Commissioner’s AI guidance. It is a starting point, not legal advice.
- There are 14 information privacy principles; IPP 3A has applied since 1 May 2026.
- A provider that only processes data on your behalf is not a disclosure under section 11.
- Providers that train on your inputs are treated as holding that information too.
- The Privacy Commissioner expects senior leadership approval and a privacy impact assessment.
- Name approved tools and account types; vague rules get ignored.
How to adopt the template
- List the AI tools in use. Include personal accounts and AI features in software you already pay for; the AI data inventory template helps.
- Fill in the brackets. Delete clauses that do not apply rather than leaving them vague.
- Complete the approved tools register. One row per tool and account type, with its training setting and processing location.
- Test it on five real staff questions. Fix any gap.
- Get it approved. The Privacy Commissioner expects senior leadership to explicitly approve generative AI use (OPC). Then brief staff using scenarios.
The AI use policy template
[Business name] AI use policy. Version [1.0]. Approved by [director] on [date]. Owner: [name, role]. Next review: [date].
1. Purpose and scope
1.1 This policy sets out how staff, contractors and volunteers may use AI tools for [Business name] work: chat assistants, AI features inside other software, and automations that call AI models.
1.2 It applies to work information on any device, including personal phones.
2. Approved tools
2.1 Only tools in the approved tools register may be used with work information, and only with your work account.
2.2 Request new tools from [owner], who checks training use, data location and security, and records the decision.
2.3 New AI features in software we already use count as new tools.
3. Information rules
| Class | Examples | Rule |
|---|---|---|
| Public | Our website text, published standards | Any approved tool |
| Internal | Our templates, procedures, de-identified notes | Approved tools on business plans |
| Confidential or personal | Client files, information about customers or staff, health or financial details | Only tools approved for this class, for approved tasks |
3.1 Never enter passwords, API keys or bank logins.
3.2 Remove names and identifying details the task does not need.
4. Personal information and the Privacy Act 2020
4.1 Personal information we put into AI tools, or that they produce, is covered by the Privacy Act 2020.
4.2 Before an AI tool is used with personal information, [privacy officer] completes a privacy impact assessment.
4.3 A provider that only processes information on our behalf, and does not use it for its own purposes such as training, may be approved for personal information. We remain responsible for that information.
4.4 A provider that uses our information for its own purposes is not approved for personal information.
4.5 If AI is used to collect personal information about people from another source, [privacy officer] decides how we tell them, as IPP 3A requires.
4.6 Do not use AI to recognise or analyse faces, voices or other biometric features without [director]’s written approval.
5. Checking AI output
5.1 You are responsible for work you produce with AI.
5.2 Read AI output in full before using it, and check facts, figures, names and references against the source.
5.3 A second person reviews AI-assisted [client advice, contracts, financial figures] before release.
6. Decisions about people
6.1 A person makes, and is accountable for, any decision about a customer, applicant or staff member. AI may help prepare information only.
6.2 Before relying on AI-prepared information about a person, check it is accurate, up to date, complete and not misleading.
7. Transparency
7.1 We tell customers, in plain language, when AI is used in a way likely to affect them or their personal information.
7.2 Customer-facing chatbots and voice agents say they are AI.
7.3 If a client asks whether AI was used, we answer honestly.
8. Confidentiality and claims
8.1 Client confidentiality terms apply to AI providers as to any other third party.
8.2 We do not claim AI capabilities in our marketing that we cannot back up.
9. Incidents
9.1 Tell [owner] the same day if: confidential or personal information went into an unapproved tool; AI output with a material error reached someone outside the business; or an AI tool did something nobody intended.
9.2 Do not delete the conversation or output.
9.3 [Privacy officer] assesses whether a privacy breach is likely to cause serious harm and, if so, notifies the Privacy Commissioner and affected people as soon as practicable.
10. Ownership and review
10.1 [Owner] maintains this policy and the approved tools register.
10.2 Staff complete [training] before using approved tools for work information.
10.3 This policy is reviewed every [six] months, when we add a tool, and when a provider changes its terms. If unsure whether information can go into an AI tool, ask first.
Which privacy rules each clause covers
The Act now has 14 information privacy principles, numbered 1 to 13 with IPP 3A inserted from 1 May 2026 (Ministry of Justice). The Privacy Commissioner says they apply at every stage of building and using AI (OPC).
| Rule | What it means for AI use | Clause |
|---|---|---|
| IPP 1 | Collect only what the task needs | 3.2 |
| IPP 3A | Tell people when you collect their information from another source | 4.5 |
| IPP 5 | Keep personal information secure, including prompts | 2, 3 |
| IPPs 6 and 7 | People can ask to see and correct AI-produced information about them | 4.1 |
| IPP 8 | Check accuracy before using information about a person | 6.2 |
| IPP 10 | Reusing information to train AI may go beyond its original purpose | 4.4 |
| Section 11 | A provider processing only on your behalf is your agent, not a disclosure; you stay responsible | 4.3 |
| IPPs 11 and 12 | A provider using data for its own purposes may be a disclosure, and offshore disclosure needs a listed ground | 4.4 |
| Sections 112 to 115 | Notify breaches likely to cause serious harm as soon as practicable | 9.3 |
On section 11, OPC gives “your information is used as AI training data” as an example of a provider using information for its own purposes (OPC). OPC asks for breach notification ideally within 72 hours (OPC). Automated biometric processing is governed by the Biometric Processing Privacy Code 2025; the transition period for existing users ended on 3 August 2026 (OPC).
Filled-in example: the approved tools register
Illustrative example: a 12-person Dunedin marketing agency on Microsoft 365. Vendor details as at 19 October 2026.
| Tool and account | Approved for | Trains on our data? | Where processed |
|---|---|---|---|
| Microsoft Copilot Chat, work sign-in | Public and internal | No: prompts and responses are not used to train foundation models (Microsoft) | May be US, EU or other regions |
| ChatGPT Business | All classes, client work after assessment | No, by default (OpenAI) | Offshore; data residency not offered on self-serve Business |
| Personal ChatGPT, Claude or Gemini accounts | Nothing | Depends on personal settings | Not approved |
Common mistakes
- Copying a corporate policy. Nobody in a 12-person business reads fifty pages.
- “Use AI responsibly.” Replace it with an action someone can check.
- No dated register. The policy goes stale within months.
- Treating the policy as compliance. It records decisions; the risk register and incident log show whether they work.
Next step
Walk through drafting and testing in creating a team AI use policy, and use protecting customer information when using AI for staff training. For regulated sectors or board-level policies, see our AI governance advisory.
Sources
- Privacy Act 2020, New Zealand Legislation, version as at 1 October 2026
- Artificial intelligence (AI), Office of the Privacy Commissioner, 21 September 2023
- Generative Artificial Intelligence, Office of the Privacy Commissioner, 15 June 2023
- Working with third-party providers, Office of the Privacy Commissioner, 26 November 2024
- IPP3A: notification requirements for indirect collection, Office of the Privacy Commissioner, accessed 19 October 2026
- Enhancing the Privacy Act, Ministry of Justice, last updated 1 May 2026
- Biometric Processing Privacy Code, Office of the Privacy Commissioner, accessed 19 October 2026
- Notify us of a privacy breach, Office of the Privacy Commissioner, accessed 19 October 2026
- Microsoft Copilot enterprise data protection, Microsoft Learn, updated 19 August 2026
- Microsoft Copilot privacy, Microsoft Learn, updated 19 August 2026
- Enterprise privacy at OpenAI, OpenAI, updated 8 January 2026
Written by the Levy Street team in Wellington. Last updated 19 October 2026.