# AI use policy template for NZ SMBs. URL: https://levystreet.com/resources/ai-use-policy-template-for-nz-smbs/ Updated: 2026-10-19 Free AI use policy template for New Zealand small businesses, written for the Privacy Act 2020 and its 14 privacy principles, including IPP 3A. Edit, adopt. ## Short answer This AI use policy template gives New Zealand small and medium businesses a ready-to-edit policy covering approved tools, information rules, the Privacy Act 2020, human review, decisions about people, transparency, incidents and ownership. It reflects the 14 information privacy principles, including IPP 3A, and the Privacy Commissioner's AI guidance. It is a starting point, not legal advice. - There are 14 information privacy principles; IPP 3A has applied since 1 May 2026. - A provider that only processes data on your behalf is not a disclosure under section 11. - Providers that train on your inputs are treated as holding that information too. - The Privacy Commissioner expects senior leadership approval and a privacy impact assessment. - Name approved tools and account types; vague rules get ignored. This template reflects the Privacy Act 2020 and Privacy Commissioner guidance as at 20 October 2026. It does not cover every situation, and health, legal, financial and real estate businesses have extra sector rules. Get legal advice where the stakes are high. ## How to adopt the template 1. **List the AI tools in use.** Include personal accounts and AI features in software you already pay for; the [AI data inventory template](/resources/ai-data-inventory-template/) helps. 2. **Fill in the brackets.** Delete clauses that do not apply rather than leaving them vague. 3. **Complete the approved tools register.** One row per tool and account type, with its training setting and processing location. 4. **Test it on five real staff questions.** Fix any gap. 5. **Get it approved.** The Privacy Commissioner expects senior leadership to explicitly approve generative AI use ([OPC](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ai/generative-artificial-intelligence/)). Then brief staff using scenarios. ## The AI use policy template **[Business name] AI use policy.** Version [1.0]. Approved by [director] on [date]. Owner: [name, role]. Next review: [date]. ### 1. Purpose and scope 1.1 This policy sets out how staff, contractors and volunteers may use AI tools for [Business name] work: chat assistants, AI features inside other software, and automations that call AI models. 1.2 It applies to work information on any device, including personal phones. ### 2. Approved tools 2.1 Only tools in the approved tools register may be used with work information, and only with your work account. 2.2 Request new tools from [owner], who checks training use, data location and security, and records the decision. 2.3 New AI features in software we already use count as new tools. ### 3. Information rules | Class | Examples | Rule | |---|---|---| | Public | Our website text, published standards | Any approved tool | | Internal | Our templates, procedures, de-identified notes | Approved tools on business plans | | Confidential or personal | Client files, information about customers or staff, health or financial details | Only tools approved for this class, for approved tasks | 3.1 Never enter passwords, API keys or bank logins. 3.2 Remove names and identifying details the task does not need. ### 4. Personal information and the Privacy Act 2020 4.1 Personal information we put into AI tools, or that they produce, is covered by the Privacy Act 2020. 4.2 Before an AI tool is used with personal information, [privacy officer] completes a privacy impact assessment. 4.3 A provider that only processes information on our behalf, and does not use it for its own purposes such as training, may be approved for personal information. We remain responsible for that information. 4.4 A provider that uses our information for its own purposes is not approved for personal information. 4.5 If AI is used to collect personal information about people from another source, [privacy officer] decides how we tell them, as IPP 3A requires. 4.6 Do not use AI to recognise or analyse faces, voices or other biometric features without [director]'s written approval. ### 5. Checking AI output 5.1 You are responsible for work you produce with AI. 5.2 Read AI output in full before using it, and check facts, figures, names and references against the source. 5.3 A second person reviews AI-assisted [client advice, contracts, financial figures] before release. ### 6. Decisions about people 6.1 A person makes, and is accountable for, any decision about a customer, applicant or staff member. AI may help prepare information only. 6.2 Before relying on AI-prepared information about a person, check it is accurate, up to date, complete and not misleading. ### 7. Transparency 7.1 We tell customers, in plain language, when AI is used in a way likely to affect them or their personal information. 7.2 Customer-facing chatbots and voice agents say they are AI. 7.3 If a client asks whether AI was used, we answer honestly. ### 8. Confidentiality and claims 8.1 Client confidentiality terms apply to AI providers as to any other third party. 8.2 We do not claim AI capabilities in our marketing that we cannot back up. ### 9. Incidents 9.1 Tell [owner] the same day if: confidential or personal information went into an unapproved tool; AI output with a material error reached someone outside the business; or an AI tool did something nobody intended. 9.2 Do not delete the conversation or output. 9.3 [Privacy officer] assesses whether a privacy breach is likely to cause serious harm and, if so, notifies the Privacy Commissioner and affected people as soon as practicable. ### 10. Ownership and review 10.1 [Owner] maintains this policy and the approved tools register. 10.2 Staff complete [training] before using approved tools for work information. 10.3 This policy is reviewed every [six] months, when we add a tool, and when a provider changes its terms. If unsure whether information can go into an AI tool, ask first. ## Which privacy rules each clause covers The Act now has 14 information privacy principles, numbered 1 to 13 with IPP 3A inserted from 1 May 2026 ([Ministry of Justice](https://www.justice.govt.nz/justice-sector-policy/key-initiatives/enhancing-the-privacy-act/)). The Privacy Commissioner says they apply at every stage of building and using AI ([OPC](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ai/)). | Rule | What it means for AI use | Clause | |---|---|---| | IPP 1 | Collect only what the task needs | 3.2 | | IPP 3A | Tell people when you collect their information from another source | 4.5 | | IPP 5 | Keep personal information secure, including prompts | 2, 3 | | IPPs 6 and 7 | People can ask to see and correct AI-produced information about them | 4.1 | | IPP 8 | Check accuracy before using information about a person | 6.2 | | IPP 10 | Reusing information to train AI may go beyond its original purpose | 4.4 | | Section 11 | A provider processing only on your behalf is your agent, not a disclosure; you stay responsible | 4.3 | | IPPs 11 and 12 | A provider using data for its own purposes may be a disclosure, and offshore disclosure needs a listed ground | 4.4 | | Sections 112 to 115 | Notify breaches likely to cause serious harm as soon as practicable | 9.3 | On section 11, OPC gives "your information is used as AI training data" as an example of a provider using information for its own purposes ([OPC](https://www.privacy.org.nz/resources-and-learning/a-z-topics/working-with-third-party-providers/)). OPC asks for breach notification ideally within 72 hours ([OPC](https://www.privacy.org.nz/responsibilities/privacy-breaches/notify-us/)). Automated biometric processing is governed by the Biometric Processing Privacy Code 2025; the transition period for existing users ended on 3 August 2026 ([OPC](https://www.privacy.org.nz/privacy-principles/codes-of-practice/biometric-processing-privacy-code/)). ## Filled-in example: the approved tools register Illustrative example: a 12-person Dunedin marketing agency on Microsoft 365. Vendor details as at 19 October 2026. | Tool and account | Approved for | Trains on our data? | Where processed | |---|---|---|---| | Microsoft Copilot Chat, work sign-in | Public and internal | No: prompts and responses are not used to train foundation models ([Microsoft](https://learn.microsoft.com/en-us/copilot/microsoft-365/enterprise-data-protection)) | May be US, EU or other regions | | ChatGPT Business | All classes, client work after assessment | No, by default ([OpenAI](https://openai.com/enterprise-privacy/)) | Offshore; data residency not offered on self-serve Business | | Personal ChatGPT, Claude or Gemini accounts | Nothing | Depends on personal settings | Not approved | ## Common mistakes - **Copying a corporate policy.** Nobody in a 12-person business reads fifty pages. - **"Use AI responsibly."** Replace it with an action someone can check. - **No dated register.** The policy goes stale within months. - **Treating the policy as compliance.** It records decisions; the [risk register](/resources/ai-risk-register-template/) and [incident log](/resources/ai-incident-log-template/) show whether they work. ## Next step Walk through drafting and testing in [creating a team AI use policy](/learn/creating-a-team-ai-use-policy/), and use [protecting customer information when using AI](/learn/protecting-customer-information-when-using-ai/) for staff training. For regulated sectors or board-level policies, see our [AI governance advisory](/services/ai-governance/). ## Questions people ask ### Is an AI policy legally required in New Zealand? No law requires a document called an AI policy. But the Privacy Act 2020 applies to personal information you put into AI tools, every agency must have a privacy officer, and the Privacy Commissioner expects senior leadership approval, a privacy impact assessment and human review before acting on AI output. Some regulators, such as the Real Estate Authority and the Law Society, encourage written AI policies. ### Does using ChatGPT or Claude count as sending information overseas? It depends on what the provider does with it. Under section 11 of the Privacy Act, a provider that only stores or processes information on your behalf is treated as your agent, so it is not a disclosure and IPP 12 does not apply, although you remain fully responsible. If the provider uses the information for its own purposes, such as training, sending it may be a disclosure under IPP 11 and IPP 12. ### What is IPP 3A and why is it in an AI policy? IPP 3A, in force since 1 May 2026, requires an agency that collects personal information from someone other than the person to take reasonable steps to tell that person, unless an exception applies. AI tools that enrich contact lists, research people or summarise third-party reports can collect information indirectly, so the policy routes those uses to your privacy officer. ### Should staff be allowed to use personal AI accounts for work? Not for work information. Depending on settings, consumer plans may use your content for training, and the business has no control over retention, access or deletion. Approve a business plan with training off, and make it easy to request new tools. Blanket bans tend to push use onto personal phones, which is harder to see and manage. ### How often should an AI policy be reviewed? Every six months, and whenever you add a tool, a provider changes its terms, or something goes wrong. AI products change plan names, data terms and features several times a year. Put the review date in the policy itself and in someone's calendar, and keep a dated list of approved tools beside it. ## Sources - [Privacy Act 2020](https://www.legislation.govt.nz/act/public/2020/31/en/latest/) - [Artificial intelligence (AI)](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ai/) - [Generative Artificial Intelligence](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ai/generative-artificial-intelligence/) - [Working with third-party providers](https://www.privacy.org.nz/resources-and-learning/a-z-topics/working-with-third-party-providers/) - [IPP3A: notification requirements for indirect collection](https://www.privacy.org.nz/resources-and-learning/a-z-topics/ipp3a/) - [Enhancing the Privacy Act](https://www.justice.govt.nz/justice-sector-policy/key-initiatives/enhancing-the-privacy-act/) - [Biometric Processing Privacy Code](https://www.privacy.org.nz/privacy-principles/codes-of-practice/biometric-processing-privacy-code/) - [Notify us of a privacy breach](https://www.privacy.org.nz/responsibilities/privacy-breaches/notify-us/) - [Microsoft Copilot enterprise data protection](https://learn.microsoft.com/en-us/copilot/microsoft-365/enterprise-data-protection) - [Microsoft Copilot privacy](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy) - [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/) Published by Levy Street (https://levystreet.com), Wellington, New Zealand.