What is inside.
18 sections, 6 appendicesFor small and medium New Zealand businesses whose staff already use ChatGPT, Claude or Copilot. It replaces “don’t use AI” with clear rules people can follow, checked against Privacy Commissioner, MBIE and NCSC guidance current at October 2026. Fill in the highlighted fields, then have a legal professional review it.
The rules on one page
Ten plain rules every staff member can follow, on a single page you can pin up.
Approved tools and work accounts
An approved tools list, why personal and free AI accounts are out, and how staff check they are in a work account.
What can go into AI
Four information classes with a clear yes or no for approved tools and for everything else.
Privacy Act 2020 and IPP 3A
Privacy impact assessments, the indirect-collection rule in force from 1 May 2026, biometrics, meeting recordings and Māori data.
Checking AI output
You own the output: what to verify, when to disclose AI use, marketing claims, and copyright.
Decisions about people
AI supports but never makes decisions about hiring, pay, credit or eligibility, with a screen for higher-risk uses.
AI agents and connectors
Least access, human approval before an agent sends, pays or deletes, logging, and hidden prompt injection. Based on May 2026 joint guidance co-authored by NCSC NZ.
Deepfake payment fraud
Call-back and dual approval rules so a cloned voice or video call can never move money.
Security and Copilot readiness
Single sign-on, browser extensions, and the permission clean-up to do before Copilot surfaces the wrong files.
Vendor checks
The questions to ask before approving an AI tool, and a yearly review, because AI vendor terms change often.
Incidents and breaches
What staff report, the Privacy Commissioner’s 72-hour expectation for notifiable breaches, and where to report cyber incidents.
Ready-made appendices
AI register and incident log, vendor terms at a glance (October 2026), a higher-risk screen, an Australian appendix, sources and a staff acknowledgement.
This template is a general resource offered as-is. It is not a substitute for tailored legal advice. We recommend a qualified legal professional review and adapt it for your business.
Need help implementing
your AI policy?
We help NZ businesses develop, customise, and roll out an AI and data governance framework that fits how you actually work.
