Why it matters
The risk is not that staff use AI. It is that client details, IRD numbers or staff records end up in a free tool that keeps them, and nobody knew that was a problem. A clear rule fixes that faster than any software.
It also makes the good uses easier. Once people know which tool is approved and what can go into it, they stop hiding what they do and start sharing the prompts that work. The policy ends up being as much about getting more from AI as about keeping it safe.
How it works
- We talk through which tools your team uses now and what information you handle.
- Within 5 working days you get a written policy, a one-page staff summary and a list of approved tools.
- A 30-minute session with the team so everyone knows the rules and why they exist.
What changes day to day
The policy is written for your business, in plain English, and short enough that people read it. It draws on the Privacy Commissioner's guidance on AI and MBIE's Responsible AI Guidance for Businesses, and covers telling people when you collect their information from someone else (IPP 3A, in force since 1 May 2026) and sending information offshore (IPP 12). The staff summary fits on one page and goes on the wall or the intranet.
This is for you if
- You suspect staff paste customer emails into ChatGPT, but you have never asked.
- Nobody could tell a new starter which AI tools are allowed.
- A client has asked how you use AI with their information, and you did not have an answer.
Worth knowing
- This is not legal advice. If you are in a regulated industry, have your lawyer look over the final version.
- A policy nobody reads does nothing. That is what the staff session and the one-page summary are for.
- Tools change their terms. Review the approved list once a year, or whenever you add a tool.