Has AI crept into your business? Why you need an AI policy

Most businesses don’t decide to adopt AI. It simply arrives. Someone asks an AI assistant to tidy up an email, another person uses it to summarise a long report, and a transcription tool starts taking notes in meetings. Within months, AI is part of how your business works, whether or not anyone decided it should be.

That isn’t a bad thing. Used well, AI saves time and lifts the quality of everyday work. But without some basic ground rules, it can also expose client information, create privacy problems or put inaccurate material in front of customers.

An AI policy doesn’t need to be long or complicated. A few clear rules give your team the confidence to use AI productively while keeping the risks in check. A quick AI health check is the best place to start.

A five-step AI health check

1. Find out what’s already being used

Ask your team which AI tools they use, what for, and how often. Include free tools, browser add-ons and AI features built into software you already pay for, such as email, accounting and meeting apps. Most businesses find more AI in use than they expected.

AI used without the business’s knowledge is often called “shadow AI”. It usually isn’t a sign of anyone doing the wrong thing. More often, nobody has said what the rules are. The risk lies in what goes into those tools: client details, staff information or financial records entered into a free tool may be stored, reviewed or used in ways you can’t control.

2. Set the ground rules in your AI policy

Your policy should answer three practical questions:

• Which tools are approved? A short list of tools the business has checked is easier to follow than a long list of what’s banned.

• What information can go into them? As a starting point, personal information about clients or staff, financial records and anything confidential should stay out of AI tools unless the business has approved that tool for that purpose.

• What is AI used for, and what isn’t it used for? Drafting and summarising may be fine. Final advice, pricing decisions or anything that affects a person’s employment may not be.

  
  

3. Control access and security

AI tools increasingly connect directly to your email, files and calendars. Review which tools have access to your systems, and remove any that aren’t needed. Turn on two-factor authentication for every account.

Where AI is part of everyday work, use business versions of the tools. These generally give you more control over how your data is stored and whether it’s used to train the tool, but check the terms rather than assuming.

4. Keep a person responsible for the result

AI can be confidently wrong, miss important context or produce something that doesn’t sound like your business. Anything that matters, including advice, figures, customer communications and decisions about people, needs review by someone who understands the subject. Using AI doesn’t shift responsibility for the outcome: that stays with your business.

5. Be open about where AI is used

You don’t need to disclose every time AI helps polish an email. But customers should know when they’re dealing with AI rather than a person, for example a chatbot on your website, or when images or content in your marketing have been generated by AI. A short note is usually enough, and it protects the trust you’ve built.

What New Zealand law and guidance say

New Zealand doesn’t have a specific AI law. Existing laws still apply, and the most important for most businesses is the Privacy Act 2020.

• The Privacy Act applies to AI. The Office of the Privacy Commissioner’s view is that the Privacy Act applies to everyone using AI tools in New Zealand. Its 13 information privacy principles govern how you collect, store, use and share personal information, including when that information goes into an AI tool. Read the Privacy Commissioner’s AI guidance.

• Government guidance for businesses. In July 2025 the Ministry of Business, Innovation and Employment (MBIE) published voluntary guidance to help businesses, including sole traders and not-for-profits, use AI responsibly. It includes a short quick-start guide for businesses using AI tools. See MBIE’s Responsible AI guidance for businesses.

  
  

Other obligations can apply too, including consumer law if AI-generated content in your marketing is misleading, and employment law if AI plays a part in decisions about staff.

Get the benefits without the risk

AI is here to stay, and the businesses that benefit most will be those that use it deliberately. If you’re relying on AI for tax or business decisions, our article on checking AI answers before you act covers the risks.

If you’d like help putting a practical AI policy in place, or reviewing how AI is being used across your business, get in touch with our team.

Last reviewed for accuracy 3 November 2026

Disclaimer: The information in this article is general in nature and does not constitute legal, privacy or tax advice. Talk to us before making decisions based on this content.