A five-person company can end up using AI in five different ways. One person drafts customer emails in a personal account. Another uploads a spreadsheet to summarise it. A third relies on an AI answer when preparing a quote. None of them intends harm, but nobody has agreed what information is safe to use or who checks the result.

A short, usable policy can replace guesswork with shared expectations. This AI policy template for a New Zealand small business is a starting framework, not a legal compliance certificate. It helps an owner explain which uses are acceptable, what information must stay out, when a person must review the output, and how to raise a concern.

Keep the policy practical and proportionate

A small organisation usually does not need a long technical document to begin. Staff need answers to ordinary questions: Which tools are approved? What work may I use them for? What information must I not enter? Who is accountable for checking the result? What do I do if something goes wrong?

Define AI broadly enough to include generative assistants, automated transcription, recommendation features, and systems that classify or act on information. Many applications add AI features over time, so employees should know to ask the policy owner before enabling a new add-on or connector that can read company files, email or customer records.

Make rules proportionate to risk. Brainstorming a generic staff event is different from summarising a complaint, making a hiring recommendation or drafting a financial decision. The more a task can affect a person’s rights, money, work, health, safety or access to a service, the more careful review and specialist advice it may require.

Copy-ready starting template

Purpose: We use approved AI tools to assist with defined work tasks. A person remains responsible for checking and approving work before it is relied on, sent, published or used to make a decision.

Approved tools and uses: Staff may use [approved tools] for [approved low-risk tasks]. New tools, plug-ins, browser extensions and connections to business information must be approved by [policy owner] before use.

Information rules: Do not enter [customer or staff personal information, payment details, passwords, confidential plans, unpublished creative work, or other restricted information] unless [the named approval process and verified safeguards] expressly permit the specific use.

Review and decisions: Check facts, names, numbers, tone, completeness and source material. AI output must not make or finalise [listed consequential decisions]. A designated person must approve [customer messages, prices, safety-related instructions, employment material and other listed work] before use.

Transparency and records: Tell customers or colleagues when AI materially shapes an interaction where that would help them understand the service. Keep [specified records] for [retention period] in [approved location]. Do not store unnecessary copies of personal information.

Problems and questions: Stop using a tool and contact [named role or channel] if information may have been exposed, an output appears discriminatory or unsafe, or the system takes an unexpected action. The owner will assess the issue, contain it and record follow-up steps.

Owner and review date: [Name or role] owns this policy. Review it on [date] and whenever a tool, process, law, risk or business use changes.

Replace each bracket with a decision that fits the business. If the organisation has no approved tool list yet, start with one tool and one low-risk task rather than leaving the whole team to guess. Make the final version easy to find and short enough that people will actually use it.

Be specific about what is approved

List uses rather than saying simply that AI is allowed or banned. For example, an owner might permit staff to draft a generic outline from public information, but require approval before using AI to respond to a customer complaint. The policy should also name who can approve a new use and how staff can ask.

Give examples that match real work. A receptionist may use a tool to tidy a generic reminder, but should not paste an identifiable customer record into an unapproved service. A manager may ask for a checklist from a public procedure, but should compare it with the current source before relying on it. Examples turn abstract rules into habits.

Set a clear information boundary

Explain information categories in everyday language. Public information is already intended for anyone to see. Internal information is for the team. Confidential information includes business plans, financial details and unpublished material. Personal information relates to an identifiable person. Staff should know which categories may be used with which approved tools, and when approval is needed.

Typing, pasting, uploading or connecting a file can disclose information to a service. Before using a tool, check what happens to prompts and outputs, who can access them, how long they are kept, whether they may be used to improve a system, and where they are stored or processed. Do not assume that a free interface, business account or New Zealand office automatically answers every privacy or security question.

In New Zealand, the Privacy Act 2020 and its information privacy principles remain relevant when organisations handle personal information with AI. The precise obligations depend on the context, the information and the use. If personal information may be processed offshore, or a proposed use has significant effects, check the relevant requirements and obtain appropriate advice rather than relying on a template alone.

Keep human accountability visible

AI can produce fluent text that contains an error, omission or unsupported conclusion. Ask reviewers to compare important claims with primary business records, verify calculations independently, and check whether the answer suits the actual customer or situation. A final reviewer must have the authority and time to change or reject the output.

Do not let convenience quietly turn a draft into a decision. Set a named approver for quotations, refunds, staff decisions, safety instructions, eligibility, or other high-impact work. If a system is allowed to take an action, document what it may change, limit its permissions, and require human confirmation for consequential steps.

Where a use involves Māori data or may materially affect Māori people or communities, a generic policy checkbox is not enough. Consider whether the information is necessary, who should guide decisions about it, how collective interests and cultural context are respected, and whether relevant Māori expertise should be involved early. Do not use Māori data for AI training without clear permission and appropriate governance.

Make disclosure and incident reporting easy

Staff should know when to explain that AI has shaped an interaction, especially when a customer is communicating with an automated system or the output materially influences an answer. Be clear about what the system can and cannot do, and offer a human route for questions or complaints.

Write down the first response to an incident: stop the affected activity, limit further access or sharing, tell the policy owner, preserve the facts needed to understand what happened, and follow the business’s privacy or security incident process. Staff should not be punished for raising a genuine concern early. Fast reporting gives the business a chance to contain a problem.

Train, test and review the rules

Introduce the policy with short examples drawn from the team’s work. Ask staff to classify sample inputs, identify a risky prompt, check a generated answer and practise escalating a concern. Training is more useful when people can apply it during a busy day rather than merely acknowledge a document.

Review the policy on a set date and when a tool, feature, data flow, law or business process changes. Track questions that staff repeatedly ask; they may show that the policy is unclear. If a new use cannot be explained in a sentence, identify its purpose, expected benefit, information involved, possible harm, reviewer and stop condition before approving it.

A useful AI policy template for a New Zealand small business is not the longest document. It is the one employees can follow, the owner can maintain and the business can adapt when its tools or risks change. Start with clear boundaries, make human responsibility explicit, and seek tailored advice where the stakes or data sensitivity are high.

Frequently asked questions

1. Does a small business in New Zealand need an AI policy?

A policy is a practical way to set consistent rules, reduce confusion and support responsible use. The right level of formality depends on the business, its information and its AI uses.

2. Is this AI policy template legal advice?

No. It is a starting framework. It cannot assess a particular business’s contracts, privacy obligations, employment context or risk. Seek appropriate advice for material or high-risk uses.

3. What should staff never paste into an AI tool?

At minimum, identify personal, confidential, security-sensitive and legally restricted information as do-not-enter categories unless a specific approved process and verified safeguards allow the use.

4. Does the Privacy Act apply when a business uses AI?

New Zealand privacy obligations can apply when an organisation collects, uses, stores or discloses personal information through AI. Check the specific use, service settings and any offshore processing.

5. Should a business ban all AI tools?

Not necessarily. A business can permit defined, low-risk tasks with approved tools and clear review, while restricting sensitive information and consequential decisions.

6. Who should approve AI-generated work?

A person with relevant responsibility and enough knowledge to verify the output should approve work before it is sent, published or used for an important decision.

7. What should a staff member do after a possible AI data incident?

Stop the affected activity, promptly tell the named policy owner and follow the organisation’s privacy or security incident procedure. Do not hide the issue or continue using the affected workflow.

8. How often should an AI policy be reviewed?

Set a regular review date and revisit the rules whenever the tools, data, business process, legal context or level of risk changes. Update staff when the approved practices change.