Why your business needs an AI policy.
Here's something we see in almost every Wellington business we visit. Staff are already using AI. Some use it well. Some paste client emails, spreadsheets or contracts into free tools without thinking twice. Nobody has told them what's okay and what isn't.
AI Policy.
An AI policy fixes that. It's a short, plain-English document that sets the rules for how your business uses AI. It protects your clients, your reputation and your staff, and it gives everyone the confidence to use AI properly instead of quietly.
What a good AI policy covers.
Approved tools
Which AI tools staff can use for work, and on what accounts
Data rules
What information can and can't go into AI, especially personal and client information
Checking output
Who reviews AI-generated work before it reaches a client or the public
Disclosure
When you tell customers that AI was involved
Ownership and IP
Who owns AI-assisted work and how you handle copyright
Responsibility
Who looks after the policy and how often it's reviewed
Keep it short.
A good policy for a small business fits on two or three pages. If it's 20 pages long, nobody will read it. The aim is clear rules your team can remember, backed by a quick reference sheet they can keep on their desk.
The New Zealand context.
The Privacy Act 2020 applies to personal information whether it's handled by a person or an AI tool. The Office of the Privacy Commissioner has published guidance on using generative AI, and it's worth reading before you roll AI out widely.
How to roll your policy out.
Writing the policy is only half the job. The other half is making sure people understand it and follow it. A policy that sits in a shared drive won't change much. A short team session that explains the reasons behind each rule usually does.
- Walk the team through it with real examples from your business
- Give everyone a one-page quick reference sheet
- Have approved tools set up and ready before the policy goes live
- Name one person staff can ask when they're unsure
- Add the policy to onboarding for new starters
Keep it current.
AI tools change quickly, so your policy needs a light review at least once a year. New features, new tools and new guidance from the Privacy Commissioner can all mean small updates. Put a review date on the policy and stick to it.
When to get help.
If you handle health information, financial records or other sensitive data, it's worth a second opinion before rollout. Our AI policy workshop takes your leadership team through each section and leaves you with a finished, practical policy. For higher-risk businesses we also recommend a legal review of the final version.
Talk it through with Ryan.
We help businesses across Wellington, the Hutt Valley, Porirua and Kāpiti write and roll out AI policies that people follow. Start with our free template or have us run a policy workshop with your team.