AI is becoming increasingly embedded in how organisations operate, from routine administrative tasks and content creation to analysis and decision-making. As its use grows, so too do the risks. AI tools may produce inaccurate or biased outputs, expose confidential or personal information, create intellectual property issues, or be used in ways that are difficult to explain or oversee. These risks reinforce the need for organisations to put good AI governance practices in place.

AI governance is the framework of roles, responsibilities, policies, processes and controls through which an organisation directs and oversees its use of AI. Effective governance helps ensure that AI is used lawfully, responsibly and consistently with the organisation’s values and risk appetite. It also supports accountability, enables proportionate oversight of higher-risk uses, and gives customers, business partners and other stakeholders greater confidence in how the organisation uses AI.

In New Zealand there is no general AI-specific legislation. The Government’s AI Strategy adopts a light-touch, principles-based approach that relies on existing laws, supported by voluntary guidance for businesses. Good AI governance helps organisations translate that framework into practical controls.

An AI use policy is a good starting point for putting that governance into practice. It can translate an organisation’s existing legal obligations and risk settings into clear, practical rules about how AI tools can and cannot be used. This article outlines the key matters a good AI use policy should cover, including permitted use, privacy and data protection, human oversight, intellectual property, transparency, accountability and training.

Scope and permitted use

The policy should identify which AI tools and uses are permitted, which require approval and which are prohibited. As a baseline, staff should use only organisation-approved AI tools for work. An approved-tools list can be kept in an appendix, allowing it to be updated without revising the policy itself. Before approving or acquiring a tool, organisations should involve the relevant legal, privacy, security, technology and procurement personnel or advisers, having regard to the nature and risk of the proposed use, to assess its security, privacy and contractual implications.

Some organisations categorise AI uses according to risk. Lower-risk uses might include generating initial ideas or summarising non-confidential material, subject to appropriate review. Uses that may materially affect an individual, involve confidential or personal information, or operate without adequate human oversight should require additional controls and approval. The policy should identify prohibited uses and give practical examples so staff can recognise when they need advice.

Privacy and data protection

The policy should give staff clear rules about the information that may be entered into AI tools. Personal, confidential, privileged or commercially sensitive information should not be entered unless the tool and the proposed use have been approved. This may include customer records, employee information, commercially sensitive material and confidential information belonging to third parties.

Before an AI tool is approved for use with personal, confidential, privileged or commercially sensitive information, the organisation should understand how the provider collects, uses, stores and retains that information. Appropriate contractual and technical controls should be put in place, including controls over whether inputs are used to train the provider’s models.

The policy should identify when a privacy impact assessment, AI impact assessment or other risk assessment is required. A privacy impact assessment is likely to be appropriate where a proposed use involves personal information and creates material privacy risks, particularly in connection with automated decision-making or profiling. An AI impact assessment or other risk assessment may be needed to evaluate impacts such as bias, explainability, security and the consequences of error. Assessments should be reviewed as the tool or its use changes.

The policy should also explain which proposed uses involving personal information require approval and who may give that approval. It should require prompt reporting of AI-related incidents, such as unintended disclosure of personal, confidential or privileged information, security issues or problematic outputs, so they can be contained and assessed.

AI-generated content may itself contain personal or official information or become part of an organisation’s records. The policy should therefore explain how outputs must be handled, stored and disclosed in accordance with applicable legal obligations, including the Privacy Act 2020 and, for public sector organisations, the Official Information Act 1982.

Human review and responsible use

Using an AI tool does not remove an organisation’s responsibility for its work or decisions. The policy should require appropriate human review where AI contributes to content, advice or a decision. Higher-risk uses, including certain employment, credit and eligibility decisions, should require closer scrutiny, clear authorisation and documented human oversight, particularly where an outcome may materially affect an individual.

AI outputs may be inaccurate, incomplete, out of date or affected by bias and other limitations in the model or its training data. Before relying on an output, staff should check its factual accuracy, completeness and context, verify any sources or references, identify potentially biased or inappropriate content, and confirm that the output is suitable for its intended purpose and audience. Outputs used for external communications, advice, important business decisions or decisions affecting individuals should not be used without meaningful human review.

Intellectual property

An AI use policy should address intellectual property risks associated with both the material entered into a tool and the content it produces.

On the input side, staff should not enter third-party material into an AI tool without considering whether they have permission to do so and whether the proposed use is consistent with the tool’s terms. The policy should also prohibit the use of confidential information or trade secrets where this could breach an obligation of confidence.

On the output side, AI-generated content should be independently reviewed before it is used or published, including for the risk that it reproduces third-party material. Questions may also arise about whether copyright subsists in the output and, if it does, who owns it. The position will depend on the circumstances, including the nature and extent of human involvement and the provider’s terms governing ownership and permitted use. Organisations creating commercially important material with AI should preserve a record of the human contribution, including substantive instructions, revisions and editorial decisions.

Transparency

The policy should explain when the use of AI must be disclosed and to whom. Internal disclosure or approval may be required where AI contributes materially to content, advice or a decision.

External disclosure may be appropriate where a person is interacting with an AI system, where AI has materially contributed to customer-facing work, or where disclosure is required by law or contract. Organisations should also consider whether their privacy notices, terms of use and customer communications accurately describe how AI is used.

Governance, training and incident management

Responsibility for the policy should sit with a clearly identified person or function. Depending on the organisation’s size and risk profile, oversight may sit with an individual or a cross-functional group drawn from relevant legal, technology, privacy, security, risk, procurement and business personnel or advisers. That oversight should include maintaining the policy, monitoring material risks and higher-risk uses, and reporting to senior management or the board where appropriate.

Operational responsibilities should also be clear. The policy should identify who can approve new tools and higher-risk uses, who staff should contact with questions, and how AI-related incidents must be reported. Organisations should keep proportionate records of approved tools, risk assessments, material approvals, higher-risk uses and incidents.

Staff should receive practical, role-appropriate training on the policy, approved tools and the risks associated with AI use. The policy should address the use of personal AI accounts or unapproved tools for work purposes, particularly where organisational information or work devices are involved. It should also explain how AI-related incidents will be contained, investigated, escalated and managed, and the consequences of non-compliance.

Concluding remarks

There is no single AI use policy that will suit every organisation. The appropriate approach will depend on the organisation’s activities, risk profile and intended uses of AI. A useful first step is to identify how AI is already being used, the tools staff can access and the risks those uses create.

Organisations can then assign responsibility for oversight, assess and approve tools and higher-risk uses, and adopt a policy supported by practical training, record-keeping and AI-related incident-reporting processes. The policy should give staff clear and workable guidance and be reviewed regularly as the organisation’s use of AI, available technology and applicable legal requirements change.

If you are developing or reviewing an AI use policy, our team can help you identify the legal and practical issues relevant to your organisation.

Get in touch

If you would like to discuss any of the above, get in touch with one of our experts.

Special thanks to Bridget de Lautour for her assistance in writing this article

Read the other article in our AI Governance Series:

Part One: The NZSIS warning for business: when espionage becomes an enterprise risk