# AI use policy

**[Organisation name]**
Owner: [role]
Approved: [date]
Review: [every six months; this area changes quickly]

## Why we have this policy

AI tools can save time. They can also expose personal and confidential information, produce confident errors, and treat people unfairly. The Privacy Act applies to personal information put into AI tools just as it does anywhere else.

## Approved tools

| Tool | Account type | Approved for | Not approved for |
| --- | --- | --- | --- |
| [Tool name] | [Organisation business account, training on our data turned off] | [Drafting, summarising non-sensitive documents] | [Personal information about clients] |

Only use tools on this list, through organisation accounts. Ask [owner] to assess a new tool before using it.

## The rules

1. **No personal information in unapproved tools.** That includes names, contact details, case notes, health information, and anything about colleagues.
2. **No sensitive information in any AI tool** unless that use has been specifically approved after a privacy impact assessment.
3. **De-identify first.** Remove names and identifying details before asking for help with a document. Check nobody could still be identified.
4. **A person checks before it counts.** Review every AI output for accuracy before you send, publish or act on it. You're responsible for the result.
5. **No AI decisions about people** (hiring, eligibility, discipline, risk scoring) without a privacy impact assessment and approval from [role].
6. **Be open.** If AI is used in a way that affects customers or the public, it must be described in our privacy statement.
7. **Keep what matters.** If you save AI output about a person, it becomes personal information we hold. It can be requested and must be correctable.
8. **Respect taonga.** Information about Māori communities, te reo and mātauranga needs particular care. Talk to [role] before using it in AI tools.

## If something goes wrong

If you've put personal information into an unapproved tool, or an AI output has been sent to someone in error, tell [privacy officer] straight away. It may be a privacy breach.

## Questions

Ask [owner, email].

---
From Faraday, faraday.co.nz/templates/ai-use-policy/ (CC BY 4.0). Checked against New Zealand sources on 19 October 2026. General information, not legal advice.