AI use policy

How to use this

Staff are already using AI tools. A short, clear policy works better than a ban nobody follows. Fill in the approved tools list after checking each tool’s terms, in particular whether the provider uses your inputs for its own purposes. Our guide on AI at work explains the reasoning.

AI use policy

[Organisation name] Owner: [role] Approved: [date] Review: [every six months; this area changes quickly]

Why we have this policy

AI tools can save time. They can also expose personal and confidential information, produce confident errors, and treat people unfairly. The Privacy Act applies to personal information put into AI tools just as it does anywhere else.

Approved tools

Only use tools on this list, through organisation accounts. Ask [owner] to assess a new tool before using it.

The rules

1. No personal information in unapproved tools. That includes names, contact details, case notes, health information, and anything about colleagues.
2. No sensitive information in any AI tool unless that use has been specifically approved after a privacy impact assessment.
3. De-identify first. Remove names and identifying details before asking for help with a document. Check nobody could still be identified.
4. A person checks before it counts. Review every AI output for accuracy before you send, publish or act on it. You’re responsible for the result.
5. No AI decisions about people (hiring, eligibility, discipline, risk scoring) without a privacy impact assessment and approval from [role].
6. Be open. If AI is used in a way that affects customers or the public, it must be described in our privacy statement.
7. Keep what matters. If you save AI output about a person, it becomes personal information we hold. It can be requested and must be correctable.
8. Respect taonga. Information about Māori communities, te reo and mātauranga needs particular care. Talk to [role] before using it in AI tools.

If something goes wrong

If you’ve put personal information into an unapproved tool, or an AI output has been sent to someone in error, tell [privacy officer] straight away. It may be a privacy breach.

Questions

Ask [owner, email].