Module 4: Safe use in New Zealand and next steps
Write a simple team AI policy starter
Allow 5 minutes, including any practice below.
Start with rules staff can use
This is a starter for discussion, not a complete policy or legal assurance. Ask your manager and privacy officer to adapt it before staff use it with real work.
Team AI use: draft for review
Owner: [responsible manager]
Approved tool and workspace: [name and account type]
Approved tasks: [for example, drafts from public or fictional material]
Allowed data: [specific approved categories]
Prohibited inputs: passwords, access tokens, authentication codes,
and any personal or confidential material not explicitly approved.
Connections: only apps approved by [role], with reviewed permissions.
Checks: compare outputs with original sources; verify facts and numbers.
Approval: [role] reviews client-facing work before it is sent or published.
Decisions: staff remain accountable; professional and people decisions
must follow our existing review processes.
Incidents: stop the task and report concerns to [role and internal channel].
Records: store approved outputs in [system], with an owner and review date.
Review this policy on: [date], and after a material tool or process change.Five-minute exercise
Use an invented organisation. Fill in the owner, tool, two approved tasks, allowed data, reviewer, and incident contact. Keep the policy short enough for a colleague to read before starting a task.
Then test it against three cases:
- Rewrite a public reception notice.
- Upload a staff medical note to make it shorter.
- Connect a work drive to find an internal procedure.
Under a cautious beginner policy, the notice may be suitable. The medical note is excluded. The drive connection needs separate approval and permission review.
Make the next action clear
A rule such as "use AI responsibly" gives staff too little help. Name the approved account, allowed task, information boundary, and reviewer. Include a clear internal route for reporting a mistake.
The Privacy Commissioner recommends privacy assessment before AI use. Digital.govt.nz also stresses accountability and human oversight. Use those sources when your organisation reviews the starter. Do not treat filling in this template as completion of a privacy impact assessment.