Here's a question worth asking around your next team meeting: who here is using AI at work?

In most New Zealand businesses, the honest answer is "more people than the owner realises." Someone's pasting a difficult customer email into ChatGPT to soften the tone. Someone else is running a spreadsheet through Copilot to work out a formula. Your marketing person is generating social posts in Claude.

None of that is necessarily a problem. AI genuinely does save time, and the productivity gains for small businesses are real. But there's a difference between your team using AI and your business having decided how AI gets used — and right now, a lot of Kiwi businesses are firmly in the first camp.

What actually goes wrong

The failures we see aren't dramatic. They're mundane, and they're avoidable.

Confidential information walks out the door. An employee pastes a client list, a draft contract, or a set of payroll figures into a free AI tool to "tidy it up." Depending on the tool and the settings, that information may now sit on an overseas server, and may be used to train the model. Your team member wasn't being reckless — they were being efficient. Nobody had told them not to.

Someone acts on an answer that's wrong. AI tools are fluent, confident, and sometimes flatly incorrect. They're particularly unreliable on New Zealand-specific detail — they'll happily give you Australian tax treatment, or cite a rule that was repealed three years ago. If a staff member relies on that for a client quote, a tax position, or an employment decision, the mistake is yours, not the software's.

Published content causes a problem. AI-generated marketing copy makes a claim about your product that isn't quite true. An AI-drafted job ad screens candidates in a way that creates a discrimination issue. An AI-generated image turns out to be someone else's intellectual property.

In every case, the business carries the consequence. The tool doesn't.

Where New Zealand law sits

This is the bit that surprises people: New Zealand has no AI-specific legislation. No equivalent of the EU's AI Act, and no sign one is coming.

What we have instead is a deliberate "light touch," principles-based approach — the view being that our existing, technology-neutral laws already cover most of the ground. The Government set this out in New Zealand's first AI Strategy, Investing with Confidence, released in July 2025.

The absence of a specific AI law is not the good news it sounds like. It means the existing rules apply in full:

• The Privacy Act 2020. If your AI use touches personal information — customers, staff, suppliers — the Information Privacy Principles apply. That covers how you store and protect it (IPP 5), who you disclose it to (IPP 11), and sending it offshore (IPP 12). Note also the new IPP 3A, in force from 1 May 2026, which requires you to tell people when you've collected their information indirectly rather than from them.
• The Fair Trading Act 1986. Customer-facing chatbots and AI-generated marketing claims are subject to the same misleading-conduct rules as anything else you publish.
• The Copyright Act 1994. Both what goes into an AI tool and what comes out of it.
• The Human Rights Act 1993. Relevant if AI is influencing hiring, or any other decision about a person.
• Your employment obligations. If AI is used in performance management or disciplinary processes, fair process requirements don't relax because software was involved.

The Office of the Privacy Commissioner has made the underlying principle clear: you remain responsible for decisions made using AI tools. Using a machine to reach a conclusion doesn't shift the accountability off your organisation.

Alongside the strategy, MBIE has published Responsible AI Guidance for Businesses. It's voluntary, it's free, and it's written for organisations of every size — including sole traders. If you want a starting point, that's it.

What an AI policy needs to cover

A workable AI policy for a small business is one or two pages. It is not a legal document, and you do not need to spend thousands on it. What it does need to answer, plainly:

1. Which tools are approved? Name them. A short green list is far more useful than a vague "use good judgement."
2. What must never be entered into an AI tool? Be specific and concrete: client financial data, IRD numbers, bank details, payroll information, health information, anything under an NDA, anything you'd be uncomfortable seeing forwarded to a stranger.
3. What must be checked by a human before it leaves the business? The short answer for most businesses is everything. Anything client-facing, anything with numbers in it, anything with legal or tax content.
4. Do we tell customers? If AI is drafting your customer correspondence or running your chatbot, decide your position on disclosure now rather than when a customer asks.
5. Who decides? Name the person who approves a new tool before anyone starts using it.
6. What happens if something goes wrong? Who gets told, and how fast. A privacy breach has notification obligations attached, and those clocks don't wait for you to work out what happened.

Then, and this is the step most businesses skip, actually talk your team through it. A policy sitting unread in a shared drive protects nobody. Ten minutes at a team meeting does more than ten pages of writing.

The honest summary

AI isn't a threat to your business. Not having decided anything about it might be.

The businesses that get into trouble are almost never the ones that thought carefully about AI and chose to use it. They're the ones where nobody made a decision, so twelve people quietly made twelve different ones.

If you'd like a hand thinking through where AI touches your financial information — what's safe to put into a tool and what absolutely isn't — get in touch. It's a short conversation and a good deal cheaper than the alternative.

This article is general information, not legal advice. For privacy, employment, or intellectual property questions specific to your situation, talk to a lawyer.