AI Acceptable Use Policy (New Zealand)
Governing workplace use of artificial intelligence tools
AI ACCEPTABLE USE POLICY
Organisation: [Organisation Name]
Policy Owner: [Policy Owner]
Effective Date: [Effective Date] | Next Review: [Review Date]
1. PURPOSE AND SCOPE
[Organisation Name] recognises that artificial intelligence (AI) tools, large language models, and automated decision-making systems offer significant productivity benefits, but also present risks including privacy breaches, intellectual property issues, accuracy failures, and bias. This policy governs the use of AI tools by all employees, contractors, and agents of [Organisation Name].
This policy is designed to ensure compliance with the Privacy Act 2020, Copyright Act 1994, and the principles of New Zealand's Algorithm Charter. It supplements the organisation's Acceptable Use Policy.
2. APPROVED AND PROHIBITED TOOLS
Approved tools: [Approved Tools]
Prohibited tools and uses: [Prohibited Tools]
3. DATA AND PRIVACY RULES
The following information must NOT be entered into any AI tool:
[Prohibited Inputs]
These restrictions apply to all AI tools, including approved tools, because inputs may be used to train AI models or accessible to third parties.
4. OUTPUT VERIFICATION AND ACCURACY
[Output Verification]
5. INTELLECTUAL PROPERTY
[IP Rules]
6. CONSEQUENCES OF BREACH
[Consequences]
ACKNOWLEDGEMENT
I confirm that I have read, understood, and agree to comply with this AI Acceptable Use Policy.
Name: _________________________ Role: _________________________
Signature: _________________________ Date: _________________________
Policy Approver
________________
Signature
What Is a AI Acceptable Use Policy (New Zealand)?
An AI Acceptable Use Policy in New Zealand sets the organisation's rules and expectations on ai and the responsibilities of staff and users, supporting compliance with the Companies Act 1993.
When Do You Need a AI Acceptable Use Policy (New Zealand)?
A AI Acceptable Use Policy is needed whenever parties in New Zealand wish to formalize their arrangement regarding business operations, corporate governance, and commercial transactions. There are numerous situations in which this document becomes essential for protecting the interests of all involved parties. In a business context, you may need a AI Acceptable Use Policy when entering into new commercial relationships, when formalizing existing arrangements that have previously been informal, when expanding your business operations, or when restructuring existing agreements. Companies registered with Companies Office should confirm proper documentation is maintained for all significant business transactions. You should also consider using a AI Acceptable Use Policy when there has been a change in circumstances that affects an existing arrangement, when you need to comply with new regulatory requirements, when you wish to update outdated documentation, or when professional advisors recommend formalizing certain aspects of your affairs. In New Zealand, maintaining current and accurate legal documentation is considered established standards and can help prevent costly disputes. It is generally advisable to prepare a AI Acceptable Use Policy before any issues arise, rather than trying to document terms after a dispute has already begun. Proactive documentation provides clarity and reduces the potential for misunderstandings. If you are unsure whether you need this document for your specific situation in New Zealand, consulting with a qualified legal professional can provide guidance tailored to your circumstances. The timing of executing a AI Acceptable Use Policy is also important. In New Zealand, certain documents must be executed before specific actions are taken or within prescribed time periods to be effective. Delaying the preparation of necessary legal documents can result in complications, lost rights, or additional costs. Therefore, it is recommended to prepare this document as early as possible once the need has been identified.
What to Include in Your AI Acceptable Use Policy (New Zealand)
A well-drafted AI Acceptable Use Policy for use in New Zealand should contain several essential elements to confirm it is legally effective and provides adequate protection for all parties. Party Identification: The document should clearly identify all parties involved, including their full legal names, addresses, and relevant identification numbers. For individuals in New Zealand, this may include identity card or passport numbers. For companies, registration numbers and registered addresses should be specified. Clear identification prevents disputes about who is bound by the agreement. Recitals and Background: The document should include background information explaining the context and purpose of the arrangement. This helps establish the parties' intentions and can be important in interpreting the terms of the document if any ambiguity arises later. The recitals section provides valuable context for the operative provisions that follow. Operative Terms: The core terms and conditions should be set out clearly and thoroughly. This includes the rights and obligations of each party, any conditions or prerequisites, the duration of the arrangement, and any limitations or restrictions. All key terms should be defined precisely to avoid ambiguity and potential disputes. Payment and Financial Terms: Where applicable, the document should specify any payments, fees, deposits, or other financial considerations. The amounts, currency (NZD), payment schedules, and methods of payment should be clearly stated. Any provisions for late payment, interest charges, or adjustments should also be included. Term and Termination: The document should specify its duration, including the start date, end date or conditions for expiry, and any provisions for renewal or extension. The circumstances under which either party may terminate the arrangement early should be clearly defined, along with any notice requirements and the consequences of termination. Dispute Resolution: The document should include provisions for resolving any disputes that may arise, such as negotiation, mediation, arbitration, or litigation. In New Zealand, parties may choose to specify the jurisdiction of New Zealand courts and the applicable law. Including a clear dispute resolution mechanism can save significant time and expense if disagreements occur. Governing Law and Jurisdiction: The document should specify that it is governed by the laws of New Zealand and that disputes shall be subject to the jurisdiction of New Zealand courts. This is particularly important in cross-border transactions or where parties are based in different jurisdictions. Signatures and Execution: The document must be properly signed by all parties or their authorised representatives. In New Zealand, certain documents may need to be witnessed, notarised, or executed as deeds to be legally effective. The date of execution should be clearly recorded, and each party should retain an original signed copy for their records. The forms-legal.com AI Acceptable Use Policy (New Zealand) provides a ready-to-use template that meets New Zealand legal requirements.
Cite this page
Reference this free template in an article, syllabus, or research note:
Forms Legal. (2026). AI Acceptable Use Policy (New Zealand) (New Zealand) [Legal document template]. Forms Legal. https://forms-legal.com/new-zealand/business/policies/ai-acceptable-use-policy-new-zealand
"AI Acceptable Use Policy (New Zealand) (New Zealand)." Forms Legal, 2026, https://forms-legal.com/new-zealand/business/policies/ai-acceptable-use-policy-new-zealand.
@misc{formslegal-ai-acceptable-use-policy-new-zealand,
author = {{Forms Legal}},
title = {AI Acceptable Use Policy (New Zealand) (New Zealand)},
year = {2026},
howpublished = {\url{https://forms-legal.com/new-zealand/business/policies/ai-acceptable-use-policy-new-zealand}},
note = {Free legal document template. Based on Companies Act 1993}
}
Frequently Asked Questions
New Zealand does not yet have specific AI legislation (as of 2025–2026), but several existing laws apply to workplace AI use. The Privacy Act 2020 applies to any AI tool that processes personal information — organisations must require that inputting personal data into AI tools complies with the Information Privacy Principles, particularly IPP 1 (collection for a lawful purpose), IPP 5 (data security), and IPP 10–11 (use and disclosure of information). The Copyright Act 1994 raises questions about AI-generated content ownership and whether using copyrighted material to train or prompt AI systems constitutes infringement. The Employment Relations Act 2000 and Human Rights Act 1993 are relevant where AI is used in employment decisions — algorithmic bias could expose employers to discrimination claims. The Evidence Act 2006 may affect the admissibility of AI-generated content in legal proceedings. The Commerce Commission's Fair Trading Act 1986 enforcement may apply where AI is used to create misleading content or advertising. New Zealand's Algorithm Charter (published by Stats NZ and adopted by various government agencies) establishes principles for transparent and accountable use of algorithms and AI in public sector contexts, which provide useful guidance for private sector AI governance too.
Whether employees can use AI tools like ChatGPT at work depends on the employer's AI policy. Without an explicit policy, employees may use AI tools in ways that create legal and reputational risks for their employer. Key risks include: privacy breaches — if employees input personal data about clients, colleagues, or other individuals into AI tools, this may breach the Privacy Act 2020 if the information is transmitted to third-party servers without appropriate consent or safeguards; confidentiality breaches — inputting confidential business information (trade secrets, client data, financial information) into public AI tools may expose that information to the AI provider's systems and potentially to third parties; intellectual property issues — AI-generated content may raise copyright questions under the Copyright Act 1994; accuracy risks — AI tools can produce incorrect or misleading information, and relying on unverified AI outputs can cause professional and legal harm; and reputational risks — publishing AI-generated content without review can damage organisational reputation. An AI Acceptable Use Policy should clearly state which AI tools are approved for which purposes, what information can and cannot be inputted, how AI outputs must be verified, and the consequences of misuse.
Ownership of AI-generated content in New Zealand is an emerging legal question. Under the Copyright Act 1994, copyright subsists in original works that are the result of human skill and effort. For computer-generated works (works generated by a computer without a human author), section 5(2) of the Copyright Act 1994 provides that the author is the person who made the necessary arrangements for the creation of the work. This suggests that the person who prompted or directed the AI tool to create content — the human user — may be treated as the author for copyright purposes in New Zealand, and if they created the content in the course of their employment, the employer would own the copyright. However, this analysis is uncertain and untested in New Zealand courts for modern generative AI. The AI tool provider's terms of service also affect ownership — some AI providers (such as OpenAI) grant users rights over AI-generated outputs, while retaining rights to use inputs for model training. New Zealand organisations should address AI content ownership in their AI Acceptable Use Policy and monitor developments in New Zealand and international intellectual property law in this area.
New Zealand's Algorithm Charter is a voluntary framework developed by Stats NZ (Statistics New Zealand) in 2020 for government agencies that use algorithms and AI in decision-making. Agencies that sign the charter commit to a set of principles for transparent, accountable, and fair algorithmic use, including: being transparent about when and how algorithms are used; embedding privacy and ethics in algorithm design; having a human in the loop for significant decisions; and managing the risks of bias. As of 2025–2026, the Algorithm Charter applies to government agencies that have adopted it — it is not legally binding on private businesses. However, the principles of the Charter provide a useful governance framework for private sector organisations that wish to use AI responsibly. New Zealand's Office of the Privacy Commissioner has also published guidance on automated decision-making and AI from a privacy law perspective, which is directly relevant to private businesses. The New Zealand government has signalled its intention to develop more thorough AI governance frameworks, potentially including legislation, in line with international developments such as the EU AI Act. Private businesses should monitor these developments and ensure their AI policies are adaptable.
A AI Acceptable Use Policy (New Zealand) does not legally require a lawyer in New Zealand, and individuals and businesses may draft and execute the document independently. The Companies Act 1993 does not mandate legal representation for the creation or signing of this type of document. However, seeking independent legal advice from a qualified New Zealand lawyer is recommended for transactions involving substantial financial value, complex regulatory requirements, or cross-border elements where multiple legal jurisdictions may apply. A lawyer can verify that the document complies with all applicable statutory requirements, identify potential risks specific to the transaction, and confirm that the terms adequately protect the interests of all parties involved. The High Court of New Zealand has jurisdiction over disputes arising from this type of document, and Companies Office may impose additional compliance obligations depending on the nature of the underlying transaction. Professional legal review is particularly advisable where the document will be submitted to government agencies or used as evidence in legal proceedings.
This template is provided for informational purposes only and does not constitute legal advice. Laws vary by jurisdiction and change over time. Consult a qualified attorney for advice specific to your situation.Full disclaimer
Found an error? Let us knowRelated Documents
You may also find these documents useful:
Acceptable Use Policy (New Zealand)
A New Zealand Acceptable Use Policy (AUP) for businesses and organisations governing the use of IT systems, networks, internet, email, and digital resources by employees and users. Compliant with the Privacy Act 2020, Harmful Digital Communications Act 2015, Crimes Act 1961 (computer-related offences), and Health and Safety at Work Act 2015. Covers internet use, social media, email, data handling, and security.
Data Collection Consent Form (New Zealand)
Create a New Zealand Data Collection Consent Form compliant with the Privacy Act 2020 and the 13 Information Privacy Principles. Covers the purpose of collection, types of personal information, how it will be used and stored, rights of access and correction, and voluntary consent.
Cookie Policy (New Zealand)
Create a compliant Cookie Policy for your New Zealand website, drafted in accordance with the Privacy Act 2020 (NZ) and the 13 Information Privacy Principles (IPPs). Unlike the EU's GDPR cookie rules, New Zealand does not have a specific cookie consent law, but cookies that collect personal information are regulated by the Privacy Act 2020. Our template covers essential cookies, analytics cookies (Google Analytics, Matomo), functionality cookies, marketing and advertising cookies (Google Ads, Meta Pixel), cookie consent mechanisms, browser controls, and users' rights under IPP 6 and IPP 7. Includes mandatory breach notification obligations and Privacy Commissioner complaint process.
Cybersecurity Incident Response Plan (New Zealand)
A New Zealand Cybersecurity Incident Response Plan (IRP) for organisations to prepare for, detect, contain, and recover from cybersecurity incidents. Compliant with the Privacy Act 2020 mandatory breach notification requirements, CERT NZ guidelines, and the National Cyber Security Centre (NCSC) framework. Covers ransomware, data breaches, phishing, and system compromise scenarios.