AI Chatbot Terms of Use in New Zealand

AI chatbot founders often launch with ordinary SaaS terms, then discover they do not deal with the biggest risks of an AI product: inaccurate outputs, user prompts containing confidential material, training data permissions and customers treating generated content as final advice.

Common mistakes include promising more accuracy than the model can deliver, staying silent on whether user content can be used to improve the system, and using a vague chatbot disclaimer that does not match how the product is actually sold. Those gaps can create issues under contract law, the Fair Trading Act 1986, the Consumer Guarantees Act 1993 and the Privacy Act 2020.

Well-drafted AI SaaS terms and conditions help customers understand what the tool can and cannot do, while giving your business clear rights to operate, improve and protect the platform. The goal is to set practical rules before users start relying on the chatbot in real business situations.

What AI Chatbot Terms Need To Cover

AI chatbot terms of use should explain the product, allocate risk for generated outputs, control user content, set data rules and define unacceptable uses. A generic software terms template rarely goes far enough for an AI tool because model behaviour can be probabilistic, context dependent and affected by user prompts.

For a founder, the starting point is to map the actual customer journey. A free public chatbot, a paid B2B workflow assistant and an enterprise API all need different terms of use. The more your tool affects business decisions, regulated industries or customer facing communications, the more precise your terms need to be.

Your AI startup legal terms should usually deal with:

• Access rights: who can use the chatbot, whether accounts are individual or team based, and whether customers can integrate it into their own products.
• Output limitations: how the chatbot generates responses, why outputs may be incomplete or inaccurate, and what customers must verify themselves.
• User content: what users can upload or type into the system, who owns it, and what licence your business needs to process it.
• Training and improvement: whether prompts, files, feedback or outputs may be used to train, fine tune or improve models.
• Privacy: how personal information is collected, used, stored, disclosed and protected under the Privacy Act 2020.
• Acceptable use: prohibited prompts, misuse, scraping, reverse engineering, illegal content and high risk reliance.
• Customer responsibilities: human review, lawful use, user permissions, backup obligations and compliance with industry rules.
• Commercial terms:subscription terms, usage limits, trials, refunds, suspension, cancellation and payment obligations.
• Liability settings: exclusions, liability caps and limits that are realistic under New Zealand consumer and fair trading laws.

A practical set of terms also needs to match your website, onboarding screens, pricing page and sales decks. If your marketing says the chatbot gives reliable legal, financial, medical or compliance answers, a buried clause saying it is only a general assistant may not protect you. The Fair Trading Act 1986 prohibits misleading or deceptive conduct in trade, so your legal terms cannot fix overconfident product claims.

For B2B customers, business terms and conditions often form part of a wider contracting stack. You might have online terms for self serve users, a signed order form for larger customers, a privacy policy for data practices, a data processing schedule for enterprise accounts and an API use policy for developers. The priority clause should say which document prevails if there is a conflict.

Choose The Right Contract Format

Self serve AI products usually use clickwrap terms, where the customer actively agrees by ticking a box or clicking an acceptance button. This is stronger than simply placing terms in a footer and hoping users have seen them.

If you sell to New Zealand SMEs through sales calls, keep the signed order form short but clear. It should identify the customer, plan, fees, usage limits, support level and any special data settings. The online AI SaaS terms and conditions can then do the heavier lifting for general rules.

Enterprise customers may ask for negotiated security, privacy and IP terms. If you accept changes for one customer, make sure your operations team can actually comply with them. For example, do not promise no training on customer data if your engineering workflow sends all prompts into a shared improvement pipeline.

Managing Output Accuracy And User Reliance

Your terms should tell users that AI outputs can be wrong, incomplete, biased or unsuitable for their particular purpose, and that users remain responsible for reviewing and applying them. This is one of the central contract issues for any AI chatbot business.

AI systems can produce confident sounding errors, sometimes called hallucinations. They may summarise outdated material, infer facts that are not present, misread user instructions or generate output that looks polished but is commercially risky. A good chatbot disclaimer in NZ should be specific to your use case rather than a one line warning that says the tool may be inaccurate.

For example, a customer support chatbot might misstate a refund policy. A recruitment screening assistant might suggest criteria that create discrimination risk. A coding assistant might produce insecure code. A research assistant might cite non-existent sources. Your terms should make clear which risks sit with the customer and which commitments your business is actually prepared to make.

Useful output and reliance clauses often cover:

• No guarantee of accuracy: outputs are generated by AI and may not be accurate, current, complete or suitable.
• Human review: users must review outputs before using them for business, customer, compliance or operational decisions.
• No professional advice: the chatbot does not replace advice from qualified professionals where the subject matter requires it.
• No sole reliance: customers should not rely solely on outputs for high impact decisions affecting legal rights, finances, employment, health, safety or access to essential services.
• Customer configuration: customers are responsible for prompts, data inputs, settings, workflows and integration decisions.
• Record keeping: customers should keep their own records and evidence rather than treating the chatbot as the sole source of truth.

The wording should match the product category. If your chatbot is marketed as an internal brainstorming tool, you can usually use stronger limitations on reliance. If it is sold as a compliance assistant or automated customer advice tool, customers will expect a higher level of performance, and your warranties, service levels and testing statements need tighter drafting.

Be Careful With Accuracy Claims

Accuracy claims create legal and customer trust issues when they are too broad. If your website says the tool is 99 percent accurate, always up to date or compliant with New Zealand law, you should have evidence to support that claim and terms that define what it means.

A safer approach is to describe the product's actual function. For instance, you might say it assists users to draft responses, identify possible issues or summarise supplied content. That is different from saying it verifies compliance, guarantees correct decisions or removes the need for human review.

The Consumer Guarantees Act 1993 can apply when services are supplied to consumers. For business customers, suppliers can sometimes contract out of certain Consumer Guarantees Act obligations where both parties are in trade and the contracting out is fair and reasonable. That drafting needs care, particularly where you sell to sole traders, mixed use customers or small organisations through standard terms.

New Zealand's unfair contract terms rules can also affect standard form consumer contracts and small trade contracts. Very one sided exclusions may be vulnerable if they go further than reasonably necessary to protect your legitimate business interests. A liability cap is usually more defensible when it is clear, proportionate and paired with sensible carve outs.

Use Examples To Set The Boundary

Short examples in your terms or onboarding screens can reduce misunderstanding. If users know what the chatbot should not be used for, they are less likely to stretch the product into risky use cases.

For example, a sales coaching chatbot might say it can help generate draft call scripts and training scenarios, but users must review all outputs and must not use it to make automated hiring, disciplinary or termination decisions. A finance admin chatbot might help categorise invoices, but not provide tax advice or make final payment approvals. This type of practical boundary can be more effective than legal wording alone.

User Content, Training Data And IP Permissions

Your terms should clearly state who owns user inputs and outputs, what licence your business receives, and whether customer content can be used for model training or product improvement. This is where many AI tools lose customer confidence if the wording is vague.

User content may include prompts, uploaded files, knowledge base documents, customer data, chat history, feedback, images, audio, code and other material submitted through the platform. You generally need a licence to host, copy, process, transmit, modify and display that content so the chatbot can operate. Without that licence, ordinary platform functions can become contractually uncertain.

The licence should be limited to what your product actually needs. Customers are more likely to accept terms that say you can use their content to provide, secure, support and improve the service than terms that suggest you can commercialise their confidential material without restriction.

Training data clauses need special attention. Founders should decide whether the platform will:

• use customer prompts and files to train or fine tune models by default;
• use de-identified or aggregated usage data only;
• allow customers to opt out of training uses;
• keep enterprise customer data completely separate from model training; or
• use feedback signals without storing original confidential content.

Once you choose a position, your product settings, privacy policy and sales promises need to align. If an enterprise customer pays for a private workspace, your terms should not quietly reserve a broad right to train a shared model on its confidential material.

Ownership Of Outputs

Output ownership is not always straightforward. New Zealand copyright law recognises computer-generated literary, dramatic, musical and artistic works. For those works, the Copyright Act 1994 treats the author as the person who undertook the arrangements necessary for the creation of the work. However, applying those rules to modern generative AI outputs can still raise difficult questions about originality, authorship, ownership and the role of prompts, training data, model providers and platform settings. Instead of overpromising that every output is fully owned and enforceable, your terms can give customers contractual rights to use outputs, subject to their compliance with the terms and any third-party restrictions.

For commercial confidence, many AI businesses tell customers they may use outputs for their internal business purposes or, for paid plans, for commercial purposes. The terms should still reserve your ownership of the platform, models, software, algorithms, prompts, templates, documentation, branding and underlying technology.

You should also address similarity. AI tools can generate similar or identical outputs for different users, especially where prompts are common. Your terms can state that customers do not receive exclusive rights in outputs and that other users may receive similar content. This reduces disputes where two customers receive near identical email templates, code snippets or product descriptions.

Customer Warranties For Inputs

Your users should promise that they have the right to upload and use the content they submit. This matters if a user pastes confidential client files, employee information, third-party copyrighted material, scraped data or personal information into the chatbot.

Customer warranties commonly cover that inputs do not infringe intellectual property rights, breach confidentiality obligations, breach privacy law, contain unlawful material or violate another person's rights. For B2B products, you may also require the customer to ensure its staff and contractors follow the terms when using company accounts.

If your chatbot lets customers upload brand assets, datasets or internal documents, include a takedown or suspension process. Your team needs the right to remove content, block prompts or suspend accounts where there is a credible rights, security or compliance concern.

Privacy, Security And Acceptable Use Rules

AI chatbot terms should work together with a privacy policy and acceptable use rules so users know what data can be entered, how it will be handled and which activities are banned. For New Zealand businesses, the Privacy Act 2020 is a key part of that framework whenever personal information is involved.

Personal information can appear in prompts, uploaded files, chat logs, support tickets, account profiles, usage analytics and integrations with other tools. If your chatbot processes names, contact details, customer records, employee information, health details or other identifiable information, you need clear privacy settings and plain English disclosures.

Your privacy documentation should explain matters such as:

• what personal information you collect through the chatbot and related services;
• why you collect it and how it is used;
• whether it is shared with model providers, cloud hosts, analytics tools, support platforms or other service providers;
• whether information may be stored or processed outside New Zealand;
• how users can request access to or correction of their personal information;
• how long data is kept, where that can be described sensibly; and
• how privacy complaints can be raised.

If you use overseas infrastructure or third-party model providers, make sure your customer terms do not imply everything stays in New Zealand unless that is true. The Privacy Act 2020 includes rules for disclosing personal information overseas, so your data flows and vendor contracts should be checked before you make firm promises.

Security Commitments Should Be Realistic

Security clauses should describe your commitments without creating impossible guarantees. Customers may expect encryption, access controls, monitoring, incident response processes, backups and staff confidentiality obligations. Enterprise buyers may ask for security questionnaires, audit reports or data processing terms.

Avoid saying the platform is completely secure or immune from unauthorised access. A more realistic position is to commit to reasonable technical and organisational measures appropriate to the nature of the service and the information processed. If you offer different security levels by plan, the terms should allow that distinction.

Data breach wording should also match your internal process. Under the Privacy Act 2020, notifiable privacy breaches may need to be reported to the Office of the Privacy Commissioner and affected individuals where the legal threshold is met. Your contracts should support prompt investigation and communication if a serious incident occurs.

Acceptable Use For AI Tools

Acceptable use rules are the operational controls that stop customers using the chatbot in ways that create legal, safety, platform or reputational risk. They should be more detailed than ordinary SaaS rules because AI tools can be used to generate content, automate decisions and scale harmful activity.

Your prohibited uses might include:

• using the chatbot for unlawful, fraudulent, misleading, harmful or abusive purposes;
• generating malware, phishing content, spam, scams or instructions to evade security controls;
• uploading content that the user has no right to use, including confidential third-party material;
• using outputs to make high impact decisions without human review, such as employment, credit, insurance, housing, education or health decisions;
• creating deceptive content that impersonates people or organisations without permission;
• attempting to reverse engineer, extract model weights, scrape the service or bypass usage limits;
• overloading the service, reselling access without permission or using the platform to build a competing model where prohibited; and
• using the chatbot in a way that breaches privacy, consumer, advertising, employment or industry specific laws.

These rules are more useful when paired with enforcement rights. Your terms should allow you to suspend accounts, remove content, throttle usage, investigate suspected misuse and terminate access where needed. For paid customers, you can decide whether serious misuse results in no refund, subject to applicable law and the wording of your plan terms.

Consumer-Facing Chatbots Need Extra Care

If your customers deploy your chatbot to talk to their own customers, your terms should allocate responsibility for those end user interactions. For example, a retailer using your chatbot on its website should remain responsible for its product claims, refund representations and customer service commitments under the Fair Trading Act 1986 and Consumer Guarantees Act 1993.

Your customer terms can require the business customer to review and approve chatbot scripts, knowledge base materials and escalation rules. They can also require the customer to provide accurate source content, monitor interactions and correct errors promptly. This is especially relevant where the chatbot discusses prices, availability, warranties, delivery times or service eligibility.

For sensitive sectors such as health, finance, employment and education, acceptable use wording should be paired with onboarding questions. If your product is not built for regulated advice or high impact decisions, say so clearly and configure the platform to discourage that use.

FAQs

Do AI Chatbot Terms Need A Separate Disclaimer?

Most AI chatbot businesses should include a specific output and reliance disclaimer inside their terms, with supporting notices in the product where users see generated answers. A separate page called a disclaimer is less useful if customers do not accept it or if it conflicts with your main terms.

Can We Use Customer Prompts To Train Our Model?

You can only do this safely if your terms, privacy policy, product settings and customer promises allow it. If prompts may contain personal information, confidential material or third-party content, you need clear permissions, privacy compliance and a careful position on opt outs or enterprise exclusions.

Who Owns AI-Generated Outputs In New Zealand?

New Zealand copyright law includes rules for computer-generated works, including a rule that treats the author as the person who undertook the arrangements necessary for the creation of the work. However, applying those rules to generative AI outputs can be fact specific and uncertain, especially where outputs are shaped by user prompts, model behaviour and third-party systems. Many AI businesses deal with this by giving customers contractual rights to use outputs while making clear that the platform, models and underlying technology remain owned by the provider.

What Laws Should AI Chatbot Founders Think About?

Common New Zealand issues include the Fair Trading Act 1986 for marketing claims, the Consumer Guarantees Act 1993 for service guarantees, the Privacy Act 2020 for personal information, copyright and trade mark laws for content and branding, and standard contract rules for subscriptions and liability.

Are Free AI Chatbots Lower Risk Than Paid Ones?

Not necessarily. Free tools can still collect personal information, generate harmful outputs, mislead users or expose your business to IP and confidentiality issues. Free plans should still have clear software terms of use for AI functionality, especially if users can upload files or rely on outputs.

Key Takeaways

• AI chatbot terms of use in New Zealand should deal directly with inaccurate outputs, hallucinations, reliance limits and human review obligations.
• Training data permissions need clear drafting, especially where prompts, files or chat histories may contain personal information or confidential business material.
• Your IP clauses should separate customer inputs, contractual rights to use outputs, and your ownership of the platform, models, prompts, software and branding.
• Acceptable use rules should ban high risk misuse such as unlawful content generation, automated high impact decisions, scraping, reverse engineering and security abuse.
• Your terms, privacy policy, onboarding screens and marketing claims must tell the same story, particularly under the Fair Trading Act 1986 and Privacy Act 2020.

If you are building or launching an AI chatbot, Sprintlaw can help with your customer terms, output disclaimer, privacy policy and data use clauses. Contact us on 0800 002 184 or at team@sprintlaw.co.nz for a free, no-obligations chat.