Can You Use AI To Write Customer Emails In NZ?

Can you use AI to write customer emails in NZ? Yes, you can - and for many businesses, it can be a genuinely useful way to save time on marketing emails, support replies and follow-ups.

The catch is that AI doesn't remove your legal responsibilities. If an AI tool uses customer data, gets a claim wrong or sends a misleading message, your business can still be responsible for what goes out.

This doesn't have to be complicated. With a few clear rules around privacy, consent, confidentiality and human review, you can use AI in a way that helps your business without creating avoidable risk.

Can You Use AI To Write Customer Emails In NZ?

Yes, you can use AI to write customer emails in New Zealand, as long as you manage privacy, marketing consent, accuracy and confidentiality properly.

AI can be used for tasks like:

• drafting responses to common customer questions
• rewriting support emails in a warmer tone
• creating first drafts of newsletters or product updates
• summarising customer feedback before you reply
• personalising emails based on broad customer groups, such as past purchasers or loyalty members

The legal risk usually isn't the act of using AI itself. The risk comes from what you put into the tool, what the tool does with that information, and what you send to customers afterwards.

For example, the Privacy Act 2020 can apply if you enter personal information into an AI platform. The Fair Trading Act 1986 can apply if the AI-drafted email makes claims about pricing, performance, availability or results. The Unsolicited Electronic Messages Act 2007 can apply if you're sending marketing emails.

So, a sensible way to think about it's this: AI can help you draft, but your business still needs to approve the message, protect the data and stand behind the claims.

What Customer Data Can You Put Into AI Tools?

It depends on the type of data, what your privacy notices say, and what the AI supplier is allowed to do with the information.

Customer data can include more than just names and email addresses. It might also include order history, delivery addresses, complaint details, support tickets, account notes, booking information, health details, payment information or anything else that can identify a person.

Under the Privacy Act 2020, you need to collect and use personal information for a lawful purpose, be transparent about how you use it, and take reasonable steps to keep it secure. If you disclose customer information to an AI provider, that can count as sharing personal information with a third party.

Before pasting customer details into an AI tool, ask yourself:

• Do I actually need to include identifiable customer information?
• Could I remove names, emails, phone numbers and addresses first?
• Does our privacy policy tell customers we use service providers or digital tools to manage communications, including AI tools?
• Will the AI provider use our prompts or outputs to train its model?
• Can staff access past prompts that include customer information?
• Is the information sensitive, confidential or commercially valuable?

Say Mia runs a Wellington online homewares store with 2,000 newsletter subscribers. She wants AI to help write a win-back email for customers who spent more than $200 last year but haven't ordered in 6 months. Mia doesn't need to upload names, email addresses or full purchase records. She can ask the AI tool to draft an email for a group described in general terms, then apply that draft in her email marketing platform.

That approach gives Mia the benefit of AI without unnecessarily disclosing customer data. It also makes it easier to explain her data handling if a customer asks how their information is being used.

Do You Need Customer Consent Before Using AI For Emails?

Not always, but you may need consent or clearer notice depending on how you're using customer information and what kind of email you're sending.

If you're using AI to draft a support reply and you don't put identifiable customer information into the AI tool, specific AI consent is less likely to be needed. Your usual customer service processes may be enough, provided your privacy practices are clear and lawful.

If you're using customer data to personalise marketing, segment audiences or feed prompts into a third-party AI platform, you should check your privacy policy and collection notices. Customers shouldn't be surprised by how their information is being used.

For marketing emails, you also need to think about the Unsolicited Electronic Messages Act 2007. Commercial electronic messages generally need marketing consent, and that consent can be express, inferred or deemed in limited cases. Your marketing emails also need to clearly identify your business and include a functional unsubscribe facility.

In practice, your unsubscribe process should be easy to use, remain functional for at least 30 days after the message is sent, and unsubscribe requests must be actioned within 5 working days.

You should be especially careful if AI is being used for:

• sensitive customer information, such as health, disability, financial hardship or complaints
• unexpected profiling, such as predicting what a customer can afford
• new uses of customer information that weren't explained when you collected it
• automated decisions that affect what a customer receives, pays or is offered

If the use would feel surprising from the customer's point of view, it's usually a sign you should pause and get tailored advice before rolling it out.

Could AI Customer Emails Breach The Fair Trading Act?

Yes, an AI-written customer email can breach the Fair Trading Act 1986 if it's misleading or deceptive, even if the mistake came from the AI tool.

This is one of the biggest practical risks with AI-generated marketing. AI tools can sound very confident, even when they invent details or overstate what your product can do. If that draft goes out under your business name, customers will read it as your promise.

Common problem areas include:

• claiming a product is available when stock is limited or sold out
• describing a discount in a way that doesn't match the real price
• making environmental claims that can't be backed up
• promising delivery timeframes you can't meet
• claiming a service will achieve a particular result
• using testimonials or reviews in a way that misleads customers
• suggesting customers have fewer rights than they do under the Consumer Guarantees Act 1993

For example, Ravi runs a subscription coffee business in Christchurch. He asks an AI tool to write a promotional email for a new compostable coffee pod range. The draft says the pods are 100% home compostable and that orders are delivered within 24 hours NZ-wide.

In reality, the packaging is only partly home compostable, and standard delivery is usually 2 to 4 business days. If Ravi sends that email without checking it, customers could be misled about both the product and delivery. The safer approach is to change the email to match what Ravi can prove, such as explaining which parts of the packaging are compostable and stating the real delivery estimate.

The rule of thumb is simple: if you wouldn't be comfortable proving the claim to a regulator or customer, don't let AI put it in your email.

How Should You Check AI Emails Before Sending?

You should treat AI emails as first drafts, not final approvals.

A human review process doesn't need to be heavy, but it should be consistent. This is especially true if more than one person in your team sends customer emails or uses the same AI account.

Before sending an AI-drafted email, check:

• Accuracy: Are the product details, dates, prices, discounts and delivery times correct?
• Legal claims: Does the email make promises about results, guarantees, refunds or customer rights?
• Privacy: Did you put customer personal information into the AI tool, and was that necessary?
• Consent: If it's marketing, do you have permission to send it and a working unsubscribe process?
• Confidentiality: Does the email reveal internal pricing, supplier details or another customer's information?
• Tone: Does it sound like your business, and is it appropriate for the customer situation?
• Evidence: Can you back up any claims with records, product specs, testing, stock data or internal policies?

It also helps to keep a simple record, or information security policy, explaining how your business uses AI. For example, you might record which tools are approved, what types of data can be entered, who can approve marketing emails, and what checks are needed before sending.

If something has already gone wrong, act in order. Stop the email campaign if you can, save copies of the prompt, output and final email, work out who received it, correct the message if needed, and check whether any privacy notification is required. Under the Privacy Act 2020, notifiable privacy breaches need to be reported to the Privacy Commissioner and affected people as soon as practicable if the breach has caused, or is likely to cause, serious harm.

When Do You Need An AI Policy Or Supplier Review?

You need an AI policy or supplier review when AI use becomes regular, involves customer data, or affects the promises your business makes to customers.

If you're only using AI occasionally to rewrite a generic email with no customer information, a short internal rule might be enough. But once your team starts using AI across sales, marketing or support, you should set clearer boundaries.

An AI policy can help your team know:

• which AI tools are approved
• what information must never be entered into AI tools
• who reviews marketing or customer support outputs
• how prompts and outputs should be stored
• what to do if the AI tool produces something inaccurate or risky
• when a manager or legal team needs to be involved

A supplier review is about checking the AI provider's terms before you trust it with business or customer information. You should look at whether the provider can use your prompts and outputs to train its model, where data is stored, who can access it, how long it is kept, what happens if you close the account, and whether the provider gives any meaningful confidentiality or security commitments.

You should also think about privilege and confidentiality. Communications with AI tools are unlikely to be protected by legal professional privilege, and they may be stored or reviewed depending on the provider's terms. Don't paste legal advice, dispute details, employee issues, trade secrets or sensitive customer information into an AI tool unless you've checked the risks first.

If you're an agency writing emails for clients, your customer contracts should also cover AI use. Your clients may want to know whether AI is used, who owns the output, who checks accuracy, what data you need from them, and what happens if they approve a campaign containing incorrect claims.

AI Policy Template: What Should You Include?

Your AI policy should tell your team what they can use AI for, what they can't use it for, and who signs off customer-facing content.

A template can be a helpful starting point, but it shouldn't be treated as a finished legal document. A lawyer or legal team should tailor it to your business, your tools, your customer data and your risk level before you use it.

A practical AI policy outline could include:

1. Purpose: Explain why your business uses AI and what the policy is meant to protect.
2. Approved Tools: List the AI platforms staff can use and who can approve new ones.
3. Allowed Uses: Set out safe uses, such as drafting generic emails, brainstorming subject lines or summarising non-sensitive feedback.
4. Prohibited Uses: Ban uses like uploading passwords, payment details, sensitive customer data, confidential supplier terms or legal advice.
5. Customer Data Rules: Explain when personal information can be used, when it must be removed, and when approval is needed.
6. Human Review: State who must check AI outputs before they go to customers, especially for marketing claims.
7. Marketing And Consent: Remind staff to check email consent, sender details and unsubscribe requirements.
8. Fair Trading Checks: Require staff to verify prices, discounts, delivery claims, product features and results claims.
9. Records: Explain what prompts, outputs or approvals should be kept for higher-risk campaigns.
10. Incidents: Set out what staff should do if customer data is uploaded by mistake or an incorrect email is sent.

If your business uses AI heavily, you may also need to update your privacy policy, customer terms, supplier contracts, employment policies or contractor agreements. These documents work best when they match how your business actually operates, rather than sitting separately from your day-to-day processes.

Key Takeaways

• You can use AI to write customer emails in NZ, but your business is still responsible for privacy, consent and accuracy.
• Don't paste customer data into AI tools unless you understand how the tool stores, uses and shares that information.
• Marketing emails still need proper consent, clear sender details and an unsubscribe process under the Unsolicited Electronic Messages Act 2007.
• AI-generated claims can create Fair Trading Act risk if they overpromise on price, delivery, product features or results.
• An AI policy and supplier review are useful once your team uses AI regularly or handles customer information.
• Templates can help you get started, but your AI policy, privacy wording and customer terms should be tailored to your business.

If you'd like help with your AI use policy, privacy compliance, customer email processes or AI supplier terms, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.