Can Employers Ban Staff From Using AI Tools In NZ?

AI tools can be incredibly useful at work, but they can also make you nervous as an employer. Maybe a staff member has pasted a customer list into a chatbot, or you have no idea which tools your team is using to draft emails, reports or social posts.

The good news is that, in New Zealand, you can usually control or ban staff use of AI tools for company work. The key is to make the rule lawful, reasonable, clearly communicated and consistently applied.

A well-written employee AI use policy can give your team clarity without stopping sensible innovation. It can also protect your confidential information, customer data, intellectual property and brand reputation.

Can Employers Legally Ban Staff From Using AI Tools?

Yes, you can usually ban staff from using AI tools for work, provided the ban is a lawful and reasonable workplace direction.

Under the Employment Relations Act 2000, you and your employees must deal with each other in good faith. As an employer, you can set reasonable rules about how work is done, especially where those rules protect your business, your clients and your systems.

A ban is more likely to be reasonable if it's aimed at genuine business risks, such as:

• protecting confidential information, trade secrets and client data
• meeting your Privacy Act 2020 obligations
• avoiding inaccurate customer advice or misleading claims under the Fair Trading Act 1986
• protecting your copyright, branding and internal materials
• keeping your IT systems secure
• making sure staff don't rely on AI for tasks that need human judgement

For example, if you run an accounting practice, you could reasonably ban staff from entering client financial information into public AI tools. If you run a marketing agency, you might allow AI for brainstorming but ban it for final client copy unless a manager approves it.

A total ban may still be lawful, but it can be harder to manage in practice. Staff may use AI anyway if the rule feels unrealistic or is buried in an old IT policy. For many businesses, a controlled approval system works better than a blanket ban.

Your rule should also fit the role. A strict ban for payroll, HR and client records may make sense, while limited use for internal meeting summaries may be lower risk if you use an approved tool with proper settings.

What Should An Employee AI Use Policy Say?

Your employee AI use policy should say exactly what staff can and can't do with AI tools, and what happens if they ignore the rules.

Try to avoid vague wording like "use AI responsibly" on its own. It sounds sensible, but it doesn't help a busy employee decide whether they can paste a draft contract, customer complaint or spreadsheet into an AI tool.

A practical policy should cover:

• Which AI tools are approved: name the tools staff can use, and who can approve new ones.
• Which tools are banned: for example, free public tools, browser extensions or tools that train on user inputs.
• What information can't be entered: customer personal information, pricing, supplier terms, passwords, source code, payroll data, sensitive health information and confidential documents.
• Permitted uses: brainstorming, summarising non-confidential information, first drafts, internal admin or research support.
• Prohibited uses: making final decisions about staff, giving customer advice, generating legal or financial advice, copying third-party content or creating misleading advertising.
• Human review: require a person to check accuracy, tone, legal risks and brand fit before anything is sent externally.
• Record keeping: say when staff must record that AI was used, especially for client work or regulated tasks.
• Consequences: explain that breaches may lead to disciplinary action, up to and including dismissal for serious misconduct where appropriate.

If you have contractors as well as employees, don't assume your employee policy automatically covers them. Your contractor agreements should include similar AI, confidentiality, privacy and IP obligations. From 2026, the Employment Relations Amendment Act changes also introduced a contractor gateway test for worker status issues, so it's worth checking that your contractor arrangements match how people actually work in your business.

Can Staff Put Confidential Information Into AI Tools?

No, staff shouldn't put confidential business information into AI tools unless you have approved the tool and checked the risks.

This is one of the biggest AI risks for small businesses. Once information is entered into an AI platform, you may lose control over where it's stored, who can access it, whether it's used to train models and how long it is kept.

Confidential information can include more than obvious trade secrets. It may include:

• customer lists and contact details
• supplier pricing and discount structures
• internal financial results and cashflow documents
• unreleased product plans
• staff pay, performance and health information
• client briefs, proposals and strategies
• software code, prompts, datasets and technical documentation

Say you run a Wellington design studio with 12 staff. One designer uses a free AI tool to summarise a 25-page client brand strategy before a meeting. The document includes the client's unreleased product name, launch budget of $80,000 and a list of potential retail partners. Even if nothing goes wrong immediately, you may have breached your confidentiality obligations to the client and damaged trust.

Your contracts with clients and suppliers may also restrict where you can store or process their information. If you let staff use AI tools without checking those contracts, you may accidentally put your business in breach.

A good rule is simple: staff should never enter confidential information into an AI tool unless the tool has been approved for that type of information, and the person entering it has permission.

How Do Privacy Risks Apply To AI In The Workplace?

The Privacy Act 2020 applies when your business collects, uses, stores or discloses personal information, including when staff put that information into AI tools.

Personal information is information about an identifiable person. In a workplace AI context, that could include customer names, email addresses, order histories, complaints, staff records, CVs, performance notes, medical details or rostering information.

If an employee uploads personal information into an AI tool, you need to think about questions like:

• Did your business have a lawful purpose for using that information in this way?
• Would the person reasonably expect their information to be used with an AI tool?
• Is the AI provider storing the information overseas?
• Can the information be deleted if needed?
• Is the information protected against unauthorised access?
• Could the output be inaccurate, biased or unfair?

New Zealand doesn't have a fixed 72-hour breach notification rule like some overseas regimes. Under the Privacy Act 2020, if you have a notifiable privacy breach, you must notify the Privacy Commissioner and affected people as soon as practicable after becoming aware of it.

A notifiable privacy breach is one that has caused, or is likely to cause, serious harm. For example, if a staff member uploads a spreadsheet containing 500 customers' names, phone numbers and health details into an unapproved AI tool, you should act quickly. You would usually want to preserve records, stop any further use, assess whether the information can be removed, consider serious harm, and get help if you're unsure about notification.

Your AI policy should work alongside your privacy policy, information security policy, internal privacy procedures and data breach response plan. If those documents don't mention AI, staff may not know where the line is.

Can You Use A Technology Policy To Control AI Tools?

Yes, an employer technology policy is often the best place to control day-to-day AI use, either as a standalone AI policy or as part of your IT, security and acceptable use rules.

Your policy should be easy to find and easy to follow. If your team uses shared drives, Slack, Microsoft Teams or an HR platform, store the latest version there and tell staff when it changes.

A Simple Approval Process

You can create a clear approval process so staff know how to ask before using a new AI tool. For example:

1. Request: the staff member explains the tool, task and type of information involved.
2. Risk check: you check privacy, confidentiality, security, IP and contract risks.
3. Decision: you approve, reject or approve with limits.
4. Record: you keep a simple AI tools register showing approved tools and conditions.
5. Review: you revisit approvals when the tool's terms, features or your business needs change.

This doesn't have to be complicated. A 10-minute internal form can be enough for a small team, as long as someone is responsible for reviewing requests.

What To Include In An AI Policy Outline

You can use this outline as a starting point, but a legal professional should tailor it before you rely on it in your business:

1. Purpose: explain why the policy exists and which business risks it manages.
2. Who It Applies To: cover employees, contractors, interns and anyone using your systems.
3. Approved AI Tools: list permitted tools and any role-based limits.
4. Banned Uses: spell out tasks or tools that aren't allowed.
5. Confidential Information: define what must not be entered into AI tools.
6. Personal Information: set privacy rules for customer, staff and supplier data.
7. Intellectual Property: cover ownership, copyright checks and use of third-party material.
8. Human Review: require staff to check AI outputs before relying on them.
9. Approvals And Records: set out who approves tools and how usage is recorded.
10. Breaches And Discipline: explain reporting duties and possible consequences.

Templates can be useful for structure, but they often miss the details that matter most, such as your actual tools, customer data, industry risks and employment agreements.

What About IP, Copyright And AI-Generated Work?

AI-generated work can create IP issues, so your policy should make it clear who owns outputs and what checks are needed before you use them.

In New Zealand, copyright is mainly dealt with under the Copyright Act 1994. Copyright can protect original works such as written content, designs, software code, images and marketing materials. AI complicates this because outputs may be based on patterns from training data, may resemble existing works, or may not attract the protection you expect.

From a business perspective, the key risks are practical:

• you may not own what a staff member creates if your employment agreements are unclear
• an AI tool's terms may give the provider broad rights to use inputs or outputs
• AI outputs may accidentally copy or closely imitate another person's work
• staff may use AI-generated images, code or copy without checking licences
• you may promise clients original work when the work was partly generated by AI

If staff create materials for clients, your client contracts should also match your AI policy. For example, you may need to say whether AI can be used, whether you'll disclose AI use, and what warranties you can honestly give about originality.

For trade marks, AI can help brainstorm names, but it can't tell you whether a brand is safe to use in New Zealand. You should still search IPONZ and get tailored advice before investing in a name, logo or product brand.

Your policy can also require staff to keep prompts and drafts for significant work. That record can help if a client asks how something was produced, or if you later need to show that a person made the final creative decisions.

How Should You Introduce An AI Ban Or Policy At Work?

You should introduce an AI ban or policy clearly, give staff a chance to ask questions, and make sure the rule is consistent with employment agreements and existing policies.

A policy that appears overnight with no explanation can feel heavy-handed. You don't need a long consultation process for every policy change, but good faith still matters. If the change affects how people do their jobs, explain the business reasons and listen to practical feedback.

A Practical Rollout Plan

1. Audit current use: ask managers and staff what AI tools are already being used for work.
2. Rank the risks: separate low-risk uses, such as brainstorming internal headings, from high-risk uses, such as customer data or HR decisions.
3. Draft the policy: make the rules specific, plain-English and tailored to your business.
4. Check related documents: update employment agreements, contractor agreements, confidentiality clauses, privacy procedures and client terms if needed.
5. Train your team: run through examples of allowed and banned use.
6. Ask for acknowledgement: have staff confirm they have read and understood the policy.
7. Review regularly: AI tools change quickly, so set a review date rather than leaving the policy untouched for years.

If someone breaches the policy, respond proportionately. A one-off mistake by a junior employee who was never trained is different from a senior manager deliberately uploading confidential client files after being warned not to.

Before taking disciplinary action, follow a fair process under the Employment Relations Act 2000. That usually means raising the concern, sharing relevant information, giving the employee a chance to respond, considering their explanation, and then deciding on an appropriate outcome.

Key Takeaways

• You can usually ban or limit staff use of AI tools in New Zealand if the rule is lawful, reasonable and clearly communicated.
• Your policy should cover confidentiality, privacy, approved tools, banned uses, human review, IP ownership and disciplinary consequences.
• Staff shouldn't put customer data, staff records or confidential business information into public AI tools unless you have approved that use.
• The Privacy Act 2020, Fair Trading Act 1986, Copyright Act 1994 and Employment Relations Act 2000 can all be relevant to workplace AI use.
• A controlled approval process often works better than a blanket ban, especially if your team can use AI safely for low-risk tasks.
• Your employment agreements, contractor agreements, client terms and internal policies should all line up so there are no gaps.

If you'd like help with your workplace AI policy, employment agreements, contractor terms or privacy procedures, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.