Can Employers Ban Staff From Using ChatGPT?

Yes, you can usually ban staff from using ChatGPT and other AI tools at work. As an employer in New Zealand, you can set reasonable rules about how work is done, especially where confidentiality, privacy, client information or quality control is involved.

But a blanket ban isn't always the best answer. AI can be useful for drafting, research, summaries and admin, so many businesses are choosing controlled use instead of a total ban.

The real goal is to make your expectations clear. If your team doesn't know what they can put into an AI tool, what they need to check, or who can approve new tools, you can end up with privacy gaps, confidential information leaks and work that hasn't been properly reviewed.

Can Employers Ban ChatGPT At Work In New Zealand?

Yes, you can generally ban ChatGPT at work if the rule is reasonable, clearly communicated and connected to your business needs.

Under the Employment Relations Act 2000, you can give employees lawful and reasonable instructions about their work. A rule that staff can't use public AI tools for customer data, client documents, financial information or confidential business material will usually be easy to justify.

A total ban may also make sense if your business handles sensitive information. For example, you might run a health clinic, payroll business, professional services firm, recruitment agency or software company with confidential source code. In those settings, a loose approach to AI can create real risk.

That said, the way you introduce the rule matters. If AI use has already become common in your workplace, you should be careful about suddenly disciplining staff for using tools you haven't previously addressed.

A practical approach is to:

• tell staff which AI tools are banned, restricted or approved
• explain the business reasons for the rule
• update your staff handbook, acceptable use policy or workplace policies
• train managers so the rule is applied consistently
• give staff a clear person to ask if they're unsure

If the policy affects an existing employment agreement, role expectations or how a team does its work, you may need to consult with staff before making the change. You can't use an AI policy to quietly change core employment terms.

When Is A Ban Reasonable?

A ban is most likely to be reasonable when it's aimed at protecting confidentiality, privacy, intellectual property, safety, legal compliance or the quality of your work.

You don't need to prove that something has already gone wrong. It's enough to identify a sensible business risk and create a proportionate rule around it.

Examples Of Reasonable AI Restrictions

You might decide staff can't use AI tools to:

• upload customer lists, employee records, invoices, contracts or client files
• generate legal, medical, financial or technical advice for customers without approval
• write final customer communications without human review
• summarise meeting notes that contain confidential business plans
• translate sensitive documents using unapproved tools
• create marketing claims that haven't been checked for accuracy

You might also allow AI for lower-risk tasks, such as brainstorming blog ideas, rewriting internal notes, summarising public information or drafting non-confidential admin emails.

What matters is that your rule matches the risk. A blanket ban on every AI tool may be sensible in some workplaces, but it can be hard to enforce if staff are already using AI for harmless tasks. On the other hand, allowing staff to use any AI tool they like, with no checks, can leave you exposed.

If your policy also covers contractors, make sure the rules fit the way you've engaged them. Contractor arrangements need particular care, especially with the contractor gateway test introduced through the Employment Relations Amendment Act 2026. You can require contractors to protect your confidential information, but too much day-to-day control over how they do the work can create employment status issues. Get tailored advice if you're using the same AI rules for employees and contractors.

What Risks Are You Trying To Manage?

You're usually trying to manage four main risks: privacy, confidentiality, intellectual property and inaccurate work.

AI tools can feel like ordinary software, but they often handle information in ways your team can't easily see. Depending on the tool and settings, prompts and uploaded files may be processed overseas, retained by the provider, reviewed to improve the service or available to an organisation account administrator.

Privacy Act 2020

If staff put personal information into an AI tool, your business may still be responsible for how that information is handled under the Privacy Act 2020. This can include customer names, email addresses, employee performance notes, health information, photos, complaints and payment details.

If information is sent to an overseas provider, Information Privacy Principle 12 can also be relevant. You may need to think about whether the overseas recipient has comparable privacy protections, or whether another permitted pathway applies.

Fair Trading Act 1986

If AI helps write your ads, website copy or sales scripts, you still need to make sure the output is accurate. The Fair Trading Act 1986 applies to misleading or deceptive conduct, even if an AI tool created the wording.

For serious breaches, companies can face penalties of up to $600,000 and individuals up to $200,000. The practical lesson is simple: don't publish AI-generated claims about pricing, results, guarantees, ingredients, qualifications or performance unless someone has checked them.

A Worked Example

Maia runs an online skincare business in Wellington with 12 staff. A customer service team member uses ChatGPT to draft replies to 320 customer complaints and uploads a spreadsheet with names, email addresses, order numbers and skin concerns.

Maia's issue isn't that the reply was drafted faster. It's that personal information and sensitive customer details may have been disclosed to an external AI provider without the right checks.

A good AI policy would have told the team member not to upload customer spreadsheets, required approved tools only, and made human review compulsory before customer replies were sent. It also would have given Maia a clearer process for responding once the issue was discovered.

Can Staff Put Confidential Information Into ChatGPT?

Usually, no - staff shouldn't put confidential business information, customer data or employee information into public AI tools unless you've approved the tool and the use case.

Confidential information isn't just secret product plans. It can include everyday material that your business wouldn't want outside the organisation, such as:

• customer names, contact details and purchase history
• employee records, payroll information and performance notes
• supplier pricing, margins and contract terms
• draft proposals, tenders and pitch documents
• software code, product roadmaps and designs
• internal processes, strategy documents and board papers

Your employment agreements, contractor agreements and confidential information policy should already include confidentiality clauses. Your AI policy should build on those clauses by explaining what confidentiality means in the context of AI tools.

For example, your policy might say that staff can use AI to improve the wording of a generic email, but they must remove names, addresses, account numbers, health details, pricing and any other information that could identify a person or reveal something confidential.

Be careful with de-identification, though. Changing a name from Sarah to Customer A may not be enough if the rest of the prompt still identifies the person. A small town, rare medical condition, job title or specific order history can still point back to someone.

If you want staff to use AI with real business data, it's worth choosing approved tools, checking the provider terms, turning off training where possible, setting access permissions and documenting what data can and can't be used.

How Should You Update Your Staff Handbook?

You should make your AI rules part of your staff handbook or workplace policies, and cross-reference them in your employment agreements where appropriate.

A short, practical AI policy is usually more useful than a long technical document that no one reads. It should tell your team what they can do, what they can't do and who can approve exceptions.

Templates can be a helpful starting point, but they often miss how your business actually uses data, customers, contractors and tools. A lawyer should tailor the policy before you use it, especially if you handle sensitive information, need a privacy policy, or provide regulated services.

AI Use Policy Outline

Here is a fill-in outline you can use to plan your policy before it's drafted properly:

1. Purpose: Explain why the policy exists, such as protecting confidential information, privacy, quality and customer trust.
2. Who The Policy Applies To: List employees, managers, contractors, interns and anyone else who accesses your systems.
3. Approved AI Tools: Name the tools staff can use, who approves new tools and whether free public accounts are allowed.
4. Permitted Uses: Set out low-risk tasks, such as brainstorming, summarising public information or improving grammar.
5. Prohibited Uses: Ban uploads of confidential information, personal information, customer files, employee records, source code or contract documents unless approved.
6. Human Review: Require staff to check AI output for accuracy, bias, tone, confidentiality and compliance before using it.
7. Customer And Marketing Content: Require review of claims that could raise Fair Trading Act issues.
8. Privacy And Security: Set rules for personal information, overseas tools, access controls, information security and record keeping.
9. IP And Ownership: Explain how AI-assisted work is treated and when staff need approval to use third-party material.
10. Breaches And Questions: Explain who to contact, how to report mistakes and what may happen if the policy is breached.

Once the policy is ready, train your team on it. A five-minute explanation at onboarding and a short refresher when tools change can make a big difference.

What If Staff Have Already Used AI The Wrong Way?

Start by containing the issue, finding out what information was used, and keeping a clear record of what happened.

Try not to jump straight to discipline. If your business didn't have a clear policy, the first step is often to manage the risk and tighten the rules.

What To Do First

1. Identify The Tool: Record which AI tool was used, whose account was used and whether it was a free or paid version.
2. Capture The Prompt And Output: Keep copies of what was entered and what the tool generated, if available.
3. Check The Information: Work out whether confidential information, personal information, customer data or employee information was included.
4. Review The Provider Settings: Check whether prompts can be deleted, whether training can be disabled and whether the provider stores data overseas.
5. Assess Privacy Breach Duties: Under the Privacy Act 2020, if a privacy breach has caused or is likely to cause serious harm, you must notify the Privacy Commissioner as soon as practicable. You'll usually also need to notify affected individuals as soon as practicable, unless an exception applies or public notice is required instead.
6. Fix The Process: Update your generative AI use policy, train staff and limit access to risky tools if needed.

If you're considering disciplinary action, follow a fair process under the Employment Relations Act 2000. That usually means investigating properly, telling the employee your concerns, giving them a fair chance to respond and considering their explanation before deciding what to do.

If you monitor staff AI use through browser logs, device controls or workplace software, tell staff what you monitor and why. Secret or excessive monitoring can create privacy and employment law problems, even when your goal is to protect the business.

Key Takeaways

• You can usually ban or restrict ChatGPT at work if the rule is reasonable, clear and connected to a real business risk.
• A controlled-use policy often works better than a total ban, especially if AI can help your team with low-risk tasks.
• Staff shouldn't upload confidential information, customer data or employee records into public AI tools unless you've approved the tool and use case.
• Your AI policy should sit alongside your employment agreements, confidentiality clauses, privacy processes and staff handbook.
• AI-generated work still needs human review, especially for customer advice, marketing claims and anything involving personal information.
• If something has already gone wrong, contain the issue, keep records, assess Privacy Act obligations and update your processes before it happens again.

If you'd like help with your AI use policy, staff handbook updates, employment contracts or confidentiality rules for your team, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.