AI acceptable use policy for your New Zealand business

Common sense is rarely enough once staff or users start using AI tools across customer service, marketing, coding, recruitment, analytics or document creation. Problems often arise when people enter confidential material into public tools, rely on outputs without checking them, or assume generated content is automatically safe to use. An AI acceptable use policy gives your business a written position on what is allowed, what needs approval and what is off-limits. That can be important for privacy, confidentiality and intellectual property risk, especially where multiple teams use different tools.

An AI acceptable use policy commonly covers approved and prohibited uses, restrictions on entering personal or confidential information, review requirements for AI-generated outputs, ownership and use of generated content, record-keeping expectations, security-related behaviour, and consequences for misuse. Some businesses also need separate rules for internal staff use and external user access. The right content depends on whether the policy is aimed at employees, contractors, customers or all three, and whether your systems process sensitive information or generate outputs that others may rely on.

We usually need to understand which AI tools are being used, who is using them, what kinds of data are being entered, whether outputs are published or relied on externally, and whether there are approval steps before use. It also matters whether your business builds AI products, buys third-party tools, or allows staff to choose their own tools. A useful version should be based on your real data practices, not just a generic list of privacy clauses. A policy that ignores actual workflows can look fine on paper but still leave important gaps.

Sometimes a template helps you see the headings, but it often falls short once your business has real data flows, customer-facing outputs or multiple teams using AI differently. A generic policy may say not to misuse AI, but it may not explain whether staff can input client material, whether generated code can be deployed, or who must review outputs before publication. Tailored drafting can address those practical questions. The work is designed to identify practical risk areas and recommend next steps, while the final legal position depends on your facts and implementation, particularly if day-to-day practices differ from the written policy.

The fixed-fee covers the legal drafting or review of the policy document and advice connected to that document. It does not include technical implementation, system configuration, security remediation, ongoing HR management or running a full training programme for your team. If you need help turning the policy into internal roll-out materials, approval workflows or related contract updates, that can usually be scoped separately. For many clients, the next step after the policy is finalised is to align onboarding, internal guidance and tool access settings with the written rules.

Submit an enquiry on this page or click 'Get started'. One of our legal consultants will review it within 1 business day and get in touch to understand what you need.

Your consultant will then email you a fixed-fee quote setting out the cost, scope and timing. If you're happy with it, you can accept the quote and sign our engagement letter online.

Once you've accepted, one of our Australian-qualified lawyers will work with you to complete your project. They'll contact you by email or phone if they need anything.

Sprintlaw works on fixed-fee pricing wherever possible, so you can review the scope and cost before you decide whether to proceed. For the AI Acceptable Use Policy service, pricing starts from $900.00.

After you enquire, a legal consultant will confirm what is included, the expected timing and whether any extra work is needed before you engage us.

We work online, so we can help wherever you are in New Zealand. Our team works remotely, mainly from Australia.

Your work is done by our Australian-qualified lawyers, who hold Australian practising certificates and specialise in business law. None of them are New Zealand lawyers or hold a New Zealand practising certificate.

Sprintlaw NZ Limited is a legal consultancy, not a law firm, and is not regulated by the New Zealand Law Society. We don't act in court or tribunal matters, conveyancing (including leases and business sales) or other reserved areas of work. Communications with Sprintlaw are unlikely to be protected by legal professional privilege. We still keep everything confidential under our engagement letter.