Module 4: Safe use at work in NZ and next steps
A simple team AI policy starter
Allow 5 minutes. This is a draft for your manager and privacy lead to adapt. It needs approval before your team treats it as policy.
Copy and complete the starter
Team Copilot use: draft for approval
Owner: [role] Review date: [date]
Approved service and account:
[Name the work Copilot service, account and licence scope.]
Allowed tasks:
[For example: draft wording from approved non-sensitive notes.]
Information rule:
Use only information approved for this service and purpose.
Do not enter passwords, tokens or recovery codes.
During training, use invented or public information only.
Refer personal or confidential information to [privacy lead].
Check before use:
Open the source. Verify facts, numbers and meaning.
Confirm the audience may receive the information.
The responsible person approves the final work.
AI output must not decide employment, contractual,
financial or safety matters on its own.
Transparency and records:
Follow our rules on telling people when AI materially helps
our work. Keep approved source and review records in [place].
If something goes wrong:
Stop using or sharing the output. Report promptly to [role]
through [internal channel]. Follow our incident process.
Do not paste the incident or affected records into AI.Make the rule usable
Choose a real owner and reporting channel. Give one allowed task and one task that needs advice. Confirm retention and web-search settings with IT. The Privacy Commissioner's guidance helps your privacy lead assess personal information use; Digital Government's governance advice supports accountable oversight.
Try it: 3 minutes
Fill in the placeholders. Add a rule about who checks client-facing drafts. Mark the document Draft: needs approval and save it for discussion. Do not describe it as an approved or legally complete policy.
Done when: another staff member can identify the approved account, data rule, reviewer and incident contact.