The adoption of AI tools in New Zealand businesses has accelerated significantly in the past 12 to 18 months. Tools like Claude, ChatGPT, and various workflow automation platforms are being used to speed up processes, improve decision-making, and free up staff time.

That’s largely a positive development. But there’s a step many businesses are skipping — one that has meaningful legal and reputational implications.

Privacy compliance.

“A lot of businesses are using these tools without thinking carefully about the privacy implications. And when client data is involved, that’s where things can get complicated very quickly.”

The Specific Issues Worth Understanding

There are three areas I’d encourage any business owner to think through carefully before expanding their use of AI tools with client or employee data.

The first is data storage location. Many of the major AI platforms — including some of the most widely used ones — store information on servers in the United States. Depending on the nature of the data you’re using and the consent you’ve obtained from clients, this may create issues under New Zealand’s Privacy Act. The question to ask your platform provider is simple: where is my data being stored, and who has access to it?

The second is your privacy policy. With updates to New Zealand privacy legislation coming into effect in May, businesses need to ensure their policies accurately reflect how client data is being used — including through third-party tools. A privacy policy written three years ago almost certainly doesn’t contemplate AI-assisted workflows.

The third is your internal AI policy. This is the one most businesses haven’t thought about at all. It’s not enough to use these tools responsibly yourself — you need to ensure your team has clear guidelines on what is and isn’t appropriate. What client data can be used? What platforms are approved? What information should never be entered into a third-party tool?

What We’re Doing at Outside Accounting

I want to be transparent: we don’t have this perfectly sorted yet either. We’re currently working with a specialist consultant to ensure our privacy policy is up to date, that our internal guidelines are clearly documented, and that our use of AI tools is fully compliant before we expand how we use them with client data.

That process has taken time and some investment. But it’s the right way to approach this — and in an environment where data privacy expectations are increasing, it’s also the commercially sensible approach.

If you’re a business owner who’s been using AI tools with client data and haven’t yet addressed these questions, I’d suggest treating it as a priority rather than something to revisit later. The risk is real, and the work to address it is manageable if you start now.

Happy to point you in the right direction if it would be helpful.