AI Operating Policy

Your staff are already using AI. For most boards the open question is not whether to allow it, but whether anyone has written the rules down.

This is the policy Layer3 operates under, published as a template with the company name left blank. It replaces the softer guideline versions most organisations start with, and it is written for New Zealand conditions.

What is in it

• Purpose and scope, covering employees, contractors, vendors and any third party touching AI on your behalf
• Roles and responsibilities, split across an AI Owner, Privacy Officer, Security Officer, business unit managers and all users
• Definitions for AI systems, generative AI, AI agents, personal information and sensitive corporate data
• General rules covering data handling, where your vendor processes data, human oversight and traceability
• Violations, the review cycle, and an appendix of legal and regulatory requirements

Written for New Zealand

The rules reference the Privacy Act 2020, the Copyright Act 1994, the Harmful Digital Communications Act 2015 and the NZ Algorithm Charter, with security expectations aligned to NZISM and CERT NZ guidance. Cross-border processing is handled against Privacy Principle 12, so cloud AI has to sit in New Zealand or an approved jurisdiction.

The rule that matters most

AI may assist a decision. It must never make one. Every output is treated as a draft requiring human review, and decisions touching employment, credit, safety, compliance or customer outcomes need documented human oversight.

Using it

Replace the company placeholder, cut what does not apply, and add what does. It is a reference template rather than legal advice, so take your own advice before adopting it.