An AI policy is no longer optional. Kiwi cybersecurity expert Daniel Watson warns unguarded adoption is creating real business risk
Without a written AI policy, staff training plan, or documented fallback process, New Zealand businesses are building operational risk into every AI tool they adopt. That’s the assessment of Daniel Watson, Managing Director of Vertech, an Auckland cybersecurity and managed IT services firm. He is also the author of She'll Be Right (Not!): A Cybersecurity Guide for Kiwi Business Owners.
"AI is incredibly useful. Businesses can automate processes, improve productivity and do things that would previously have taken hours, but we're rushing into it without spending enough time thinking about what happens next," Watson said.
The warning has direct implications for HR leaders, who are typically responsible for workforce AI policy, staff training, and the employment consequences of automation decisions.
How should HR leaders approach AI policy for their workforce?
Watson says the most immediate gap is documentation. Many organisations have staff using AI tools daily without any written rules covering approved platforms, permitted data inputs, or accountability for the result.
"That creates a very practical risk. Somebody can paste commercially sensitive information, customer information or intellectual property into an AI system without understanding where that information goes or what happens to it," he says.
The Ministry of Business, Innovation and Employment (MBIE) Responsible AI Guidance for Businesses recommends clear governance structures, staff capability-building, and human oversight of AI outputs. The guidance, published July 2025, is voluntary. HR leaders can use MBIE's framework as a practical starting point without waiting for regulation to compel it.
The Employers and Manufacturers Association (EMA) Workforce 2030 White Paper found only 13% of New Zealand companies have an AI policy in place. With HR being left out of AI adoption leadership in New Zealand, that gap carries real people and culture risk.
What are the workforce training risks HR needs to address?
Watson raises a concern that sits in HR's operational remit: what happens to talent pipelines when AI absorbs tasks that junior employees once performed?
"If businesses stop employing junior people because AI can perform many of the tasks they used to do, where do the experienced people come from in ten years?" Watson said. "We may get an immediate productivity benefit, but we also have to think about how people develop judgement, research skills, critical thinking and experience if the machine increasingly does the early work for them."
The training deficit is already visible. Dayforce's 16th Annual Pulse of Talent report found that 52% of companies surveyed globally do not offer AI training to employees. In New Zealand, 23% of employees said their skills are becoming obsolete, according to the same study.
Training programs should address both current skills gaps and the longer-term question of how human judgement is preserved as automation handles more routine tasks.
Planning for vendor dependency
Watson also raises a scenario HR and operations teams rarely model: what happens when an AI vendor changes its product, adjusts pricing, or removes a feature a core business process depends on?
"It's a business continuity issue because, if an AI system is doing something critical to your operation, you need to know what it is doing, how it is doing it and how you would continue operating if it stopped tomorrow," he says.
Organisations that automate without retaining human capability to perform the same function are creating operational fragility. Watson recommends that businesses commissioning AI-powered systems insist on documentation detailed enough for another competent person to understand and rebuild them.
The decisions made now about which tools to build processes around and which human skills to preserve will shape dependency levels for years to come. Most New Zealand employers are aware of the impact AI will have on their workforce. The organisations that govern AI deliberately now will be better placed to manage what follows.
