New report warns employers that they are leaving themselves open to 'significant risks' without AI guardrails
Guardrails on artificial intelligence (AI) tools are falling behind in New Zealand workplaces, according to a new report, which warned employers of the potential security risks in the absence of an AI policy.
Findings from MyHR revealed that 87% of Kiwi workplaces are now harnessing AI tools, in line with the 82% of organisations the AI Forum of New Zealand found were using the technology.
"The adoption of AI tools, especially publicly available ones like ChatGPT, Claude, Copilot, and Gemini, has happened at lightning speed across a wide range of industries," said Sylvie Thrush Marsh, chief evangelist for MyHR.
However, MyHR also found that only 5.7% of employers utilising AI have an AI policy in place. In fact, just 2.3% of employers with five or fewer employees have guardrails for AI use, significantly behind the 14.3% of businesses with more than 100 people.
"Unfortunately, what we're seeing is that the guardrails and setting of expectations around the use of this new technology at work are lagging behind, which leaves employers and employees open to significant risks if things go pear-shaped."
One situation that could open up an organisation to major risk is when an employee inadvertently enters confidential company information into their AI platform, according to Marsh.
Employees can also end up relying on an inaccurate device or use AI that require human judgements, she added.
"Without a good understanding of how large language models work, lacking clear expectations from their employer, and without useful training, it's going to be hard for employers to meet their privacy obligations, or hold employees to account where appropriate," Marsh said.
"This means employers are going to face a higher burden of responsibility when things eventually go wrong."
Developing AI policies
The findings come in the wake of the New Zealand government's strong push for the "responsible" use of AI in businesses.
The Ministry of Business, Innovation, and Employment (MBIE) last year published a "Responsible Artificial Intelligence guidance for businesses," aimed at supporting businesses to build "better, safer, and more fit-for-purpose AI products and services."
"Businesses can decide the extent to which different parts of the Guidance matter in their context – based on where they sit in the AI life cycle, how the business works, who their customers are, and their business goals and limits," the guidelines read.
"Even if some parts don't seem to fit right now, reading the Guidance in full will help with understanding the big picture and what to watch out for when using, deploying, or developing AI systems."
MyHR, an HR tech and advisory firm, said almost as many of its customers have introduced their first AI policy in the past three months as in the first half of 2026.
It noted that professional, scientific, and technical businesses lead the way in implementing an AI policy at 11%. However, only 2.3% of retailers and just 0.7% of accommodation and food services businesses have followed suit.
The first step in developing an AI policy at work is assessing where AI tools can be implemented in the business and identifying where staff are already using these tools, according to MyHR.
This step should be followed by:
- Introducing boundaries, controls and clear guidance around use, which should be written and shared. This includes whether personal accounts can be used, or if the company will be providing enterprise-level subscriptions to staff
- Creating space for safe experimentation, including auditing how staff are using public AI tools across the business and flagging high-risk areas and opportunities
- Providing ongoing training and education
MyHR said the first three steps should be reviewed and updated regularly.
