An employee uploading a document to an AI tool is making a decision about information as well as productivity. The document may contain material that the business is not free to share or reuse without checking its obligations.
New Zealand’s National Cyber Security Centre published small-business AI guidance on 14 January 2026. It addresses the security implications of using AI applications. This article uses that guidance as context, not as a certification or a substitute for specialist advice. Official guide.
Make the boundary understandable
WCRC’s Guru Codex analysis starts with decision ownership. Employees need to know which tools are approved, what information can be used and whom to ask about an exception. A rule that simply says “use AI responsibly” leaves those decisions undefined.
The amount of review should match the information and intended use. A public brochure and an unpublished customer contract do not present the same question. The business must understand its own obligations before defining the boundary.
Keep the process usable
Approval should be specific enough to help the person doing the work. If a process is too slow or unclear, employees may improvise. That is a reason to improve the authorised route, not a justification for bypassing it.
A practical management review would also ask how decisions are revisited when tools or work requirements change. Approval should not be mistaken for permanent assurance.
This explainer does not give legal or technical security clearance for a particular upload. Its purpose is to make the management question explicit: who can authorise the use of this information, for this task, in this tool?