For an NZ business, the risk check is simple: find who is using AI, what tools they use, what information they enter, what outputs reach customers or systems, and where human review is required. Then decide whether personal accounts, a team workspace, or a governed AI agent is appropriate.
Do not start with panic or a ban. Start with visibility. When use is recurring, sensitive, customer-facing, or connected to source systems, the $1,000 AI Agent Assessment helps decide what should become an approved workflow.
Most personal ChatGPT use starts for practical reasons: a draft to clean up, a document to summarise, a proposal to outline, or a customer question to think through.
Personal AI accounts appear when the business has not named approved tools, safe use cases, or review rules. Staff are usually trying to solve work friction: unclear notes, slow admin, repetitive emails, messy handoffs, or a blank page.
A simple ban can push use further out of sight. A better first step is to ask what staff are already doing, separate low-risk drafting from sensitive use, and write a short rule set. The broader ChatGPT for Business NZ AI Policy Checklist is useful when the business needs staff-wide rules.
The risk is not that ChatGPT exists. The risk is that the business cannot see what context entered the tool, whether the output was checked, or whether a customer, staff member, supplier, or system was affected.
Staff may paste customer emails, contracts, complaint notes, employee information, financial details, pricing context, or confidential project material into a tool the business has not approved. The AI Data Access Audit for NZ Businesses gives a practical pre-check.
Personal accounts usually sit outside business records. Managers may not know which prompt was used, what answer came back, what was copied, or whether the output influenced a decision.
The safest rule is: AI can prepare, people approve consequences. Customer replies, proposal language, pricing statements, HR wording, public claims, website copy, privacy wording, and complaints need human review. The AI Approval Gates for Business Automation page explains those review points.
AI can sound confident when the source material is incomplete. If a staff member asks ChatGPT to summarise a customer situation from pasted fragments, the output may miss CRM notes, job history, contractual details, or recent emails.
Personal accounts are one type of shadow AI. The same issue can appear through browser extensions, meeting assistants, CRM add-ons, document tools, and spreadsheet automations.
Use this as a short visibility exercise. The goal is to understand the work before setting rules.
Ask each role where AI already helps them: sales, admin, operations, marketing, reporting, HR, customer service, finance, website work, or management. Include ChatGPT, Claude, Gemini, Copilot, browser extensions, meeting bots, and built-in AI features.
Record whether the tool is a personal account, team workspace, business feature, extension, or automation. Note who owns the account and whether the business can control access and offboarding.
Classify inputs as public, confidential, customer-related, staff-related, financial, legal, or operationally sensitive. Use the AI Privacy Impact Assessment NZ checklist when personal or client information may be involved. If interpretation is needed, get professional advice; this article is not legal advice.
Look for AI output that becomes a customer email, proposal, quote, support reply, complaint response, website page, sales follow-up, CRM note, policy draft, or decision. The more consequential the output, the clearer the review gate needs to be.
Name the actions that cannot be private judgement: sending, publishing, changing records, making promises, quoting prices, refunds, staff decisions, or using sensitive data. A short AI policy for small business NZ should state these boundaries.
The right answer depends on the workflow, the information involved, and how often the task repeats.
A personal account may be reasonable for low-risk work such as rewriting an internal note, brainstorming agenda items, explaining a public concept, or improving grammar where no private business information is entered.
A business workspace is usually better when staff need shared standards, account ownership, offboarding control, internal templates, agreed settings, and consistent rules about business information.
A managed agent workflow becomes relevant when the task repeats every week, needs approved sources, crosses systems, touches CRM or inbox records, or prepares customer-facing output. If the work is mostly office preparation, compare AI Admin Automation NZ to decide whether the first workflow is admin triage, document intake, CRM cleanup, or reporting preparation.
A useful policy is short enough for staff to follow and specific enough for managers to enforce.
Name which tools are approved for work, who may use them, who owns accounts, and where exceptions are recorded.
List data that staff must not enter into personal AI accounts: customer records, employee information, contracts, credentials, private financial material, complaints, sensitive supplier details, confidential strategy, and unpublished commercial information.
State which outputs need review before they leave the business or affect a system. Customer messages, public copy, pricing, proposals, finance, HR, privacy, legal wording, and high-risk CRM notes should not be used unchecked.
Give staff a simple path when they are unsure: stop, save the example, ask the owner, and record the exception.
Use the AI Agent Assessment when personal ChatGPT use has moved from occasional drafting into recurring business work.
The Assessment maps one workflow, source systems, information involved, outputs AI may prepare, blocked permissions, and human approval points. It also decides whether the next step is policy only, a team workspace, data cleanup, a governed agent, or no automation yet.
This is especially useful when staff are using AI with customer context, proposals, CRM notes, management reports, inbox triage, document summaries, or website copy. The goal is to turn hidden use into an approved, reviewable workflow.
They can use AI tools in low-risk work contexts, but the business should decide what is allowed. Personal accounts become risky when staff enter private business, customer, staff, financial, legal, or confidential information, or when unchecked outputs affect customers or records.
Staff should not enter customer records, employee information, contracts, passwords, private finance details, complaints, confidential strategy, sensitive supplier information, or personal data unless the business has explicitly approved the tool and workflow.
Usually not for recurring or sensitive workflows. A personal account may be fine for low-risk drafting, but business workflows need account ownership, source rules, review gates, logging, offboarding, and permission controls.
Ask which AI tools help staff work faster, what tasks they use them for, what information they enter, and what outputs they use. Treat the answers as workflow evidence, not a disciplinary trap.
Run an Assessment when AI use is recurring, customer-facing, connected to business systems, using sensitive information, or creating outputs that need review before they affect customers, staff, finance, public content, or operations.
Ask one practical question this week: “Where are staff already using AI for work?” If the answers involve sensitive data, customer outputs, repeated admin, or unclear approval, book the $1,000 AI Agent Assessment to decide what should become an approved, governed workflow.
