// AI
Your staff are already using AI. The question is whether you have told them how. A one-page policy that covers approved tools, what never goes in, who owns it and how you check — and what ISO/IEC 42001 adds if you ever need to prove it.
The short version
Every business we visit has staff using AI. About one in five has told them how. The rest have a policy by default: whatever each person decided, with whatever data they pasted. This is the page that replaces that, and it takes an hour to adopt.
Name them. Typically: Microsoft 365 Copilot (inside your tenant), the AI features inside systems you already license (Xero, your practice or job system), and — for general, non-confidential tasks only — one named consumer tool with a business account. Anything else needs approval.
Customer and staff personal information, financial details, legal matters, health information, passwords, unreleased commercial information. If it would be a Privacy Act problem in an email to a stranger, it is a problem in a chat box.
Everything AI produces is checked by a person who is responsible for it before it goes to a customer, a regulator or a system of record. Citations and figures are verified against the source.
Where AI materially contributes to advice, a document or a decision about a person, we say so — in terms of engagement and, where appropriate, in the work itself.
A named owner. A review every six months, or when a new tool is adopted. A simple log of which tools are in use and for what.
Data pasted where it should not have been, an AI-drafted error reaching a customer: tell the owner the same day. Mistakes reported fast are fixable; mistakes hidden are breaches.
ISO 42001 is the management-system standard for AI. Stripped of the standards language, it asks an organisation to:
| ISO 42001 asks | In plain English | On the one page |
|---|---|---|
| Context and leadership | Why you use AI and who is accountable | Section 5 |
| Risk and impact assessment | What could go wrong for whom, before deployment | Sections 2 and 3, per tool |
| Controls | Technical and procedural safeguards | Sections 1–3 plus your IT controls |
| Transparency and human oversight | People know, and a person remains responsible | Sections 3 and 4 |
| Monitoring and improvement | Review, log, learn | Sections 5 and 6 |
A 20-person business does not need certification. It needs the structure, so that when a large customer’s procurement form asks “describe your AI governance”, the answer is a page rather than a pause. Be AI aligns every engagement to ISO 42001 and the NIST AI Risk Management Framework for exactly that reason.
The policy is the easy part; the controls are what DigitalShield does. If you want the page written for your business and the controls checked, a Be AI readiness session does both — and the AI Opportunity Score on beai.nz tells you where to start.
With a policy, yes for general tasks u2014 drafting a generic email, explaining a concept, brainstorming. Without customer, staff, financial, legal or health information, and never as the system of record. For anything involving your data, use a tool inside your Microsoft tenant such as Copilot.
The international standard for an AI management system, published in 2023. It is to AI what ISO 27001 is to information security: a structured way to govern, risk-assess, document and improve how an organisation uses AI. Certification is for larger organisations; the structure is useful at any size.
If AI materially shapes something a customer relies on u2014 advice, a document, a decision about them u2014 transparency is expected and, in regulated professions, often required. A line in your terms of engagement is the usual approach.
A director or the general manager, with the IT partner responsible for the technical controls. It should not sit with the most enthusiastic user.
// More insights
A single commercial screen with a player and installation, a four-screen menu board, a reception video wall: realistic NZ budgets for each,…
Read more →The three laptops we specify for most NZ businesses, the spec floor that stops a machine being replaced in two years, why…
Read more →Hyperfibre sounds like the obvious upgrade. For most offices under 30 people it is the wrong money. How to size a connection…
Read more →// Ready when you are
Tell us what your business runs on today. We will map what DigitalShield would cover, what it would cost per user, and what we would fix first — free, and in plain language.
