An AI pilot is already a privacy decision

An AI pilot that handles personal information needs a privacy decision before the first live record enters the tool. A short trial can still collect, expose, retain or generate information about identifiable people. For New Zealand teams, a privacy impact assessment should examine the actual workflow and identify what must change before the proposed use can proceed.

The Office of the Privacy Commissioner recommends assessing AI use before starting and updating that assessment as the use changes. Its AI guidance dates from 2023; it remains guidance, rather than a new AI approval scheme. OPC AI guidance

Start with a precise task: who supplies the information, which tool receives it, what output is produced and who acts on it. “Testing AI” is too broad to assess. A customer-service drafting pilot and a tool that ranks people need different questions, even if both use the same provider.

Trace the information through uploads, prompts, integrations, outputs and any operational logs. Identify the person or group who can explain each step. Record the exact service, account type, enabled features and settings. An assurance about the vendor's brand does not establish how this particular arrangement works.

The regulator's PIA resources include a brief privacy analysis for deciding whether a fuller assessment is needed, a step-by-step guide and a template. Use the appropriate depth, and involve your privacy team where the proposed use or uncertainty warrants it. Completing a form does not settle unresolved risks. OPC assessment resources

Review the purpose and source of the information as well as the destination. Information collected for one activity should not silently become material for a different AI task. Ask the privacy owner to assess the proposed collection, use, disclosure and safeguards against the applicable Information Privacy Principles.

IPP3A came into force on 1 May 2026 and adds notification requirements for indirectly collected personal information, subject to exceptions. A pilot that draws information from another person or organisation needs an assessment of whether these duties apply. The indirect collector is responsible for the notification requirements; arrangements for another agency to notify people need evidence, rather than an assumption. OPC IPP3A guidance

Do not copy a supplier's privacy notice and declare this work complete. Record who collects the information, which notification route is proposed and who has checked any claimed exception. This article does not determine an exception for a particular deployment.

Separate facts you have inspected from statements that remain unverified. For example, distinguish a contract's retention commitment from a setting you have checked in the selected account. Where provider behaviour remains unclear, assign the question to an owner and decide whether the uncertainty prevents use of real information.

This is a suggested decision record, not an official regulator template. Keep credentials and sensitive test records out of the assessment pack. Prefer invented data when exploring what a tool sends, saves or returns; confirm the limits of what that test can demonstrate.

A convincing response from the tool is not evidence that personal information is accurate. The Commissioner’s generative AI expectations call for procedures to check accuracy before use or disclosure, and for handling access and correction requests where relevant. OPC generative AI expectations

An invented New Zealand service team proposes using customer complaints received from a partner to draft responses. The account is approved for public material, but its treatment of complaint text has not been verified. No real records have been uploaded and no product test is claimed.

The recorded outcome is: live-data pilot held; fictional-data design exercise only, within the approved environment. This is a decision about missing evidence, not a finding that a named supplier is unsafe. The owner can progress the process map and test expected drafting behaviour using invented cases, but that does not close the production privacy assessment.

The OPC's generative-AI expectations specifically caution against personal or confidential inputs without explicit confirmation of provider retention and disclosure treatment. Its expectations also address leadership approval and engagement with affected communities, including Māori. Those considerations belong in the actual assessment where relevant; a three-row technical checklist cannot replace it.

The assessment should end with an intelligible decision: what use is permitted, under which conditions, who accepts the remaining risks and which matters remain unresolved. Name the business sponsor and the privacy and security responsibilities. Give the operating team the controls it must actually follow.

Connect those conditions to meaningful human checks. Specify what the checker verifies, what information they need and when an output must be withheld. A general instruction to “review the answer” leaves the crucial work undefined.

Set events that reopen the assessment, such as a new data source, provider, integration, account type or consequential output use. Preserve the previous decision and record why the revised workflow remains acceptable, or why it must pause. A trial's successful completion is not advance approval of a wider rollout.

They can reduce exposure during a test, but do not resolve the planned live workflow. Establish whether the records are genuinely invented and assess the production data separately.

Do not present your PIA as an OPC endorsement. It is your organisation's assessment and decision, supported by appropriate expertise.

Duration alone does not explain the processing or its consequences. Assess the proposed use and relevant obligations before relying on real personal information.

OPC AI and the Information Privacy Principles — Guidance dated 21 September 2023, checked 8 October 2026.

OPC Privacy Impact Assessments — Assessment resources, checked 8 October 2026.

OPC generative AI expectations — Expectations issued 15 June 2023, checked 8 October 2026.

OPC IPP3A — Current indirect-collection notification guidance; effective 1 May 2026; checked 8 October 2026.

QSE Advisory is part of the QSE Advisory brand family. Research and drafting were AI assisted. The decision record is an original implementation aid. Obtain competent privacy and technical review for the specific use.

This article is general information. Verify current requirements and seek qualified advice for your specific circumstances.

Spotted an issue? Contact our editorial desk.