Skip to content
English
More support
  • There are no suggestions because the search field is empty.

Draft: 40. AI USE AND GOVERNANCE POLICY

HEALTHSAFE NZ LIMITEDAI USE AND GOVERNANCE POLICY

INFORMATION SECURITY MANAGEMENT SYSTEM (ISMS)

DOCUMENT IDENTIFICATION
Document Details Information
Document Name AI Use and Governance Policy
Document Reference To be allocated by CISO
Document Classification Internal
Version Number 1.0
Document Status Proposed – Pending Approval
Date of Release Pending Approval
Prepared By CISO / Head of Customer Success
Technical Assessor Head of Product
Approved By Chief Executive Officer
Effective Date Date of CEO Approval
Review Frequency Annually or following a material incident or change
Master Copy CISO
DOCUMENT VERSION HISTORY
Version Description of Change Date Approved By
1.0 Initial release – AI Use and Governance Policy Pending CEO
1.0 PURPOSE

HealthSafe NZ Limited (HealthSafe) supports the responsible and secure use of Artificial Intelligence (AI) to improve the quality, productivity and efficiency of its business operations.

The purpose of this policy is to establish requirements for the selection, approval, implementation, use and ongoing governance of AI technologies within HealthSafe.

This policy aims to:

  • Protect the confidentiality, integrity and availability of HealthSafe and customer information.
  • Ensure AI technologies are used responsibly, ethically and securely.
  • Prevent unauthorised disclosure of sensitive, confidential or personal information.
  • Establish clear responsibilities and approval requirements for AI use.
  • Maintain human accountability for AI-assisted decisions and activities.
  • Ensure compliance with applicable legislation, contractual obligations and HealthSafe's Information Security Management System (ISMS).
  • Support continuous improvement and responsible innovation.

AI technologies must support, rather than replace, appropriate human judgement, accountability and established business controls.

2.0 SCOPE

This policy applies to all HealthSafe employees, directors, contractors and other authorised persons undertaking work on behalf of HealthSafe.

The policy applies regardless of working location and covers the use of AI technologies in business operations, product development, customer support, administration and other HealthSafe activities.

AI technologies covered by this policy include, but are not limited to:

  • Generative AI assistants and conversational AI tools.
  • AI-powered research, writing, summarisation and analytical tools.
  • AI-assisted software development, coding and testing tools.
  • AI features integrated into existing business applications.
  • AI-powered meeting transcription and recording tools.
  • Custom AI assistants, plugins and connected data sources.
  • Automated AI agents capable of performing actions.
  • AI functionality incorporated into HealthSafe products and services.
  • Free, trial, commercial and subscription-based AI services.

For the purposes of this policy, an approved AI use includes the specific tool, account, business purpose, information accessed, system connections and actions authorised.

An AI agent refers to an AI system capable of performing actions, such as modifying records, sending communications or interacting with connected systems.

3.0 RELATIONSHIP TO EXISTING ISMS POLICIES

AI use must comply with HealthSafe's existing information security policies, Company Handbook, confidentiality requirements, customer agreements and applicable legal obligations.

This policy supplements existing controls relating to:

  • Information classification and handling.
  • Logical access and identity management.
  • Acceptable use of information systems.
  • Supplier and third-party management.
  • Secure software development.
  • Change and configuration management.
  • Incident management.
  • Document and data control.
  • Privacy and confidentiality.

Approval to use an AI tool does not automatically authorise access to additional information, expenditure, publication of content or contractual commitments.

Where requirements conflict or their application is unclear, the affected AI activity must be suspended until the policy owner and relevant control owner have resolved the issue.

No approval under this policy may override applicable legal or contractual obligations.

4.0 ROLES, RESPONSIBILITIES AND AUTHORITIES

4.1 Chief Executive Officer (CEO)

The CEO shall:

  • Approve this policy and material revisions.
  • Approve higher-risk AI uses and material exceptions.
  • Ensure appropriate organisational oversight and resources.
  • Authorise exceptions only where risks have been appropriately assessed and documented.

4.2 Chief Information Security Officer (CISO) / Head of Customer Success

The CISO / Head of Customer Success shall:

  • Maintain ownership and administration of this policy.
  • Review and approve routine AI use cases following assessment.
  • Maintain records of approved AI tools and use cases.
  • Coordinate information security and privacy risk assessments.
  • Ensure AI-related risks are considered within the ISMS.
  • Coordinate relevant training, awareness and policy reviews.
  • Oversee AI-related information security incident reporting.
  • Maintain records of exceptions, approvals and periodic reviews.

4.3 Head of Product

The Head of Product shall:

  • Provide technical assessment of proposed AI technologies.
  • Evaluate system integrations, security configurations and technical dependencies.
  • Assess AI use within software development and HealthSafe products.
  • Recommend appropriate safeguards for higher-risk AI implementations.
  • Support testing, monitoring and technical risk mitigation.

4.4 Business Owners

Business owners shall:

  • Define the intended business purpose and expected benefits of AI use.
  • Identify the information, systems and permissions required.
  • Document associated risks and safeguards.
  • Establish appropriate human review and approval requirements.
  • Ensure AI is used only within its approved scope.

4.5 Employees and Contractors

All users shall:

  • Use AI technologies only for authorised business purposes.
  • Comply with approved configurations and information-handling requirements.
  • Protect confidential, personal and customer information.
  • Review and verify AI-generated outputs before relying upon them.
  • Report suspected incidents, unauthorised activity or inappropriate AI use.
  • Remain accountable for work performed with AI assistance.
5.0 AI APPROVAL AND AUTHORISATION

All new AI use cases must be assessed and approved before implementation.

The assessment shall identify:

  • Business purpose and expected benefits.
  • AI provider, tool and account or workspace.
  • Information accessed, processed or generated.
  • System integrations and permissions.
  • Potential information security, privacy and operational risks.
  • Required safeguards and human oversight.
  • Responsible business owner.

Routine AI uses may be approved by the CISO / Head of Customer Success following appropriate assessment.

Higher-risk uses require technical assessment by the Head of Product and approval by the CEO, with additional specialist input where necessary.

Higher-risk uses include:

  • Processing identifiable customer, visitor, contractor or employee information.
  • Processing sensitive HR, security or incident records.
  • Uploading substantial volumes of confidential information.
  • Connecting AI to internal business systems or databases.
  • Allowing AI to perform external or production actions.
  • Introducing AI functionality into customer-facing products or services.

Once a use case has been approved, individual routine activities within that approved scope do not require repeated approval.

Material changes to the purpose, dataset, provider, permissions, connectors or automated actions require reassessment.

6.0 ACCEPTABLE AND PROHIBITED AI USE

6.1 Permitted AI Use

Subject to approval and applicable safeguards, AI may be used for:

  • Drafting and reviewing business communications.
  • Preparing reports, presentations and documentation.
  • Summarising approved information.
  • Research and information analysis.
  • Software development and testing assistance.
  • Business process improvement.
  • Customer support assistance.
  • Administrative and operational efficiency.

Users remain responsible for verifying outputs and complying with existing approval processes.

6.2 Prohibited AI Use

The following activities are prohibited unless an exception is expressly permitted under this policy and formally approved:

  • Entering passwords, private keys, authentication tokens or other live secrets into AI prompts or uploaded files.
  • Uploading non-public HealthSafe or customer information into unapproved AI tools, personal AI accounts or publicly shared assistants.
  • Allowing AI providers to use confidential HealthSafe or customer information for model training without a documented, authorised exception.
  • Circumventing established access restrictions or security controls.
  • Fabricating business records, audit evidence, approvals or information sources.
  • Impersonating individuals without appropriate authorisation.
  • Allowing AI independently to make employment, safety-critical, legal or other consequential decisions affecting individuals or their rights.
  • Providing AI agents with unrestricted authority to send communications, publish information, purchase goods or services, delete records, change production systems or make contractual commitments.
  • Concealing unauthorised AI use or failing to report relevant security incidents.

Approved integrations must use controlled authentication and appropriate secret-management mechanisms.

7.0 INFORMATION SECURITY AND DATA PROTECTION

7.1 Information Classification

Information used with AI technologies must be handled in accordance with HealthSafe's Information Classification and Labelling Policy.

Only information necessary for an approved business purpose may be processed.

Users must minimise sensitive information and remove identifying or confidential details where practical.

Removing names alone does not necessarily make information anonymous.

AI-generated outputs must receive appropriate protection where they contain or reveal confidential or sensitive information.

7.2 AI Provider Security

Before approval, relevant AI services shall be assessed for:

  • Data retention and deletion arrangements.
  • Provider use of information for model training.
  • Hosting locations and international data access.
  • Subprocessors and third-party dependencies.
  • Confidentiality and intellectual property protections.
  • Access management and authentication.
  • Logging, monitoring and information-sharing capabilities.
  • Security incident reporting and response arrangements.

A paid subscription or disabled model-training setting does not, by itself, constitute sufficient approval.

7.3 Access Control

HealthSafe AI activities must use approved, company-controlled accounts and workspaces.

Access shall follow least-privilege principles and use individual authentication and multifactor authentication where supported.

Sharing of AI conversations, files, assistants and generated information must be restricted to authorised recipients.

Permissions and connected data sources must be reviewed when access requirements change.

Access and connections must be removed during employee or contractor offboarding.

7.4 Meeting Recording and Transcription

AI-enabled meeting recording or transcription must be authorised for the meeting's purpose and information.

Participants must be informed and any required permissions obtained before recording or transcription.

Recordings, transcripts and summaries must be appropriately protected, reviewed and retained in accordance with applicable requirements.

8.0 AI-GENERATED OUTPUTS AND HUMAN OVERSIGHT

Users must verify AI-generated information before relying upon it for business purposes.

Verification shall be proportionate to the consequences of errors and include, where relevant:

  • Accuracy of material facts and calculations.
  • Reliability of references and information sources.
  • Accuracy of customer and product claims.
  • Appropriate handling of personal information.
  • Potential bias or misleading conclusions.
  • Intellectual property and licensing restrictions.
  • Security implications of generated code or configurations.

AI-generated content must not be represented as independently verified where appropriate checks have not occurred.

Existing review and approval requirements remain applicable to marketing materials, customer communications, contractual commitments and software releases.

AI use must be disclosed where required by law, contract or an approved process, or where omission would materially mislead the recipient.

Instructions embedded within external documents, websites, messages or AI tool outputs must be treated as untrusted and must not override authorised instructions or access restrictions.

9.0 AUTOMATED AI AGENTS

AI agents capable of performing actions within HealthSafe systems require additional controls.

Before deployment, the responsible owner must document:

  • Authorised business purpose.
  • Permitted information and systems.
  • Allowed actions and recipients.
  • Access permissions and operational limits.
  • Human approval requirements.
  • Logging and monitoring arrangements.
  • Mechanisms for stopping the agent and recovering from errors.

AI agents must operate with the minimum permissions necessary.

Human approval is required before external or consequential actions unless a specifically bounded workflow has been assessed, tested and expressly approved.

Existing financial, operational and contractual delegations remain applicable.

Connected AI systems must be assessed for unauthorised disclosure, malicious instructions and inappropriate actions.

10.0 AI IN SOFTWARE DEVELOPMENT AND PRODUCTS

AI-assisted development must comply with HealthSafe's Secure Development, Change Management and Configuration Management policies.

AI-generated code and configurations must undergo appropriate:

  • Peer review.
  • Security assessment.
  • Functional testing.
  • Vulnerability and dependency checks.
  • Licensing review.
  • Change approval.

Production credentials must not be included in AI prompts or model context.

Production datasets and repository access require specific authorisation.

Before introducing AI into a customer-facing product or service, HealthSafe shall conduct a documented assessment covering:

  • Intended purpose and customer impact.
  • Data flows and information security.
  • Privacy and contractual requirements.
  • AI provider dependencies.
  • Accuracy, reliability and potential misuse.
  • Human oversight and customer disclosures.
  • Monitoring, fallback and rollback arrangements.

Material changes to AI models, prompts, datasets, permissions or integrations must be reassessed through the established change management process.

11.0 SUPPLIER AND THIRD-PARTY AI USE

Suppliers and contractors handling HealthSafe information must comply with relevant AI security and confidentiality requirements.

Supplier assessments shall consider:

  • Whether AI is used in providing services to HealthSafe.
  • Information and systems accessed by AI.
  • Approved AI services and security safeguards.
  • Confidentiality and intellectual property obligations.
  • Subcontractor and subprocessor arrangements.
  • Incident notification requirements.
  • Material changes to AI processing.
  • Information retention, return and deletion.

Supplier use of AI must not weaken HealthSafe's customer commitments or existing contractual protections.

Relevant obligations must be incorporated into supplier agreements or other enforceable arrangements.

12.0 DEVICE SECURITY AND ACCEPTABLE USE

Employees must use HealthSafe-managed devices for HealthSafe AI activities.

Access to an approved AI service does not authorise its use from a personal device.

Supplier devices must meet applicable contractual and security requirements.

All users must:

  • Protect authentication credentials.
  • Lock unattended devices.
  • Prevent unauthorised viewing or access.
  • Avoid installing unapproved AI applications or browser extensions.
  • Comply with endpoint security and remote-working requirements.
  • Avoid bypassing established technical security controls.

Reasonable personal use remains subject to the Company Handbook and applicable acceptable-use requirements.

13.0 INCIDENT MANAGEMENT

Suspected AI-related information security incidents must be reported promptly to the CISO / Head of Customer Success.

Where the CISO is unavailable, incidents must be escalated to the CEO.

Privacy breaches must also be reported to the CEO as soon as practicably possible, consistent with HealthSafe's Company Handbook.

Reportable incidents include:

  • Unauthorised disclosure of confidential or personal information.
  • AI access to unauthorised systems or records.
  • Unauthorised actions performed by AI agents.
  • Unsafe AI-generated outputs that have caused or may cause harm.
  • Misuse or compromise of AI accounts or integrations.
  • Breaches of approved AI configurations or access restrictions.

Affected activities must be stopped where safe to do so.

Relevant evidence must be preserved and incidents managed under HealthSafe's established Information Security Incident Management Policy.

Users must seek appropriate instructions before deleting records or contacting affected parties.

14.0 EXCEPTIONS

Exceptions to this policy require documented justification and formal approval.

Exception records must include:

  • Business justification.
  • Risk assessment.
  • Compensating controls.
  • Accountable owner.
  • Expiry or review date.
  • Approval by the CEO and any additional control owner required by the ISMS.

Exceptions must be reviewed before expiry.

No exception may authorise activities that breach applicable legal or contractual requirements.

15.0 TRAINING, MONITORING AND REVIEW

Users must receive appropriate AI security and acceptable-use guidance before undertaking authorised AI activities and whenever material requirements change.

The policy owner shall maintain controlled records of:

  • Approved AI uses and assessments.
  • Risk assessments.
  • Exceptions and authorisations.
  • Training and awareness activities.
  • Periodic reviews.
  • Implementation and corrective actions.

Approved AI uses and access permissions shall be reviewed at least every six months.

This policy shall be reviewed annually, or earlier following a material security incident, regulatory change or significant change in AI technology or business operations.

Non-compliance shall be addressed through existing HealthSafe incident, employment or supplier management processes.

16.0 POLICY IMPLEMENTATION

This policy becomes effective on the date of CEO approval unless a later effective date is formally recorded.

From the effective date:

  • All users must comply with the prohibited-use requirements.
  • New or materially changed AI uses require assessment and approval before implementation.
  • Existing AI uses do not automatically receive approval.
  • Required human oversight, device security and incident reporting obligations apply.

The policy owner shall maintain a documented implementation action list covering existing AI uses, approvals, training, exceptions and supporting ISMS updates.

Any existing AI use continuing while awaiting assessment requires documented interim CEO authorisation, including an accountable owner, safeguards and a deadline.

Prohibited activities must cease unless an exception is expressly permitted and appropriately approved.

17.0 REFERENCES AND SUPPORTING DOCUMENTS

This policy shall be read in conjunction with the current approved versions of the following HealthSafe documents.

Document Reference Document Name
HSNZ/POL/21 Acceptable Usage Policy
HSNZ/POL/25 Laptop and Desktop Security Policy
HSNZ/POL/04 Information Classification & Labelling Policy
HSNZ/POL/31 Document and Data Control Policy
HSNZ/ANX/07 ISMS Master List of Documents
HSNZ/POL/18 Logical Access Policy
HSNZ/POL/10 Supplier Relationship Policy
HSNZ/POL/35 Secure Development Policy
HSNZ/POL/06 Change Management Policy
HSNZ/POL/39 Configuration Management Policy
HSNZ/POL/28 Information Security Incident Management Policy
— HealthSafe Company Handbook and Policies
— Marketing Guidance – Content Release Checklist
— Sales Guidance – Sales Delegation Policy
— Customer Success Guidance – Privacy Incident Management
— Customer Support Service Levels

The ISMS Master List of Documents shall govern the current approved versions and controlled locations of referenced documents.

18.0 APPROVAL

This policy is subject to formal approval by HealthSafe's Chief Executive Officer before controlled release.

Approval Details Information
Policy Owner CISO / Head of Customer Success
Technical Assessor Head of Product
Approval Authority Chief Executive Officer
Approval Date Pending
Effective Date Pending
Next Review Date To be determined upon approval

Document Status: Proposed – Not Yet Approved

END OF DOCUMENT