The full policy pack

What the ledger is for

Your ledger is the answer to “what AI does this office use?”. It is a spreadsheet, not a project. It exists so that when a client asks, an insurer asks, or someone pastes the wrong file on a Tuesday, you can open one tab and see every tool, who pays, who has it and where their data lives.

Ninety per cent of the value is the two columns everybody leaves blank: monthly cost in New Zealand dollars, and the country the data is processed in. Those are the two that decide whether you have a PP12 story.

The columns

Three rules that make it real

1. One owner, usually the office manager — not the boss, who will never have the time.
2. Bill every paid tool through one admin account. Self-serve sign-ups are the reason the ledger is never complete.
3. Review it quarterly at the same slot as your OH&S review. Delete every seat that nobody opened in 90 days.

What a row usually looks like

The pattern to watch for: the free version on a phone, paid by a credit card in someone’s own name, with a data region nobody checked. That row is the one that turns up in a tender disclosure and the one that costs you an afternoon in the office.

Why this exists in construction

Building firms are not software companies, so the paperwork that protects them is usually borrowed from someone else’s template and never read. The result is a paid AI tool that sees your priced tender, your subbie rates and your client’s personal details, with nothing in writing about where any of it goes.

You do not need a legal team. You need three questions, asked once, in writing, with the answer filed next to the receipt.

The three questions

1. Where is my data processed and stored? Ask for the countries, in writing. One line is enough — a sentence is better than a link to a trust page.
2. Will you use my content to train a model? If the answer is yes, ask what you can opt out of, and record the date you asked.
3. How will you tell me if there is a breach? You want a named notification period and an email address that reaches a human.

Record of the answers

Red flags that mean stop

• No written answer to any of the three after two weeks — treat that as no.
• A region your team cannot pronounce, with no contractual protection for it.
• Terms that let the vendor change the data handling at any time without notice.
• The free tier offered to staff with no business account available at any price.

Where the Act sits

IPP 12 of the Privacy Act 2020 restricts sending personal information to a foreign party. A written commitment to protect the information to a comparable standard — your contract clauses, not their marketing page — is one of the routes that makes an overseas disclosure lawful. The Privacy Commissioner has published model clauses you can point at.

From 1 May 2026, IPP 3A adds a notice obligation where personal information is collected indirectly. If your AI work infers or scrapes information about people rather than collecting it from them, that principle now applies to you as well.

The eight things that must not go in

1. Client, developer or subcontractor names, addresses, phone numbers and emails.
2. Live pricing, rate cards, day rates, a completed scope or a priced tender.
3. Unredacted drawings, MSJ, RISA, structural sets, survey or geotech data.
4. Recordings or transcripts of a variation, claim or dispute discussion.
5. Staff and subbie personal information — IRD numbers, bank details, certifications, ticket numbers.
6. Anything under NDA, or anything already in dispute.
7. Site safety incident details and any person’s health information.
8. Your client’s own client — the person one level up who never agreed to anything.

Where those hide in a building office

The routine — eight steps, two minutes

1. Open the original file and save a copy with “-work” on the end.
2. Work only in the copy.
3. Delete the title block, headers and footers.
4. Replace names with role codes — “Client”, “Engineer”, “Subbie A”.
5. Strip phone numbers, emails and IRD numbers.
6. Numbers stay if they are yours and anonymous; change the price if it identifies the client.
7. Paste the copy into the tool, never the original.
8. Delete the copy when the job closes, or keep it with the job file.

A test that takes ten seconds

Before you paste, ask: if this paragraph ended up on a public model, would I have to ring the client? If the answer might be yes, it is not ready. That single question would have caught most of the shadow-AI cases recorded in the New Zealand building sector’s own research on unmanaged AI use.

First — is this even notifiable?

Under the Privacy Act 2020 you must notify the Privacy Commissioner and any affected person when a privacy breach has caused, or is likely to cause, serious harm. Sections 112 to 117 set the test. Serious harm includes financial fraud, identity theft, physical harm or intimidation, blackmail, employment harm and psychological harm.

A business that collects or holds personal information is an “agency” under the Act, so this is not optional for a building firm. Failing to notify the Commissioner without reasonable excuse is an offence carrying a fine of up to NZD 10,000. The Commissioner also expects notification ideally within 72 hours of becoming aware, even while you are still investigating.

You do not need to be certain. The assessment is whether it is reasonable to believe serious harm has or may occur — judged from the position of a reasonable person in your situation.

The same day — six steps

1. Stop the bleeding. Revoke access, rotate the credential, pull the account. Do this before anything else.
2. Do not delete anything. Preserve the tool, the prompt history and the file. You will need them to answer questions.
3. Write down the facts as they stand: what left, when, whose information, to whom, what you know and what you do not know yet.
4. Name one person to run it. Usually the office manager, with the director told the same hour.
5. Make the serious harm call. Financial data, identity documents, medical or disciplinary detail, or a variation discussion that exposes a claim position — any of those raises the risk.
6. Notify. If the Commissioner and affected people need telling, do it within 72 hours and keep proof you sent it.

Who to call

What the notification needs

• What happened, including when it occurred and when you identified it.
• How many people were affected, if you know.
• The type of personal information involved and how sensitive it is.
• Where the information went, if you know.
• The likely harm and the cultural perspectives on that harm.
• What you have done to contain it, and what security was in place.
• A contact person for the Commissioner to come back to.

Then, the week after

1. Add the incident to the ledger’s review slot.
2. Fix the control that failed — offboarding, admin accounts, the redaction routine.
3. Re-run the readiness score. The dimension that failed is the one you under-scored.

What this page is not

General guidance written for New Zealand building firms, not legal advice. If a breach has happened and the dollar amounts or the people involved are significant, get a lawyer and the Privacy Commissioner’s own guidance at the same time.

Why a clause at all

Most subcontracts say nothing about AI, which means nothing about whose data goes where, or who checks the output. When a subbie drafts a variation letter with a tool and sends it to your client in your name, the gap is yours to explain.

Three sentences closes most of it. Add them to the scope or the letter of appointment rather than rewriting the whole contract.

The clause

What it buys you

• A named person somewhere in the chain who checked the number before it left.
• A record that exists if a variation later becomes a claim.
• A written answer to the client’s question about where the information went.

If a subbie pushes back

The usual answer is “we already do this”. The clause is not asking them to stop — it is asking them to say which tool, who checks, and where the file is kept. Most established subcontractors will agree in a minute, because they would rather say so in writing than have it discovered later.