Plain-English definition for NZ business owners
Think of it as an approved-tool list with enough context to make decisions: who can use each tool, what it can be used for, what information must stay out, and what output needs checking.
AI tool register NZ
AI Tool Register NZ: What to Record Before Staff Use AI Tools
Make AI tool use visible before it becomes workflow risk
An AI tool register is a simple list of the AI tools a business uses, who owns each account, what data may enter each tool, what outputs may be used, and which actions need approval.
It shows which tools are safe for low-risk drafting, which need tighter rules, and which workflows should be assessed before AI touches CRM records, inboxes, files, websites, customer details, or public claims.
The register is not legal, privacy, employment, or cybersecurity advice. It is a practical governance checkpoint.
What is an AI tool register?
An AI tool register records the AI tools, accounts, integrations, use cases, data rules, approval points, owners, and review dates inside a business.
AI tool register vs AI policy vs AI risk register
An AI policy for small business NZ explains the rules. An AI tool register records the tools and approved uses. An AI risk register for NZ businesses tracks workflow-level risks, controls, and build decisions. They work together, but the tool register is usually the fastest place to start.
Why NZ businesses need visibility before more AI adoption
AI use often spreads through personal accounts, browser extensions, meeting notetakers, built-in document features, CRM assistants, design tools, and automation platforms before the owner has made a formal decision.
Shadow AI, personal accounts, and built-in AI features
A staff member may use a personal ChatGPT account at work to draft a proposal. Another may turn on an AI meeting assistant. Someone else may use a CRM feature that summarises customer information. These examples are not automatically wrong, but they should not stay invisible.
Why a ban can push AI use further out of sight
If the first response is “do not use AI,” staff may stop talking about tools that help them move faster. A better first move is visibility: ask what is already being used, separate low-risk uses from sensitive uses, and write down what is approved, restricted, or blocked. The shadow AI guide explains how to run that discovery without blaming staff.
Bounded access
What to include in an AI tool register
Keep the first version short enough to maintain. A spreadsheet or shared document is enough to begin.
Tool name, account owner, users, and purpose
Record the tool, subscription type, account owner, active users, purpose, and whether the account is personal, team-owned, or business-controlled.
Approved data, restricted data, and blocked data
List what may enter the tool. Public website copy, internal templates, or approved source documents may be low-risk. Customer records, staff information, contracts, credentials, financial material, or confidential client details may need restriction. Use the AI data access audit when tool use touches files, CRM, inboxes, or shared drives.
Permission level: read, draft, update, send, publish, or blocked
The register should separate preparation from authority. Reading public pages is different from updating CRM fields, sending email, publishing pages, deleting records, or triggering finance actions.
Output review owner and approval gate
Name the person who checks outputs before they affect customers, staff, public content, money, sales commitments, pricing, legal wording, privacy wording, or business records. The rule is simple: AI can prepare, people approve consequences.
Vendor, data settings, retention, logging, and offboarding notes
Record vendor settings, data retention, admin access, logs, exports, and offboarding steps. If the tool is being purchased or renewed, connect the row to your AI procurement checklist and use the AI tool selection checklist for small businesses before approval.
Red, amber, and green AI tool categories
A red, amber, green model helps staff make decisions without reading a long policy every time.
Green: low-risk drafting and public-information use
Green uses involve public information, internal brainstorming, grammar improvement, summarising approved non-sensitive material, or preparing draft structures that a person reviews.
Amber: customer, CRM, meeting, proposal, or website workflows
Amber uses may be valuable but need rules: proposal preparation, customer email drafts, meeting summaries, CRM notes, website copy, reporting notes, or document summaries.
Red: credentials, HR, legal, finance, sensitive customer data, or public claims
Red uses should be blocked or assessed first: passwords, payment information, staff decisions, legal or privacy wording, financial commitments, sensitive customer data, public claims, or automatic sending and publishing.
Example AI tool register for a small NZ business
These examples are illustrative, not client results. They show the level of detail needed for a useful register.
Personal ChatGPT account
Purpose: low-risk drafting and rewriting. Data rule: no customer records, staff information, contracts, confidential documents, or private financial material. Permission: draft only. Approval: manager reviews customer-facing output.
Microsoft Copilot or Google Workspace AI
Purpose: internal document and email assistance. Data rule: approved business accounts only; folder permissions need checking first. Permission: read and draft. Approval: named owner reviews customer, HR, finance, legal, privacy, or public outputs. Pair this with a Microsoft 365 Copilot governance checklist or Google Workspace AI governance checklist.
AI meeting notetaker
Purpose: call summaries and action lists. Data rule: approved meeting types only; consent, sensitive topics, and client confidentiality need clear rules. Permission: record, transcribe, summarise, and draft actions. Approval: meeting owner checks before notes become CRM updates. See the AI meeting notes policy.
CRM or inbox AI assistant
Purpose: summarise customer context and prepare replies. Data rule: approved CRM or inbox access only. Permission: read and draft first; no automatic send, field changes, discounts, or promises without approval. Approval: sales or service owner reviews before action.
When a tool register should trigger an AI Agent Assessment
A register is not only a compliance exercise. It also shows where AI is already useful enough to govern properly.
Repeated weekly use
If staff use the same AI tool for the same task every week, the business may need a repeatable workflow, not private prompting habits.
Sensitive or customer-facing use
If AI touches customer context, proposals, support replies, staff information, financial material, complaints, website copy, or public claims, it needs approval gates and source rules.
Connected systems or workflow automation
If a tool connects to CRM, inboxes, calendars, files, websites, dashboards, accounting systems, or automation platforms, assess permissions before giving it authority.
No clear owner, reviewer, or source of truth
If no one owns the tool, reviews outputs, or knows which source the tool should trust, the workflow is not ready for more automation.
The AI Agent Assessment reviews the register, source systems, approval points, permissions, and workflow value. The outcome is a practical decision: approve use, tighten rules, prepare data, build a governed workflow, or avoid the use case.
Frequently asked questions
What is an AI tool register?
An AI tool register is a list of AI tools used by a business, including account owners, users, business purposes, approved data, blocked data, permission levels, review owners, vendor notes, and review dates.
Is an AI tool register the same as an AI policy?
No. An AI policy sets the rules for safe use. The tool register records which tools and use cases are approved, restricted, blocked, or waiting for assessment.
What AI tools should a New Zealand business record?
Record public chatbots, personal AI accounts, team workspaces, Copilot or Google Workspace AI, meeting notetakers, browser extensions, CRM assistants, inbox tools, design tools, automations, and any AI feature connected to business data or outputs.
Who should own the AI tool register?
A named person should own the register: the business owner, operations manager, IT lead, privacy/security owner, or another accountable manager. Each tool should also have a workflow owner.
When should AI tool use be assessed before continuing?
Assess when the tool is recurring, sensitive, customer-facing, connected to business systems, using private data, preparing public claims, changing records, or lacking a clear reviewer.
Next step
Start by listing the tools staff use, what information enters them, and what output reaches customers, systems, or public pages. Then mark each row green, amber, red, or assessment needed.
If the register shows repeated, sensitive, customer-facing, or system-connected AI use, start the $1,000 AI Agent Assessment. We will map what should be approved, what needs tighter rules, and which workflow to build first.