AI in short: The essentials

Contributors: Liz Blythe, Louise Taylor and Jessie Williams

In June, the Five Eyes intelligence alliance issued a rare public warning. In short: "the cyber threat from frontier AI is coming in months, not years. Act now". Just weeks later, an Open AI model broke out of its sandbox, accessed the open internet and hacked a real company, just to cheat on the test it was taking. Five Eyes said "months, not years". But the reality arrived in weeks.

So, what should businesses do? Well, the answer isn't futuristic. It's basic security hygiene, done faster. Three things matter most:

• First, know where your sensitive data goes. Every path it takes in, through, and out of your business, and which of those paths you're actually monitoring. The answer may be less coverage than you think.
• Second, fix your access controls. Who can reach what, and how are you verifying they are who they claim to be? Most of these AI-related incidents aren't evil robots. They're ordinary systems accessing data they simply shouldn't have access to.
• Third, test your response for real. Not a document. A live drill.

Five Eyes was blunt: breaches will happen. The only question is how fast you catch them and respond.

And don't forget your supply chain – are your suppliers engaging in the same security hygiene as well? It's time to check. The threat may sound like science fiction. But the defence is surprisingly ordinary.

Contributors: Liz Blythe, Will Irving

Here's a question that didn't exist three years ago: If you paste confidential client information into a public AI tool, is it still privileged? Recent court decisions suggest the answer is no.

In the U.S. Heppner case, a corporate executive entered details of his situation into a public AI chatbot to work out his legal exposure. When authorities later seized his computer, he claimed privilege. But the Courts disagreed. Why? Because an AI chatbot isn't a lawyer. Also, privilege can be waived if confidentiality is lost. Based on the terms of access, public AI chatbots owe you no duty of confidence. Confidentiality gone. Privilege gone.

In the UK Munir case, the Upper Tribunal went even further, finding that uploading confidential documents into an open, public AI tool effectively placed them in the public domain. Confidentiality lost. Privilege waived.

So, what about New Zealand? Well, we haven't had our own Heppner or Munir case yet, but we don't actually need one to know the answer.

As a matter of New Zealand law, legal advice privilege protects confidential communications between a client and a lawyer made for the purpose of obtaining or giving legal advice. It barely needs to be said that a public AI chatbot is not a lawyer because privilege can be waived if confidentiality is not protected. The same rules apply here as in the Heppner and Munir cases. The New Zealand Courts and the Law Society have issued guidance on using AI. In short, don't put confidential, privileged or suppressed information into a public AI tool. 

So, the lesson is simple. Use the tools but be sure to keep sensitive information out of the public ones. 

Contributors: Liz Blythe, Louise Taylor and Jessie Williams

AI-generated content in the EU now has to carry an invisible mark that says, in effect, a machine made this. Get it wrong, and the fines run to €15 million, or three per cent of global turnover.

That's Europe. So why does it matter here?

Because the technology doesn't stop at the border. The major AI developers are marking their output worldwide, not just for EU users. So, if your team drafted something with a mainstream AI tool this morning, the work that goes out to your client this afternoon may already carry a mark — whether the Act applies to you, or not.

There are two kinds of marks: Some marks are woven into the content itself: the pixels, the word choices. Others are signed metadata attached to the file. Both are invisible to the human eye and need a specialist tool to detect.

And neither is proof. A mark can survive content a human has rewritten completely. It can attach to your own writing, just because AI translated it or checked for typos. And an absence of a mark doesn't mean no AI - ordinary editing can strip them out, and models that are not used in the EU may not apply them in the first place.

So, treat detection as a signal, not a verdict.

Three steps you should take next:

• First, work out whether the Act applies to you. The trigger isn't where you're based. It's whether you supply AI into Europe, or if your AI-generated outputs are used there.
• Second, work out how it applies to you: are you an AI provider, a deployer, or both? The obligations are different.
• Third, whether the Act applies to you, or not: decide your position on telling clients when you've used AI before they pick it up on a scanner. And make sure that use complies with your client terms. 

And your suppliers?  Are you relying on them to help you comply with watermarking obligations? Your contracts should say who carries that risk. 

And are they using AI in the services they provide to you? Well, it's starting to get easier to check.  

For more information, read Watermarking AI content: What the EU AI Act means for your business. 

Contributors: Petra Carey and James Tocher

Right now, software is setting prices across some entire industries. And regulators are asking a pointed question: is that smart business, or is it collusion?

In the United States, landlords and hotels are being sued for using the same pricing software. But the devil is in the details. The software vendors were promising higher prices, feeding commercially sensitive data into the algorithm, and pushing for 90% adoption rates of price recommendations. The result was scrutiny by regulators, class action lawsuits, and even legislative bans on pricing algorithms.

But here’s the thing - it’s not just an American problem. The Commerce Commission has said that using a common pricing algorithm could amount to a price fixing cartel under the Commerce Act.

So, what should businesses watch for? Three things:

• First, where does the data come from? If your pricing software pools commercially sensitive data from your competitors, that’s a red flag. The same is true if an AI pricing model is trained on such data. Algorithms built with public data carry less risk but are not immune from scrutiny either.

• Second, how much are you actually deciding? If your business deploys prices on autopilot, or rubber stamps price recommendations without genuine commercial judgment, you may be coordinating with competitors without even realising it.

• Third, how is the software being marketed? If your vendor promises market discipline or higher prices, that’s the language of a cartel — not a market intelligence tool.

Using the same pricing software as your competitor isn’t illegal. The problem is using it in a way that replaces competition with coordination. And that line may be closer than you think.

For more information, read Adopting algorithmic or AI-driven pricing in your business? The opportunities and risks - a New Zealand competition law perspective.

Contributors: Emma Peterson 

Used well, AI can boost productivity, enhance innovation, and improve employee performance. However, this is uncharted territory for many employers, so protections need to be put in place.

A recent global survey, including New Zealand, found that more than 70% of employees use AI tools every week. Employers therefore need to make sure they have control over what data is being put into AI, how it is being used, and ensuring appropriate processes are in place for checking output.

That same survey showed that a third of employees use unapproved AI called "shadow AI". This is staff using tools the employer hasn't approved, often through personal accounts.

Why does that matter?

Because confidential client information, personal data, and commercially sensitive material can end up in tools the business can't see or control.

So what should employers do?

1. Find out how your people are actually using AI and what for. That will allow you to come up with a plan for how to provide the right tools to your people.

2. Put a clear AI policy in place. Set out which tools are approved, what data can go into them, and the consequences if the policy is breached.

3. Ensure your people have adequate training as to how to use AI properly and within the bounds of your workplace policy.

The bottom line: your people are using AI. The question is: whether you're managing it, or it's managing you?