New Zealand releases guidance on using GenAI in the New Zealand Public Service. The guidance provides initial advice from the data, digital, privacy, procurement and security System Leaders about Public Service use of GenAI tools. This document and its attached A3 are intended to support agencies to make more informed decisions about using GenAI, balancing benefits and risks.

It is intended to help understand the key risks of using GenAI within the New Zealand Public Service, and mitigations, to develop policy, standards and plans for responsibly using GenAI within an agency context. 

The recommendation asks the users not to use GenAI tools for data classified as sensitive or above. It states that the risks for security and potential impacts if sensitive or above datasets were to be compromised could be catastrophic for our society, economy, and public services. Therefore, all necessary steps must be taken to avoid inputting these at-risk datasets into GenAI tools. 

Also, personal information should not be inputted into GenAI tools if external to the user’s environment. The risks to people, and their trust and confidence in their government, if their personal information is compromised could be significant. Hence, all necessary steps should be taken to avoid inputting personal information into GenAI tools outside the user’s network. 

The guidelines also remark that permitting GenAI to be used as Shadow IT should be avoided, be aware that free GenAI tools could carry higher risk, and paid GenAI also carries risk; avoid inputting into GenAI tools any information that would be withheld under the Official Information Act, avoid using GenAI for business-critical data, systems or public-facing channel. 

Whilst the benefit potential is substantial, there are several risks to the Public Service use of GenAI that could seriously damage public trust and potentially harm the public if they were to materialize. The guidelines recommend fully assessing and actively managing the risks to support informed decisions on when and how your agency uses GenAI. 

To sum up, the following are the key pointers mentioned in the guidelines:

• Robustly govern the use of GenAI  
• Assess and manage for privacy risks  
• Consider Te Tiriti o Waitangi (the Treaty of Waitangi)  
• Use AI ethically and ensure accuracy  
• Be accountable  
• Be transparent, including to the public  
• Exercise caution when using open-source AI  
• Apply the Government procurement principles  
• Testing safely