An AI policy your people follow, and your board signs.
Your rules for AI, written for you. Which data goes where, who holds it, and a framework your board signs off in three weeks.
Been asked 'what is our AI policy?' and there isn't one yet.
- Written for your people, not downloaded
- Which data can go where, on one page
- Signed off by your board
Your people are already using AI. The rules haven't caught up.
Somebody in your team pasted a client record into a chatbot this week, and meant well. AI is already in the building. What is missing is a written line on what is allowed, and a board that could explain it if asked.
Your organisation today
With a policy in place
Staff are pasting client data into ChatGPT and nobody knows.
Written rules everyone has read, and a list of which tools take what.
AI is shaping decisions nobody can explain afterwards.
A decision log: what the AI did, who approved it, and why.
The log is what an auditor asks to see.
The board asks about AI and gets a shrug.
A one-page framework they have seen, questioned and signed.
The policy is a PDF nobody opens.
A one-page guide people actually keep open.
Your people use AI with confidence. And your data stays where it should.
The rules, the classification, and the framework your board signs.
Three documents, each written for the person who has to use it: the staff who need a yes or no, the leader who approves a new tool, and the board that has to stand behind it.
The safe-use policy
What your people may and may not do with AI, in plain language, short enough to be read:
- Which tools are approved, and for what
- What may never go into a public model
- What to do when something goes wrong
The data classification
One page that says which data can go where, so nobody has to guess:
- Public, internal, confidential, personal
- Which tool takes which class, and which takes none
- Where the data sits and who holds it, in your terms
The framework
What the board signs, and how new AI use gets a yes:
- An approval path with a named owner
- A decision log for anything AI shaped
- A review date, and a briefing to present it
Written for your organisation, by people who build the tools.
We write AI policy from the inside: we build and run AI for organisations like yours, so the rules describe what actually happens in the tools rather than what a template imagines.
Everything a procurement or legal team needs about RIVER's own controls is in our Trust Centre
- 100% New Zealand built, Māori and Pacific owned, and your data is never used to train a model.
- Where a line needs a lawyer, we say so and hand it to yours for review. The policy is operating guidance, never legal advice.
- Where the answer is that your data cannot leave the building, we point you at what that takes rather than writing around it.
Two to three weeks, policy signed.
Listen
Week 1
We talk to your leaders and the people already using AI, and look at the tools and data in play, so the policy fits how you actually work.
Write
Week 2
We draft the policy, the classification and the staff guide, and work through them with you until every line is one you would defend.
Sign off
Weeks 2-3
Your legal reviewer sees it where it needs one, your leadership signs it, and we brief the board on the framework and what it asks of them.
The investment
Safe-use policy, data classification and staff guidance, signed off
Or keep it alive on the Retainer from $5,000 a month: the annual review, new-tool approvals and board updates, alongside whatever you build or coach.
Every policy set includes
- A safe-use policy your people can read in ten minutes
- Data classification: what may and may not go into which tool
- An approval path for any new AI use, with a named owner
- How an incident or a privacy question gets handled, and by whom
- A one-page staff guide, written for the people using the tools
- A board briefing, so the framework is understood rather than filed
The questions people ask when they’re ready to move.
No. We write the policy, the classification and the framework in plain language, from how your organisation actually uses AI. Where a line needs a lawyer, we say so and hand it to your lawyer for review before sign-off.
- We bring the operating knowledge: which tools take what, how approvals run, what an incident looks like.
- Your lawyer brings the legal read on the lines that need it. That is a short review, not a rewrite.
Both are in the classification. The classification says which personal information can go where, and the approval path is built so a privacy question gets asked before a tool is adopted, not after.
For iwi, hauora and public organisations, where the data sits and who holds it is part of the classification, not a footnote. We write it with you, in your terms, and it is your call. Where it needs a legal read, see the question above. If sovereign hosting turns out to be the answer, that is Sovereign AI, and the policy is what tells you whether you need it.
Not always, but it is cheaper first. A policy written before the first build sets the rules the build follows. Written after, it has to work around what is already running.
- Already using AI informally? Then yes, start here. The risk is already in the building.
- Building with us? The policy set can run beside the first sprint, and the build follows it from day one.
- Nothing running yet? A Review may tell you more, and the policy can follow it.
They answer three different questions. This policy is about how your people use AI. Sovereign AI is about where your models and data physically run. The Trust Centre is how RIVER itself handles your data, with the documents a procurement or legal team asks for.
Your policy can point at all three. A procurement reader who asks "what are RIVER's controls" gets the Trust Centre, and a board member who asks "what are ours" gets this framework.
Once a year at least, and whenever a new tool arrives. The tools change faster than the policy, so the approval path is what keeps it current between reviews: each new AI use goes through it, and the classification grows as it does.
We set a review date at sign-off, and the one-page framework carries it, so the board knows when it comes back.
It is a one-off, and the Retainer is where it stays alive. Buy the policy set or the framework on its own, and it is yours. Included from the Retainer+ tier, where the annual review, the new-tool approvals and the board updates are part of the month, alongside whatever you are building or coaching.
Neither needs the other. Start with the policy if that is the question in front of you.
Easy to start. Fast to prove. Built to scale.
Tell us about your AI Governance & Policy, and we’ll take it from there. Prefer to look first? Ask Moana, or take the free Readiness Check.
Ideas from the field.
Guides and research from a team that ships it.
ArticleHighlight
AI Governance for NZ Enterprises: What Boards Need to Know
New Zealand's regulatory landscape for AI is evolving fast. What boards and leadership teams need to understand about governing AI responsibly, before the regulator tells them to.
GuideHighlight
AI and NZ Privacy: What You Need to Know
The NZ Privacy Act wasn't written for AI, but it applies to AI. A practical guide to data collection, consent, automated decisions, and cross-border transfers for enterprise AI.
Article
The Governance Gap: Between Policy and Practice
Most enterprises have an AI policy now. Few have operationalised it. The gap between 'we have a policy' and 'our teams follow the policy' is where risk lives.
Teams like yours, in their own words.
A decade of work, across health, sport, finance and the public good.
RIVER learnt our business inside out, and found growth we hadn't seen ourselves. That is what changed our ability to scale.
Jay HarrisonFounder, Edison Health · 2022We crunch through complex data to generate insights, and RIVER made it simple to work through, while keeping everyone aligned on our core value proposition.
Alex OsbornCTO, trev · 2024Our business runs on what RIVER built. They have been central to our technology and our growth, and it keeps driving results.
Mark BramwellDirector, Commercial Realty · 2024RIVER listens, understands what we actually need, and gives us our time back. That is what a good partnership looks like.
Tony NaiduDevelopment Manager, Auckland Badminton Association · 2025RIVER helped us validate our market and launch our platform, and they haven't stopped since. They've been with us every step.
Mike CollinsFounder, iMatch Sport · 2025RIVER has been a trusted partner from the start, and they exceeded what we expected. We're already seeing the difference their work is making.
Ellen LekkaProgramme Specialist, UNESCO & SVSG · 2025The team at RIVER has been an incredible partner from day one. Their ongoing support helped make our success possible.
Scott TownshendFounder, trev · 2022RIVER approached every detail with care. Every decision was made with consideration and purpose.
Daemon CoyleGM, Mental Health Foundation · 2021Our new brand is bold and effective, and customers love it. The website has driven a real increase in leads.
Marcus SinGM, Cleanly · 2020We have always been ambitious about what our site should do, and RIVER take on the hardest parts of it. They make it happen, no matter how complex.
Chris HartFounder, Real Groovy · 2021RIVER are responsive and always ready to adapt. We have never had to chase them, and their support has been critical as our needs changed.
Supriya Kulkarni-PadhyeM&E Coordinator, Oceania Football Confederation · 2020We love our new brand. It reflects who we are as a team and resonates with our customers. Thank you for bringing our vision to life.
Tracy BergeGM, Greentree Advisers · 2021