Legal and accountability — what you actually own

Working with Claude — CC BY 4.0

Most of the legal worry about business AI comes from one mistake: treating a capable tool as if it were a second party in the room — someone who shares the authorship, the responsibility, the risk. It isn’t. There’s one party who stands behind the work, and it’s you. That’s the reassuring part and the demanding part at once. This lesson is a checklist for using AI in a real business without the surprises.

Read this first: this is general education, not legal advice. It sets out the shape of the ground so you know what to ask. For anything load-bearing in your business — a contract, a customer promise, a compliance question — get advice from a qualified lawyer in your jurisdiction. The law differs between New Zealand and Australia at several edges flagged below, and there is not yet a decided NZ or AU case squarely on AI-generated content, so treat these as settled-by-analogy positions, not the last word.

1. You own the output — full stop

• Whatever you send, you authored. In law, the maker of a message is the person who adopts and issues it, not the tool that helped draft it. You’re no more sharing authorship with Claude than a writer shares it with a word processor, or a firm with its precedent bank.
• “The AI wrote it” is not a shield. It won’t reduce your responsibility for a single word. Plan your workflow on the basis that everything the tool produces is yours the moment you use it.
• Review is the whole discipline. The one genuinely new risk is that a fluent tool makes it easy to ship work you haven’t actually checked. The old answer still holds: review what you send, own what you sign.

2. The AI is not a director, agent, or party

• No AI has legal personhood anywhere. It cannot be a company director (the law requires a natural person — NZ Companies Act 1993 s151; AU Corporations Act 2001 s201B), cannot sign a contract in its own name, cannot be sued, cannot “stand behind” anything.
• But its output still binds you. Automated output binds the human or company behind it (NZ Contract & Commercial Law Act 2017 Pt 4; AU Electronic Transactions Act 1999 s15C). The AI is the instrument; your business is the party. There was never a second guarantor to point to — capability is not agency.

3. Misleading conduct — the liability that’s already yours

• It’s strict and technology-neutral. If an AI-assisted communication misleads a customer, the liability is yours, exactly as if a staff member had drafted it (NZ Fair Trading Act 1986 s9; AU Australian Consumer Law s18). Regulators in both countries have confirmed existing law applies to AI output.
• Check claims before they go out. Prices, specifications, testimonials, comparisons, certifications, availability — a plausible-sounding but wrong claim from the tool becomes a false claim from you the moment you publish it. Watch especially for confident superlatives and unqualified promises the tool adds on its own. Run sales and marketing copy through the same fact-check you’d give a new hire’s first draft.

4. Disclosing that you used AI

• There’s no general duty to disclose AI use in ordinary business communications, in NZ or AU. You’re not obliged to badge every AI-assisted email or document.
• But specific rules bite in specific contexts — some professional and court settings, and some newer transparency and automated-decision rules (which differ by jurisdiction and have their own commencement dates). If you operate in a regulated field, or make automated decisions about people, or touch the EU market, check whether a disclosure rule applies to you. Counsel-check before you rely on “no duty”.

5. Copyright of what you make — and the NZ/AU split

• AI-assisted, human-directed work is protected in both countries. When you direct, select, edit and shape the output, the result is your copyright work in NZ and AU alike. This covers most real business use.
• Purely AI-generated output is where they diverge. NZ’s Copyright Act 1994 s5(2)(a) treats the “person who made the arrangements” as the author of a computer-generated work, so purely-AI output may be protected. Australia requires a human author, so purely-AI output is likely unprotected there. If protecting a specific asset matters to you, keep a record of your human authorship — your prompts, choices and edits.
• A Tiriti / Māori-data flag: where work engages mātauranga Māori or Māori data, standard copyright rules don’t settle the questions of custody and control. Raise it early with the right advice, not as an afterthought.

6. Data, privacy and who can reach it

• Don’t paste confidential or privileged material into public tools. Doing so can breach privacy obligations (NZ Privacy Act 2020 IPP 12; AU Privacy Act 1988 APP 8) and, for legal material, waive privilege. Australia’s regime is stricter on cross-border transfers — s16C can make the AU entity liable for an overseas recipient’s breach.
• Know where the data lives and who has authority over it. A US-headquartered vendor can be reached by the US CLOUD Act (2018) regardless of which country the data is physically stored in. For sensitive or regulated data, that reach is the question to ask before you choose a tool — not where the servers sit, but who ultimately controls access.
• Minimise by default. Strip names, client identifiers and commercially sensitive detail before a tool sees them, unless you’ve confirmed the tool and its terms are fit for that data.

The through-line

None of this is a case against using AI. Used with review and custody, it increases your accountability rather than diluting it — you direct the work, you check it, you own it, and the tool never becomes a party you have to reason around. Keep the judgment with you, keep the record of your authorship, and get real legal advice for the specifics that matter to your business.