Banning AI pushed a police investigator onto Google Translate

New Zealand Police did not have a technology problem. It had a governance problem, and the result was predictable. Official documents show one investigator uploaded 350,000 lines of Chinese-language audio data into Google Translate, a consumer platform that is unsecured and not approved for police use.

The lesson for business owners is blunt. If staff have a real productivity need and no safe, sanctioned way to meet it, they will improvise. A written policy does not stop that. A usable tool does.

The tool worked, then it disappeared

The frustrating part is that police had already proven the upside. In the 2024 Operation Parade investigation into the killing of Shulai Wang, the Whisper AI system processed 250 hours of Mandarin audio across more than 2,500 files. It finished in 10 hours what would have taken a human translator about 750 hours and cost roughly $50,000.

That is a 75-fold time saving. No organisation under operational pressure walks away from a gain like that voluntarily.

But during a six-month trial running to March 2025, officers broke an explicit ban on using Whisper to transcribe English-language audio. Police responded by dumping the tool altogether, before restarting it in September 2025 with tighter controls: only trained, approved staff can use it, and its output cannot be used as evidence. The same reporting noted Whisper is 45 percent inaccurate on Maori and Pacific languages, so the tool was never a silver bullet.

The workload did not pause while management reconsidered. Investigators still had foreign-language intercepts to get through, and at least one reached for the free option in their browser.

Detective Inspector Stu Mills had warned that unless police adopted a permanent approved AI tool, investigators would turn to unsecured translation platforms. He called the breaches “unfortunate but not unexpected”. That is about as clear a description of a foreseeable failure as you will find in an official document.

A policy that switches on too late

Police are not short of paperwork on this. The force has an acceptable use policy for generative AI built around use being lawful, ethical, proportionate and safe. The catch is that it is framed around tools once they are approved. It says little that helps when nothing is approved and the job still has to be done.

Above that sits the Government Chief Digital Officer’s responsible AI guidance for the public service, published in February 2025, which urges agencies to run risk and impact assessments before adopting generative AI. Sensible advice. It did not stop an investigator defaulting to Google Translate.

Critics have pushed for more law. In 2023, University of Auckland commercial law academic Alex Sims argued that police AI principles were “both voluntary codes, leaving significant gaps” and that New Zealand should follow Europe’s lead with AI regulation. The accountability concern is fair. But this breach was not caused by a missing statute. It was caused by an organisation that pulled a working tool without putting a safe replacement in staff hands. Another layer of legislation would not have translated a single intercept.

Most businesses have far less structure than this

Here is the uncomfortable comparison. Police had a dedicated genAI policy, internal reviews, trans-Tasman AI principles and whole-of-government guidance. Most New Zealand SMEs have none of that. If an organisation with that much scaffolding still ended up with sensitive data in a consumer app, the odds inside a typical 40-person firm are worse.

The legal exposure is not theoretical either. Back in 2023, then-Privacy Commissioner Michael Webster told the EMA that “if you’re using AI in your business then it’s your responsibility” to stay within the Privacy Act. He urged leadership sign-off and a Privacy Impact Assessment before any AI use. Paste client contracts, HR files or customer records into a free chatbot, and the business, not the employee, owns the breach.

Give staff a safe tool or they will pick an unsafe one

The practical fix is not complicated, and it is mostly about speed.

• Procure before you prohibit. Banning a tool without offering a sanctioned alternative simply moves the risk somewhere you cannot see it.
• Pay for enterprise versions. Business-tier AI products typically offer data protection terms that free consumer apps do not. The licence fee is cheap insurance.
• Write rules for the gap. Say plainly what staff can do while a tool is under review, not just after it is approved.
• Keep a human in the loop. Police now bar Whisper output from being used as evidence. Businesses should treat AI output on contracts, compliance and customer advice the same way.

The police episode is a warning about bureaucratic drift, not runaway technology. The productivity case for AI is real, and staff know it. Leaders who respond with slow procurement and blanket bans are not managing risk. They are outsourcing it to whatever free website an overworked employee finds at 4pm on a deadline.

Sources

• NZ Herald: Police AI: Investigator uploads 350,000 lines of audio in risky workaround (2026-10-18)
• RNZ: Police AI: Investigator uploads 350,000 lines of audio in risky workaround (2026-10-19)
• RNZ: Police use of AI restarted after officers used unapproved models (2026-06-17)
• NZ Police: Acceptable Use of Generative AI (genAI) Policy
• Government Chief Digital Officer: Responsible AI Guidance for the Public Service: GenAI (2025-02)
• University of Auckland: Unravelling the implications of AI in policing (2023-10-16)