Workflow automation in NZ: what to automate first and how to do it safely

Most businesses have tasks that follow the same steps every time: copying details from emails into a job system, turning timesheets into invoices, building the same report each month. Done by hand, they take hours and invite mistakes. Workflow automation hands those steps to software, so your team gets the time back.

The technology is rarely the hard part. What matters is choosing the right process, building it to fail safely and keeping it running. This guide covers how to decide what to automate in your business, how to measure it, where AI fits, which tools to consider and what the Privacy Act 2020 means for all of it.

Signs a process is worth automating

Business process automation pays off when a task has most of these traits:

• Repetitive: it happens daily or weekly, in much the same way.
• Rules-based: you could write the steps as “if this, then that”, with few judgement calls.
• High volume: a few minutes saved each time adds up.
• Error-prone: re-keying names, numbers and codes causes mistakes that are slow to find.
• Cross-system: information moves by hand between tools that don’t talk to each other, such as email, spreadsheets, a CRM and your accounting software.

Typical candidates include entering supplier bills, invoicing completed jobs, sorting a shared inbox, sending reminders and compiling weekly reports. Leave tasks that are rare, different every time or mostly judgement for later.

To pick a first project, business.govt.nz’s AI guidance suggests listing 5–10 tasks that take longer than they should or feel repetitive, then picking one with low cost, low risk and a clear benefit if it improves.

Map the process and count the hours

Before automating anything, write down how the work really happens, not how the manual says it should. Sit with the person who does it, walk through a few real examples and capture:

1. The trigger: what starts it, such as an email, a form, a finished job or a date.
2. The steps: who does what, in which system.
3. Decisions and exceptions: the judgement calls, and what happens when information is missing or wrong.
4. The result: what “done” looks like, and who relies on it.

Allow an hour or two per process. Then measure for a week or two: count how often the task happens and roughly how long each one takes, and multiply. For example, 150 supplier bills a month at six minutes each is 15 hours of someone’s time every month. Note errors too, and the time spent fixing them. This baseline shows which process to tackle first, and what to measure the result against.

Quick wins versus bigger builds

Start with a quick win: it proves the value and builds confidence.

Quick wins use features you already pay for, or one simple connection between two tools: bank rules in your accounting software, email rules, automatic payment reminders, or website enquiries added to your CRM with an alert to the right person. These can often be set up in hours or days, and are easy to switch off.

Bigger builds join several systems, handle exceptions or read unstructured information such as PDFs and emails: turning site notes into quotes, say, or processing orders that arrive in every format. They take weeks rather than days, need testing against real examples and need someone to look after them.

If AI is part of the plan and you have 50 or fewer full-time equivalent staff, the Government’s AI Advisory Pilot can co-fund up to half the eligible cost of an AI roadmap and its implementation, through approved providers until 30 June 2027. It doesn’t fund projects already under way. Our AI Advisory Pilot guide explains who qualifies.

Where AI helps, and where it shouldn’t decide alone

Rules-based automation is dependable but needs tidy, predictable inputs. AI stretches it to messier work: reading invoices and forms, sorting email by what each message is about, and drafting replies, quotes and summaries for a person to check.

Look for tools that tell you how sure they are. Microsoft’s invoice processing model in AI Builder extracts fields such as the invoice number, date and amount due, each with a confidence score. On some plans, Xero’s AI feature, JAX, reconciles bank transactions automatically only when it’s highly confident they match, and otherwise suggests a match for you to check. Design your automations the same way: confident results flow through, uncertain ones go to a person.

MBIE’s Responsible AI Guidance says a person should always be involved when AI helps make big decisions, such as those about money, health or the law. Business.govt.nz advises keeping people in the review process, especially when work affects customers, staff, pricing, eligibility or finances, and using AI for drafts and suggestions rather than final decisions or approvals. Let AI draft the refund email; have a person approve the refund.

Make those reviews real: people can over-rely on automated outputs and accept them without proper checking, which MBIE calls automation bias. And keep permissions tight, because AI that reads outside content, such as files or web pages, can be tricked by instructions hidden in it (prompt injection).

Unsure whether you need an automation, a chatbot or an agent? See our guide to AI agents vs chatbots vs automation.

Common tools, and how to choose

You may be able to start with tools you already have. These are examples, not recommendations:

• Microsoft Power Automate comes in a basic form with Microsoft 365 work accounts, at no extra cost; premium connectors and AI Builder need a paid licence. It can also drive older desktop software, and its approvals step waits for a person to respond.
• Zapier connects thousands of apps without code. Each workflow, called a Zap, has a trigger that starts it and one or more actions that follow.
• Make does a similar job, also without code.
• Xero has built-in bank rules that treat similar transactions the same way every time, and its App Store lists apps that connect it to job, payroll, inventory and other systems.

Before you commit, check that the tool connects to every system in the process, what it will cost as volumes grow, and who can maintain it.

Privacy, security and human review

Automations often move personal information about customers and staff. The Privacy Commissioner’s guidance treats “systems that interpret data or automate tasks” as AI, and its starting point is that the Privacy Act applies to everyone using AI tools in New Zealand. For generative AI, the Commissioner also expects a person to review outputs before you act on them.

• You stay responsible. When a provider stores or processes personal information for you, you remain responsible for it. Check whether it uses your data for its own purposes, such as training AI.
• Keep personal information out of tools that reuse it. The Commissioner advises against entering personal or confidential information into a generative AI tool unless the provider has explicitly confirmed it isn’t retained or disclosed. Use business plans, switch off training on your data, and pass on only the fields each step needs.
• Know where data goes. Business.govt.nz suggests treating personal information stored or processed offshore as higher risk, with extra supplier checks and tighter settings.
• Lock down access. Use business accounts, turn on multi-factor authentication for the platform and every account it connects to, and give each connection only the access it needs.
• Plan for breaches. If a privacy breach has caused or is likely to cause serious harm, you must notify the Privacy Commissioner and the people affected as soon as you practically can. Make sure your providers will tell you quickly.

Any business handling personal information must also have a privacy officer. For rules on staff use of AI tools, see our AI policy template.

Measure results and avoid common mistakes

After a month or two of normal use, compare the automated process with your baseline:

• Time: hours saved, measured rather than estimated.
• Quality: errors, rework and how many cases go to a person.
• Speed: time from trigger to done, such as job to invoice.
• Running costs: subscriptions, usage charges and time spent looking after it.

If the numbers don’t stack up, fix the automation or switch it off.

Common mistakes to avoid:

• Automating a broken process. Automation makes a messy process faster, not better. Cut unneeded steps and agree the rules first.
• No owner. Every automation needs a named person who checks it, fixes it and approves changes.
• No monitoring. Automations can fail quietly when a password changes, an app updates or a form gains a field. Set up failure alerts and check run histories. Some safeguards are opt-in: Make, for example, only keeps failed runs for retrying if you switch that on.
• Building on one person’s login. Use business accounts with more than one administrator, and document how each automation works.

Where to start

Pick one repetitive process, map it, measure it, then automate it with people in control where judgement matters. If you’d like help with the first one, our workflow automation service maps the process, builds around your existing tools and measures the time saved. To see where you stand first, try the free AI readiness check or book a free 30-minute consultation.