A Nonprofit AI Policy Staff Can Actually Use

Your team does not need permission to be curious about AI. It does need clear answers before someone pastes a donor list into a new tool, relies on an AI-generated answer in a grant application or lets an automated workflow contact a supporter.

A useful policy tells people what they can try, what needs review and where to ask for help. It also names an owner who can update those answers as tools and the organization’s needs change.

Start with the task and the information

Compare two requests. A staff member asks an approved tool to suggest headings for a public event announcement. Another wants help summarizing confidential case notes. Both involve text, but the information, potential harm and review needed are very different.

Before using a tool, ask: Is the information public, internal or sensitive? Has the organization approved this tool and this use? Does the vendor’s handling of data fit the organization’s agreements and privacy requirements? If staff cannot answer, they should know whom to ask before entering the information.

Decide what people must approve

Use cases should have a named owner and an approval path suited to their risk. A person might use AI to brainstorm or draft, then check the result before sharing it. Decisions about eligibility, services, financial commitments or sensitive relationships need accountable human judgment and the organization’s established review process.

For external communication, decide who checks the facts, the tone and the recipient before anything is sent. An AI-generated citation is a lead to investigate, not proof that the cited source supports the statement.

Make room for uncertainty and mistakes

Tell staff how to report an incorrect output, accidental disclosure or unexpected action. Record the use case, affected information, owner and response. Make it possible to pause a workflow while the organization investigates and corrects the problem. Review incidents for patterns, not just individual mistakes.

Keep a short record of each use case

For each approved use, document the purpose, tool, information involved, owner, reviewers, permitted actions and date for reassessment. Start with a few common jobs and test the policy with the people doing them. If a rule is unclear in practice, improve the rule.

The free nonprofit AI policy template provides a starting point for those decisions. Adapt it to your organization’s data, people, agreements and responsibilities, and involve the appropriate privacy, legal and operational leaders.