Nonprofit AI Policy Template

AI use policy: working draft

Complete the fields and follow your organization's approval process before adoption.

Document control

Organization: [NAME]
Policy owner and contact: [ROLE / CONTACT]
Approving authority: [ROLE / BODY]
Effective date: [DATE] Review date: [DATE]
Status: DRAFT - NOT YET APPROVED

1 / Purpose and scope

[ORGANIZATION] uses AI to support its mission while protecting people, information, and work quality. This policy covers staff, volunteers, contractors, and others using AI for organizational work, including use through personal accounts.

2 / Approved tools and uses

Only tools and accounts listed in [TOOL REGISTER LOCATION] may be used for organizational work. Each approval specifies the purpose, permitted data, owner, required settings, and review date. Approval for one use does not authorize every use. Staff request new uses through [REQUEST PROCESS].

3 / Data boundaries

Use public, fictional, or specifically approved non-sensitive information within the tool register limits. Confidential, personal, health, financial, donor, employee, or service-recipient information requires separate documented review and explicit authorization for the specific tool, account, data, and use. Removing names alone is insufficient.

Responsibility and release

Continuation of the draft policy.

4 / Prohibited uses

Do not enter passwords, authentication codes, or account secrets. Do not fabricate evidence, impersonate people, or present generated text as a real person's quote or experience. Do not make consequential decisions about individuals using AI alone. Automated external actions require separate approval.

5 / Human review and disclosure

The staff member responsible for the work verifies facts, sources, rights to use material, tone, accessibility, and potential bias before use. AI output is not an authoritative source. Follow [DISCLOSURE RULE / OWNER] and applicable funder, contract, and publication requirements for disclosure of AI assistance.

6 / Training and access

Before use, staff complete [ORIENTATION] covering data boundaries, verification, reporting, and tool limits. [TOOL OWNER] manages access and required settings. New integrations, connected data sources, and autonomous actions require approval through [PROCESS].

7 / Reporting concerns

Promptly report suspected disclosure, harmful output, unauthorized use, or unexpected automated actions to [CONTACT / CHANNEL]. Stop the affected activity, preserve requested facts, and follow the organization's response process. Deleting a chat alone may not resolve a disclosure.

8 / Records, exceptions, and review

Store final work and required records in [LOCATION] under [RETENTION RULE]. [POLICY OWNER] documents exceptions before use, with scope and expiry. Review on [DATE] and after material tool changes or incidents.

Approved-tool register

Complete one record for each approved tool, account, and use.

Register entry

Tool and provider: ______________________________________________
Account / plan / environment: ___________________________________
Approved purpose: _____________________________________________
Permitted data: ________________________________________________
Prohibited data / uses: __________________________________________
Owner and authorized users: ____________________________________
Required settings and integrations: ______________________________
Approval record/date: __________________________________________
Review date / expiry: ___________________________________________

Review evidence

Record where the reviewer documented vendor terms, retention/deletion, training use, access controls, integrations, and incident support. Do not paste secrets or unnecessary personal data into the register. A general vendor claim does not establish approval for every plan or use.

Fictional example

Approved use: rewrite published event announcements using the organization's designated account. Permitted data: public event text. Excluded: donor details, internal plans, client records, and automatic publication. Reviewer: communications lead. Review date: set by the approving authority.

Exception record

Requested use and reason: _____________________________________
Risks and controls: ______________________________________________
Approver, scope, expiry, and review: ______________________________

Adoption and staff acknowledgement

This template needs organization-specific review. It does not establish legal compliance.

Adoption checklist

[ ] All placeholders completed and tool register available.
[ ] IT/privacy and relevant leadership reviewed the draft.
[ ] Existing records, security, HR, and program policies reconciled.
[ ] Reporting route and response owner confirmed.
[ ] Disclosure, retention, and exception processes defined.
[ ] Approving authority documented adoption.
[ ] Staff received the policy and orientation.
[ ] Review date and owner recorded.

Staff acknowledgement template

I received [POLICY TITLE / VERSION] and know where to find the approved-tool register. I understand that I must stay within approved uses, verify outputs, and report concerns through [CHANNEL]. Questions may be directed to [CONTACT].
Name/role: _______________________ Date: ______________________
Acknowledgement record location: ______________________________

Owner review record

Approved by: _____________________ Date: ______________________
Policy version: ____________________ Next review: ________________
Change summary: ______________________________________________