This lesson shows you how to choose AI tools for a small organization without needing a technical background. You start from the job you want done, compare tools on the same short list of questions, and keep a written list of the tools staff may use. Your staff are probably already trying AI tools on their own, so the sooner you have a way to say yes or no, the safer your data is.

The idea: start from the job, not the tool

Most people pick an AI tool because a friend mentioned it or an ad looked good. That puts the tool first and your data second. Turn it around.

Begin with the job. Typical jobs in a small office look like this:

Drafting letters, grant reports or newsletters
Summarizing meetings
Translating flyers or messages for families
Analyzing a spreadsheet of program results

For each job, write down what kind of data it involves. A newsletter draft might contain nothing private. A meeting summary might include names of clients, health details or staff issues. A spreadsheet might hold donor addresses and gift amounts. The type of data decides how careful you need to be, and it gives you a standard to measure each tool against.

Compare every tool on the same fields

Once you know the job and the data, look at a few candidate tools and check each one on the same fields:

Training on your data by default: does the vendor use what you type to improve its AI models unless you say no?
Opt-out: if training is on by default, can you turn it off, and who can turn it off (each user, or an admin for everyone)?
Retention: how long does the vendor keep what you type and upload, and can you delete it?
Admin controls: can one person in your organization manage accounts, settings and access?
Certifications the vendor publishes: for example a SOC 2 report or ISO 27001 certification. These show that an outside party has reviewed the vendor’s security practices.
Data region: in which country or region is your data stored and processed?
Free versus paid plans: do any of the answers above change depending on the plan?

Here is the rule that matters most: if the vendor does not document a field, that is a question to ask, not a pass. Silence is not the same as a good answer. Our guide to questions to ask AI vendors gives you wording you can send by email.

The plan matters as much as the tool

The same tool can behave quite differently depending on the plan. A business or team plan usually adds admin controls and contract terms, such as a data processing agreement, which sets out in writing how the vendor handles your data. The free plan of the same tool may handle data differently, and you may have no contract at all.

So before you judge a tool, decide which plan you would actually use. If you will only ever pay for the free version, judge the free version. Do not read the business plan’s promises and assume they apply to a free account.

Tools you install and run yourself

Some AI software is not a service you sign up for. It is something your organization installs and runs on its own computers or server, such as an open-source tool or a self-hosted chat interface. These can be a good choice, but they come with a different question: who keeps it safe?

For these tools, check two things. First, look at the tool’s record of security advisories, the public notices about security problems found in it. You can search our vulnerabilities pages for tools we track. Second, make sure someone will keep it updated. Software that nobody patches gets less safe every month.

A worked example: choosing a meeting note-taker

This is an illustration, not a real organization.

A small youth charity holds weekly staff meetings where people discuss individual young people, safeguarding concerns and family situations. The office manager wants an AI note-taker so nobody has to type minutes. Two tools look promising. She writes down the job (summarizing meetings) and the data (names of minors, sensitive personal details). That tells her this is a high-care job.

She compares the 2 tools on the paid plans the charity would actually buy:

Field	Tool A, paid plan	Tool B, paid plan
Training on your data by default	Excluded on this plan	Not documented
Opt-out	Not needed	Each user must find a setting
Admin controls	Admin can control who may record	No central control over recording
Retention	Documented, admin can delete	Not documented
Certifications published	Lists an outside security report	None found
Data region	Stated	Not stated
Free versus paid	Free plan handles data differently	Same terms for both

Tool B is cheaper and some staff like its interface. But it leaves several fields blank, and she treats each blank as a question. She emails the vendor and gets vague replies. Tool A’s paid plan excludes the charity’s data from training and lets an admin decide who can record meetings, which matters a great deal when minors are discussed.

She picks Tool A on the paid plan. She also notes that the free plan of Tool A handles data differently, so staff must not sign up for free accounts on their own.

The steps to take

1. Write down the job and the data

Pick one task. Describe it in a sentence and list what kind of information goes in. Be honest: if someone might paste in a donor list, write that down.

2. Shortlist a few tools and fill in the fields

Use the fields above for each candidate. Our tools pages may already have some of this filled in. Mark anything undocumented as “ask the vendor.”

3. Decide on the plan

Choose free, team or business before you compare. If the job involves sensitive data, a plan with admin controls and a data processing agreement is usually worth the cost.

4. Run a short pilot

Before you roll a tool out to everyone, try it for a few weeks with non-sensitive data only. Give the pilot a single named owner, a person who sets it up, watches how it goes and reports back. “The team” is not an owner.

5. Add it to your approved tools list

Keep a simple list, in a spreadsheet or a shared document, with these columns:

Tool
Plan
Owner
Data allowed (for example “public information only” or “internal documents, no client names”)
Date checked

Then tell staff plainly: tools not on this list are not to be used with work data. This is how you reduce shadow AI, the AI tools staff use without anyone in charge knowing. A clear list with a route to request new tools works better than a blanket ban, because people have a sanctioned option.

Common mistakes

Choosing the tool first. If you start from a tool you like, you will find reasons to keep it. Start from the job and the data.

Treating silence as a yes. A vendor that does not say whether it trains on your data has not told you it doesn’t. Ask, and wait for a clear answer.

Judging the wrong plan. Reading the business plan’s terms while staff use free accounts gives you false comfort. Check the plan people actually use.

Installing software and forgetting it. Self-hosted tools need someone to watch for security advisories and apply updates. If nobody will, choose a managed service instead.

Skipping the pilot. Rolling out straight to everyone means the first mistakes happen with real data. A small pilot with test material costs little.

Keeping the list in one person’s head. If the approved list is not written down and shared, staff cannot follow it, and it disappears when that person leaves.

Never rechecking. Vendors change their terms. The “date checked” column reminds you to look again, for example every 6 months or when a vendor announces changes.

Try it this week

Set aside 15 minutes.

Ask your staff, by email or at your next meeting, which AI tools they use for work today, including free ones on personal accounts. Make it clear nobody is in trouble; you want an honest list.
Write every tool in a list, with the plan each person uses.
Sort the list into 3 groups using the fields from this lesson:
- Approved: you know the answers and they fit the data people use it with.
- Needs review: important fields are blank or unclear. Send the vendor your questions.
- Stop using: the tool trains on your data with no opt-out, or people use it with data it should not see.
Tell staff the result and name who owns the list.

Key takeaways

Start from the job and the type of data it involves, then look for a tool that fits.
Compare every tool on the same fields, and treat anything the vendor does not document as a question to ask.
Judge the plan you will actually use, because free and paid plans of the same tool can handle data differently.
Pilot new tools with non-sensitive data and a single named owner before rolling them out.
Keep a written approved tools list and make clear that unlisted tools are not used with work data.

Picking AI tools your organization can trust