This lesson shows you how to write a short AI acceptable-use policy that your staff and volunteers will actually follow. It matters this week because people in your organization are probably already using AI tools, with or without permission. A clear page of rules is the fastest way to stop sensitive data from ending up in the wrong place.

The idea: a policy is a set of decisions

An acceptable-use policy tells people what they may and may not do with a tool. For AI, many organizations start by writing a page of values: “We use AI responsibly,” “We respect privacy,” “We value transparency.” Those sentences are fine, but they do not tell anyone what to do at 4 p.m. on a Friday when a grant report is due.

A useful policy for a small organization fits on one or two pages. It makes a handful of clear decisions instead of restating principles. When a staff member wonders “Can I paste this into the chatbot?”, the policy should give them a yes or no in under a minute.

Here are the decisions your policy needs to make:

Approved tools. Which AI tools people may use for work, and on which plan (for example, the paid team plan, not the free personal version).
Data that never goes in. Donor records with gift amounts, client case notes, health information, payment details, passwords and other login credentials.
Data that goes in only with approved tools. Internal documents, draft reports, staff schedules and similar material that is not public but is not highly sensitive either.
Who approves a new tool. One named person or role, so requests do not get lost.
Human review. A person checks any AI output before it is sent, published or used to make a decision. AI tools can state wrong things with confidence.
Disclosure. When you tell people that AI helped produce something, such as a public report, a grant application or a letter to a client.
Work accounts only. Staff use accounts tied to the organization, not personal ones, so the organization can manage access and settings.
Reporting. How someone reports a mistake or incident, and to whom.
Ownership and review. Who owns the policy and how often it gets reviewed.

That is the whole skeleton. Everything else is wording.

Who the policy covers

Write it for everyone who handles your organization’s data, not only paid staff. That includes volunteers, board members and contractors. A volunteer who drafts thank-you letters from a donor spreadsheet needs the same rules as the development director.

Why plain words matter

People follow rules they understand. Use examples your staff recognize. “Do not enter sensitive personal data” is vague. “Do not paste client intake notes, even with the name removed” is clear. If your team calls the donor database by a nickname, use the nickname.

A worked example from a small organization

The following is an illustration, not a real case.

Picture a community health non-profit with 12 staff and about 30 volunteers. The director noticed that several people were using free AI chatbots on their phones to draft emails and summarize meeting notes. Nobody had asked permission, and nobody had said not to. This kind of unapproved use is often called shadow AI.

The director and the office manager spent an afternoon writing a one-page policy. The center of it was three lists:

List	What it means	Examples
Red	Never enter into any AI tool	Patient or client case notes, health information, donor records with gift amounts, payment details, passwords
Amber	Approved tools only, on the work account	Draft grant reports, internal meeting notes, staff rotas, volunteer training materials
Green	Any tool is fine	Published annual report, text from the public website, general questions with no organization data

Below the lists, the page said:

The approved tool is the organization’s team plan of one AI assistant, and everyone uses their work login.
The office manager approves any new AI tool. Send her the name and what you want to use it for.
Someone reads every AI draft before it goes out, checking facts, names and numbers.
If AI helped write a public document or a grant application, say so where the funder or reader would expect it.
If you put something from the red list into a tool by mistake, tell the office manager the same day. Nobody will be in trouble for reporting it.
The director owns this policy and reviews it every six months.

Then they held a 30-minute session at the monthly staff meeting, walked through the three lists with real examples, and pinned the page in the shared drive next to the approved tools list. Volunteers got the same page in their onboarding pack.

The result was not perfect, but people now had an answer when they asked “Can I use AI for this?”

Steps to take

You can write a first version in a week. Here is one way to do it.

Find out what people already use. Ask staff and volunteers, without judgment, which AI tools they use for work and what for. You cannot write useful rules without knowing this.
Choose your approved tools. Pick one or two, and decide which plan. Our tools pages can help you compare what different services do with your data.
Write your red, amber and green lists. Use your own data types and your own names for them.
Name the people. Decide who approves new tools, who receives incident reports and who owns the policy. Use roles if people change often, but make sure each role has a current holder.
Add the rules on review, disclosure and accounts. Keep each to one or two sentences.
Write the reporting rule so it feels safe. Say plainly that reporting a mistake will not get anyone punished. Problems you hear about on day one are much easier to fix than problems you find a month later.
Keep it to one or two pages. If it runs longer, cut principles and keep decisions.
Train and share. Run a short session, walk through examples and put the policy where people will find it, alongside the approved tools list. A policy nobody has read does not change behavior.
Set a review date. Put it in a calendar now.

If you want a starting point, our AI acceptable-use policy template follows this structure and leaves blanks for your own lists and names.

Common mistakes

Writing principles instead of rules. “We use AI ethically” does not help someone decide whether to paste a case note. Every line should answer a question a staff member might actually ask.

Making it too long. A ten-page policy gets filed and forgotten. If you need detail on a specific tool, put it in a separate how-to guide and keep the policy short.

Leaving out volunteers and board members. They often handle donor and client data, sometimes on their own devices. If the policy only mentions “employees,” they will assume it does not apply to them.

Banning AI completely. A total ban often pushes use out of sight, onto personal accounts you cannot see or manage. Approving a safe option usually works better.

Punishing people who report mistakes. If the first person who admits pasting donor data gets scolded in front of the team, nobody will report the next one. Thank people for reporting, fix the problem and move on.

No owner and no review date. AI tools change their features and terms often. A policy with no owner goes stale within a year.

Skipping the training. Emailing a PDF is not the same as explaining it. A short conversation with real examples is what makes the rules stick.

Try it this week

Set a timer for 15 minutes.

Write three headings: Red (never enter), Amber (approved tools only), Green (public information).
Under each, list the kinds of data your organization handles. Use the names your staff use. Aim for at least four items under red.
When the timer ends, send the lists to one colleague. Ask them one question: “For each item, is it clear which list it belongs on, and would you know what to do?”
Note any item they hesitated over. That hesitation shows where your wording needs an example.

These three lists are the hardest part of the policy. Once you have them, the rest takes an afternoon.

Key takeaways

A good AI acceptable-use policy for a small organization fits on one or two pages and makes clear decisions instead of restating principles.
Red, amber and green data lists give staff a fast answer to “Can I put this into an AI tool?”
The policy should cover volunteers, board members and contractors, and should require work accounts and human review of AI output.
Reporting a mistake must be easy and blame-free so problems come to light early.
Pair the policy with a short training session and the approved tools list, because a policy nobody has read does not change behavior.

Writing an AI acceptable-use policy