Training staff: the five habits

A written AI policy only protects you if the people using AI tools know what it asks of them. This lesson gives you five habits to teach every staff member and volunteer, and a simple way to teach them in one short session. You can run that session this month without any technical background.

The idea: habits beat rules

Most people will not read a policy document more than once. They will remember a few simple habits, especially if they practiced them on real examples from their own work. So instead of asking staff to memorize a policy, give them five habits that cover most of the risk.

Each habit answers a question someone faces in the moment: Which tool should I use? Can I paste this? Is this answer right? Can I trust what the assistant is reading? What do I do if something went wrong?

Habit 1: use approved tools with work accounts

Staff should use only the AI tools your organization has approved, and sign in with their work account.

This matters because a personal account on a free plan sits outside your organization’s settings and contracts. Any protections you arranged with a vendor, such as how long data is kept or whether it is used for training, may not apply to someone’s personal login. When staff quietly use their own accounts for work, that is often called shadow AI. It is usually well meant: people are trying to get work done. The fix is to make the approved tool easy to reach and to explain why it matters.

Habit 2: check before you paste

Before pasting anything into an AI tool, staff should pause and ask: does this text contain anything from our restricted list?

Your restricted list should include things like:

• Donor or client names together with gift amounts
• Case notes
• Health details
• Payment details
• Passwords

If the answer is yes, they either remove that information first or do not use the tool for that task. A donor thank-you letter can be drafted without the donor’s real name and gift amount, and the details filled in afterward. If you have not yet written your restricted list, the AI acceptable use policy template gives you a starting point.

Habit 3: check every output before it leaves

A person reads and corrects every AI output before it is sent, published or shared outside the team.

AI tools can state wrong facts with full confidence. This is called hallucination. They can invent references that do not exist, and they often get names, dates and numbers wrong. The writing sounds polished, which makes mistakes easy to miss. Teach staff to check the parts that would cause harm if wrong: figures, names, quotes, dates and any claim a funder or the press might repeat.

Habit 4: treat outside content as untrusted

When staff give an AI assistant an email, a web page or a document from outside the organization, they should treat that content as untrusted.

Outside content can contain hidden instructions written for the AI, not for the person. This is called prompt injection. For example, a web page might contain invisible text telling the assistant to ignore its instructions and do something else. Most of the time, the worst result is a strange or wrong answer. The risk grows when the assistant can also act on your behalf: send messages, edit files or browse the web. Teach staff to be especially careful with assistants that both read outside content and take actions, and to stop and check if the assistant suggests something unexpected.

Habit 5: report mistakes fast

If something sensitive went into the wrong tool, or an AI output caused a problem, staff should tell the named person the same day.

Two words in that sentence matter. “Named” means everyone knows exactly who to tell, by name, not “IT” or “management.” “Same day” means problems are caught while they are still small. And reports must be met without blame. If people fear getting in trouble, they hide mistakes, and hidden mistakes are the ones that grow.

A worked example from a small organization

Here is an illustration of how one session might open. It is an example, not a real case.

The office manager of a small community charity starts the monthly staff meeting with a slide. On one side is a page from last quarter’s board paper. On the other is a summary of that paper made by an AI assistant. She asks the team: “One number in the summary is wrong. Can you find it?”

It takes the group a few minutes. The board paper says the food program served a certain number of families, and the summary gives a different figure. The summary is otherwise clear and well written, which is the point: nothing about it looks wrong.

The office manager then asks what would have happened if the summary had gone straight into the newsletter. Someone says a funder might have quoted the wrong number. That leads naturally into Habit 3, and the team remembers it because they found the error themselves.

She uses the same approach for the other habits: a short real example, a question to the group, and a minute of discussion. The whole session takes about 40 minutes.

Steps to run your training session

You do not need a trainer or slides. Here is a simple plan.

Before the session

1. Name the person for reports. Decide who staff tell when something goes wrong, and confirm that person agrees.
2. Confirm the approved tools. Make a short list of which tools staff may use and how they sign in with work accounts.
3. Collect real examples. Find one example from your own work for each habit. An AI summary with an error, a document that would have broken the restricted list, a suspicious email. Remove any sensitive details from the examples themselves.
4. Make a one-page handout. List the five habits, the approved tools, the restricted list and the name of the person for reports. Keep it to a single page so people will actually keep it.

During the session

Plan for 30 to 45 minutes. A simple structure:

• 5 minutes: explain why you are doing this. Keep it about protecting the people you serve, not about rules.
• 25 to 30 minutes: go through the five habits, one real example each. Ask the group questions rather than lecturing.
• 5 to 10 minutes: hand out the one-page sheet and answer questions. Ask what tools people are already using, and listen without judgment.

Include volunteers. They often handle donor and client information and may use personal devices and accounts.

After the session

• Put the handout where people will see it, both printed and in a shared folder.
• Schedule a refresher whenever your approved tools or your policy change. A new tool or a new feature, such as an assistant that can send email, is a good reason to revisit Habit 4.
• Add the handout to your onboarding for new staff and volunteers.

Common mistakes

Making it a lecture. People remember what they figured out themselves. Use questions and real examples.

Using made-up examples. Generic examples feel like someone else’s problem. Examples from your own reports, letters and emails stick.

Leaving the reporting person vague. “Tell someone” does not work. Put a name on the handout.

Punishing the first report. If the first person who admits a mistake is criticized, nobody will report again. Thank them, fix the problem and move on.

Banning everything. If the approved tools are hard to use or nothing is approved, staff will turn to personal accounts. Give them a safe option that works.

Training once and forgetting. Tools change quickly. A short refresher when things change keeps the habits current.

Try it this week

Set aside 15 minutes and write the five habits on one page, in your organization’s own words. Under each habit, add one example from your work. For instance, under “check before you paste,” you might write: “Do not paste the donor database export. Remove names and gift amounts first.”

Share the page at your next team meeting and ask for one improvement from each person. That draft becomes your handout.

Key takeaways

• Five simple habits cover most AI risk better than a long policy staff will not read.
• Staff should use approved tools with work accounts, check before they paste, and check every output before it leaves.
• Outside content can carry hidden instructions, so take extra care with assistants that can act on your behalf.
• Mistakes should be reported to a named person the same day, without blame.
• A 30 to 45 minute session with real examples and a one-page handout, refreshed when tools or policy change, is enough to get started.