This lesson gives you a one-hour review to run every 3 months. It keeps your AI tools, their settings, your policy and your staff training in step with what is actually happening in your organization. The work you have done so far in this course only stays useful if someone checks it regularly, and this week is a good time to put that check in the calendar.

Why every quarter

The choices you made when you first set up your AI tools were right for that moment. They do not stay right on their own. Three things change underneath you.

Vendors change their plans, settings and policies. A plan that kept your data out of model training last spring may have new terms now. A setting you switched off may have been renamed, moved or reset. Vendors often announce these changes in an email that nobody reads.

Staff start using new tools. Someone finds a handy transcription app, a volunteer signs up for a free writing assistant, a board member forwards a link to a new chatbot. Tools used at work without anyone approving them are called shadow AI. It is rarely done in bad faith. People are trying to get their work done.

New vulnerabilities are published. If your organization runs any AI software itself (for example a chatbot on your website or a tool a developer installed on a shared computer), security problems in that software are found and published over time. Each one usually comes with a fix, but the fix only helps if someone applies it.

None of these changes is dramatic on the day it happens. The risk is drift: small gaps that add up until a donor list ends up somewhere it should not be. A short review every quarter catches drift while it is still small and easy to fix. Once a year is too long a gap. Once a month is more than most small organizations can keep up.

A worked example

Here is an illustration of how a review can pay off. It describes a made-up organization, not a real case.

A small museum has 6 staff and a group of regular volunteers. A year ago, the office manager set up a paid workspace with an AI writing tool, turned off training on the organization’s content, and wrote a one-page policy.

At the quarterly review, the office manager starts by asking everyone which AI tools they used in the last 3 months. Two volunteers mention they have been using the same writing tool, but on their own free accounts, because they were never added to the paid workspace. They have been drafting exhibit labels and a few donor thank-you letters.

The office manager checks the vendor’s data-use page for the free plan. It now says that content on the free plan is used for training by default. That was not true, or at least not clear, when the museum first chose the tool.

The fix takes about 15 minutes. The office manager adds both volunteers to the paid workspace, asks them to stop using their free accounts for museum work, and adds a line to the training handout: “Use the museum’s workspace, not a personal account, for anything to do with the museum.” The one-page record notes what was found and what changed.

Without the review, those two volunteers would have kept using personal accounts for months, with donor names in the text.

The one-hour agenda

Work through these 7 items in order. For a small organization, most of them take 5 to 10 minutes.

1. Re-inventory your tools

Ask staff and regular volunteers one plain question: “Which AI tools have you used for work in the last 3 months, including free ones and browser add-ons?” A short message a few days before the review works well. Make it clear that honest answers will not get anyone in trouble.

For each new or unapproved tool, decide one of three things: approve it (and set it up properly), replace it with an approved tool that does the same job, or stop using it. Write the decision down.

2. Check each approved tool

For every tool on your approved list, confirm that what you set up is still true:

Open the vendor’s data-use or privacy page and look for changes since your last review. If you use the tool profiles on our tools page, check the “Verified on” date to see how recently we confirmed the details.
Log in to the admin settings and confirm that training on your content is still off, that data retention is still set the way you chose, and that admin controls (such as who can invite new users) are still in place.

If anything has changed, decide whether you can set it back, need a different plan, or need a different tool.

3. Check AI software you run yourself

Skip this step if you only use tools through a website or app that the vendor runs. If you run any AI software yourself, ask whoever looks after it to:

Look at recent advisories and the vulnerabilities list for that software.
Confirm that available updates were actually applied, not only downloaded.

To make this easier between reviews, you can subscribe to advisories by product through an RSS feed, so new problems reach you as they are published.

4. Review accounts and access

Compare the list of people with access to each tool against your current staff and volunteer list. Remove anyone who has left. Check that only the people who need admin rights have them.

If any tool uses an API key (a password-like code that lets software connect to the tool), rotate it: create a new key, update wherever it is used, and delete the old one. This matters most when someone who knew the key has left.

5. Read the incident log

Read through anything recorded since the last review, including near misses: the time someone almost pasted a client file into a chatbot, or an AI-made email draft that nearly went out with wrong facts. Near misses show you where your policy or training is unclear before a real problem happens.

6. Update the policy, the approved list and the handout

Turn what you found into changes on paper. Update the approved tools list, adjust the policy where it was unclear, and add any new guidance to the staff training handout. Small, specific changes are better than a full rewrite.

7. Note upcoming regulatory dates

Rules about AI and data are still developing, and some may apply to you depending on where you work and who you serve. Note any dates you are aware of that are coming up, and who will look into them. You do not need to become an expert. You need to avoid being surprised.

How to keep it to an hour

A review that takes a whole afternoon tends to get postponed and then forgotten. Four habits keep it short and regular:

A named owner. One person runs the review and makes sure it happens. Others can help, but one name goes on the invitation.
A fixed date. Put all 4 reviews for the year in the calendar now, as recurring meetings.
A one-page record. After each review, write down what was checked, what was found and what changed. Next quarter, start by reading the last page.
A two-line summary. Send staff and the board a short note after each review, for example: “Quarterly AI review done. Two volunteers moved to our paid workspace; no other changes.” This keeps people informed and reminds everyone that the policy is real.

For a fuller list of controls to check once you have the habit going, see our AI security checklist for small organizations.

Common mistakes

Only checking the tools you already approved. The biggest risks are often the tools nobody told you about. Always start with the staff question.

Trusting your memory of the settings. Log in and look. Settings can be changed by a vendor update or by another admin.

Treating near misses as non-events. If something almost went wrong, that is useful information. Log it and talk about it.

Letting accounts pile up. Former staff and volunteers with live access are an easy gap to close and an easy one to forget.

Making the review too big. If you try to fix everything in one session, it will run over and you will skip the next one. Note larger problems, give each one an owner, and move on.

Keeping the results to yourself. If staff never hear what the review found, they will not see why their answers matter.

Try it this week

Set aside 15 minutes and do three things:

Create a recurring calendar invitation for your first quarterly review, 1 hour long, repeating every 3 months.
Copy the 7-item agenda from this lesson into the invitation.
Write the owner’s name at the top of the invitation, and invite them if it is not you.

That is all. When the date arrives, the agenda is waiting for you.

Key takeaways

Your AI setup drifts over time because vendors change terms, staff adopt new tools and new vulnerabilities are published.
A one-hour review every quarter catches that drift while it is still small and easy to fix.
Start each review by asking staff what they actually use, then check settings, updates, accounts and the incident log.
Give the review a named owner, a fixed calendar date and a one-page record of what changed.
Send staff and the board a two-line summary after every review so the policy stays visible.

Keeping it current: a quarterly review