An AI acceptable-use policy tells your staff and volunteers which AI tools they may use, what information must never go into them, and who checks the results. You do not need a long document. The template below has 11 short sections with sample wording you can copy and fill in, and the finished policy should fit on one or two pages.
What the policy is for
People in your organization are probably already using AI tools, whether or not anyone approved them. Someone drafts a grant summary in a chat assistant. Someone else turns on a meeting note-taker. A volunteer pastes a donor list into a free tool to tidy up the formatting. Use that nobody has approved is often called shadow AI, and it is where much of the risk sits.
An acceptable-use policy does three jobs:
- It protects people. It keeps sensitive information about the people you serve, your donors and your staff out of tools that should not have it.
- It gives permission. Staff know where AI is allowed and helpful, so they do not have to guess or hide what they are doing.
- It sets a plan for mistakes. Everyone knows who to tell and how fast when something goes wrong.
For a small organization, the goal is clarity, not legal completeness. A short AI use policy for nonprofits that people actually read is worth more than a long one that sits unopened in a shared drive. If you want more depth on each decision, the course lesson on writing an AI acceptable-use policy goes further.
The template, section by section
Copy the sample wording below and replace anything in [square brackets] with your own details. Cut what does not apply to you. Keep the language plain, because your readers are colleagues and volunteers, not lawyers.
Purpose and scope
Say why the policy exists and who it covers. Spell out what counts as an AI tool, because many people do not think of a meeting recorder or a writing feature inside familiar software as AI.
This policy explains how [Organization name] uses AI tools safely. It applies to all staff, volunteers, board members, and contractors who handle our organization’s data. “AI tools” includes chat assistants, writing and design tools with AI features, meeting recorders and note-takers, and AI features built into software we already use, such as [examples].
Approved tools
List the tools people may use, or link to a list you keep up to date. For each tool, note the plan (free or paid) and what kind of data it may handle. Require work accounts. With a personal account, your organization has no control over the data and cannot remove access when someone leaves.
Only use the AI tools on our approved list: [link or list]. Always use your work account for work tasks, never a personal account.
A short table keeps the list easy to scan:
| Tool | Plan | Data it may handle |
|---|---|---|
| [Tool name] | [Free or paid plan name] | [Public information only] |
| [Tool name] | [Plan name] | [Internal documents without personal details] |
| [Tool name] | [Plan name] | [Data allowed] |
If you are still choosing tools, the tools section of this site can help you compare options.
Data rules
This is the most important section. Three tiers are easy to remember and easy to apply.
| Tier | Examples | Where it may go |
|---|---|---|
| Never enter | Donor records with gift amounts, client case notes, health information, payment details, passwords and other login credentials, anything about children | No AI tool |
| Approved tools only | Internal documents without personal details, such as [draft plans, meeting agendas] | Tools on the approved list |
| Free to use | Public information, such as published reports or text from your website | Any tool |
Never enter the following into any AI tool: [list from the “never enter” tier]. Internal documents that contain no personal details may be used only in approved tools. Public information may be used in any tool. If you are not sure which tier something belongs to, treat it as “never enter” and ask [name or role].
Checking output
AI tools can produce confident, well-written text that is simply wrong. This is known as hallucination. The fix is a person who checks before anything leaves the building.
A person must review AI output for accuracy before it is sent, published, or used to make a decision. AI must not be used to make decisions about individuals, such as eligibility for services, without review by [role].
Transparency
Decide when you will tell people that AI helped produce something. This is your organization’s call. Published reports and messages to donors are common places to decide on a rule.
When AI helped produce [published reports / messages to donors / other content], we will say so by [method, such as a short note at the end].
Meetings and recordings
AI note-takers are convenient, but people have a right to know they are being recorded.
Before using an AI tool to record, transcribe, or take notes in a meeting, tell all participants and get their agreement. If anyone does not agree, do not use the tool.
New tools
Give people a clear, quick path to ask for a tool. If the path is slow or unclear, people will use tools without asking.
To request a new AI tool, contact [name or role] with the tool’s name, what you want to use it for, and what data it would handle. Do not use the tool for work until it is approved. [Name or role] will reply within [number] working days.
Security
Do not share your login details for any AI tool. Do not connect an AI tool to email, shared drives, or databases without approval from [role]. If a tool behaves strangely, for example by asking for passwords or taking actions you did not request, stop using it and report it to [contact].
Incidents
Make reporting easy and safe. People who fear blame tend to hide mistakes, and a hidden mistake is much harder to fix.
If you enter information you should not have, or an AI mistake reaches someone outside the organization, report it to [name or role] the same day by [phone, email, or other method]. We do not blame people for reporting mistakes. Early reports help us fix problems faster.
Ownership and review
Every policy needs a named owner, or it quietly goes out of date.
Policy owner: [name or role]. Version: [number]. Last reviewed: [date]. Next review: [date, no later than 12 months after the last review].
Acknowledgment
I have read this policy and agree to follow it. Name: [ ] Signature: [ ] Date: [ ]
How to roll it out
A policy only works if people know it exists and understand it. Here is a simple plan you can start this week.
- Fill in the blanks with a few of the people who will use it. Ask them which tools they already use. You will learn about shadow AI you did not know about, and your approved list will reflect real work.
- Keep it to one or two pages. If a section runs long, move the detail (such as the full tools list) to a separate page and link to it.
- Hold a short training session. Plan for 30 to 45 minutes. Walk through the three data tiers with real examples from your work, show where the approved list lives, and explain how to report a mistake. The course lesson on training staff in five habits can help you plan it.
- Collect sign-off. Ask everyone covered by the policy, including volunteers and board members, to sign the acknowledgment. Keep the signed copies with your other records.
- Put it where people will find it. Add it to your onboarding pack and your shared drive, and mention it when someone new joins.
- Review it on a schedule. Check it at least once a year, and sooner whenever you add or drop a tool, a tool changes its features, or a rule that affects you changes. Update the version number each time.
What to watch for
Even a good AI policy template can go wrong in practice. Keep an eye on these common problems:
- Banning too much. A policy that forbids all AI use often pushes people to use tools quietly on personal accounts, which is worse than approved use.
- A stale approved list. If the list never changes, people stop checking it. Give it a date and keep it current.
- AI features that appear on their own. Software you already pay for may add AI features in an update. Ask the policy owner to watch for these and decide whether they are allowed.
- Leaving people out. Volunteers and contractors often handle sensitive data too. Make sure they receive the policy and the training.
Frequently asked questions
Should we ban free AI tools?
Not necessarily. Free tools can be fine for public information, but they often give you less control over how your data is handled. A common approach is to allow free tools only for the “free to use” tier and to require approved, work-account tools for anything internal.
Do volunteers need to follow the policy?
Yes, if they handle any of your organization’s data. Volunteers often work with donor lists, client information or event records, which is exactly the kind of data the policy protects. Include them in training and ask them to sign the acknowledgment.
How detailed should the data rules be?
Detailed enough that a new volunteer could sort a document into the right tier without asking. Use examples from your own work, such as your case notes or your donor database, rather than general categories. When in doubt, the “treat it as never enter and ask” rule covers the gaps.
How often should we update the policy?
Review it at least once a year. Update it sooner when you add or remove a tool, when a tool’s features change, or when a rule that applies to you changes. Record a new version number and date each time so everyone knows which copy is current.
Published Updated