1. Purpose and scope
[Organization name] uses AI tools to save staff time on drafting, summarizing and research, while protecting the people we serve, our donors and our staff. This policy applies to all staff, volunteers, board members and contractors who use AI tools for [Organization name] work.
2. Approved tools
Only these tools may be used for organization work: [list tools, for example Microsoft Copilot Chat signed in with a work account]. Ask [policy owner] before using any other AI tool for work. Personal AI accounts may not be used with organization data.
Why a work account matters: Microsoft says that when Copilot Chat is used with a work account, prompts and responses are covered by its enterprise data protection terms and are not used to train foundation models. Check the terms of any tool before you approve it.
Source: Microsoft: enterprise data protection in Copilot Chat
3. What never goes into an AI tool
- Passwords, account numbers or other credentials.
- Client case notes, health information or anything that identifies a person we serve, unless the tool is approved for that data in writing.
- Donor records, payment details or unpublished financial information.
- Information shared with us under a confidentiality agreement.
4. People stay responsible
- A person reviews every AI output before it is sent, published or used in a decision about someone.
- AI is not used to make final decisions about services, eligibility, hiring or discipline.
- Facts, names, numbers and quotes from AI output are checked against a reliable source.
- We say when content that the public sees was mostly created by AI, where that matters to the reader.
5. Permissions and records
AI assistants connected to our files can see what the signed-in person can see. Before turning one on, [policy owner] checks that sensitive folders are shared only with the right people. AI outputs used in our work are kept under our normal records rules.
6. Owner, training and review
[Policy owner] maintains this policy and the approved tool list. New staff and volunteers read it during onboarding. We review it every [6 or 12] months, or sooner when a tool or law changes. Concerns or mistakes are reported to [policy owner] without blame.
Want a framework behind the template?
The NIST AI Risk Management Framework is a voluntary framework, released in January 2023, for managing risks from AI. NIST also published a Generative AI Profile in July 2024. Both are free to read and useful if your board wants a recognized reference.
Common questions
Do small nonprofits really need an AI policy?
If staff or volunteers already use AI tools, a one-page policy sets clear limits on what data goes in and who checks the output. It is easier to write before a problem than after.
Is this template legal advice?
No. It is a plain starting point. If you handle health, education or other regulated records, have a qualified advisor review your final policy.
Can we change the template?
Yes. Copy it, change anything, and use it as your own. No attribution is needed.