Building an AI Policy for Your Nonprofit: A Practical Framework
In many nonprofits, AI arrived before anyone decided how to use it. A development associate drafts appeal letters with a chatbot. A program manager summarizes client interviews with a transcription tool. The CRM vendor switches on a new prediction feature. Each decision seems small, but together they shape how the organization handles donor data, client privacy and its own public voice.
An AI policy turns those scattered choices into shared rules. It does not need to be long or legalistic. A good policy tells staff and volunteers what they can do, what they must not do, and who to ask when they are unsure. It also gives leadership and the board a way to show donors and partners that the organization takes its responsibilities seriously.
This framework breaks the work into manageable steps, from taking stock of current use to reviewing the policy once it is in place.
Start With an Honest Inventory
You cannot write useful rules without knowing what is already happening. Many organizations are surprised by how many tools staff are already using informally.
Questions for the Inventory
- Which AI tools are staff and volunteers using, including free consumer apps?
- Which existing software, such as CRM, email or accounting platforms, has added AI features?
- What kinds of data go into these tools: donor records, client information, financial data, internal documents?
- Who decided to adopt each tool, and was anyone outside the team consulted?
Making It Safe to Answer
Frame the inventory as fact-finding, not an audit. If staff fear being disciplined for using a tool without permission, they will underreport, and the policy will be written for an organization that does not exist.
Recording What You Find
Keep the results in a simple spreadsheet: tool name, who uses it, for what purpose, what data goes in, and whether the vendor’s terms have been reviewed. This list becomes the first version of your approved tool register and shows quickly where the biggest gaps are.
Define Principles Before Rules
Rules change as tools change. Principles last longer and help people make sensible decisions in situations the policy did not anticipate.
Principles Worth Considering
- Human responsibility: a named person is accountable for any output that reaches donors, clients or funders.
- Privacy first: personal data is shared with AI tools only when necessary and permitted.
- Transparency: the organization is open about where AI shapes communications or decisions.
- Fairness: AI is not used in ways that disadvantage the communities the organization serves.
- Mission alignment: tools are adopted because they serve the mission, not because they are new.
The fairness principle deserves particular attention in any work that involves eligibility, prioritization or grant decisions. Bias in these systems is often invisible until someone looks for it.
Sort Uses by Risk
Treating every AI use the same way either blocks harmless tasks or lets risky ones through. A simple tiered approach gives staff clarity.
| Risk Level | Examples | Requirement |
|---|---|---|
| Low | Brainstorming, editing public text, summarizing published reports | Allowed with approved tools; human review before publishing |
| Medium | Drafting donor communications, analyzing anonymized data | Approved tools only; manager review; no personal data |
| High | Donor scoring, client eligibility, decisions about individuals | Leadership approval, documented assessment, ongoing monitoring |
| Prohibited | Entering client case notes into public tools, impersonating staff | Not permitted under any circumstances |
Adapting the Tiers
Your tiers will depend on your work. A health or social services organization handling sensitive client data will draw stricter lines than an arts organization whose data is mostly ticket sales. The point is to make the categories obvious enough that a new employee can place a task in the right tier without asking.
Handling the Gray Areas
Some uses will not fit neatly. Imagine a youth mentoring program that wants to use AI to summarize volunteer feedback forms that occasionally mention individual young people by name. Is that medium or high risk? The policy should say who makes the call in such cases and ask staff to err toward the higher tier until they get an answer. Each decision can then be added to the policy as an example, so the next person does not have to ask the same question.
Cover Data, Vendors and Disclosure
Three practical areas cause most of the difficulty in day-to-day use.
Data Handling
Specify which categories of data may never be entered into external AI tools, such as client case notes, health information, payment details and donor records with identifying information. Explain how to anonymize data when analysis is necessary. Consent matters here too; for a fuller treatment, see donor consent and data ethics in machine learning fundraising.
Vendor Review
Before adopting a tool, ask whether it trains on your data, where data is stored, how long it is kept and how it can be deleted. Ask whether you can explain its outputs to a donor who asks. Keep a short register of approved tools so staff do not have to guess.
Disclosure
Decide when the organization will tell people that AI was involved. Many organizations choose to disclose when donors interact directly with automated systems, such as chatbots, and when AI informs decisions about individuals. Fewer disclose routine editing help. Whatever you choose, be consistent.
Governance, Training and Review
A policy that sits in a shared drive does little. It needs owners, training and a schedule for revisiting it.
Assign Ownership
Name a staff lead responsible for the policy, the tool register and questions from colleagues. In small organizations this may be the executive director or operations manager. Decide which decisions go to the board, typically high-risk uses and significant new vendor relationships.
Train for Judgment
Training should focus on realistic scenarios: what to do when a tool produces a statistic you cannot verify, or when a donor asks if they are talking to a bot. Boards need a version too, so trustees can ask informed questions; AI literacy for nonprofit boards covers what that conversation can look like.
Schedule Reviews
Set a regular review, at least annually, plus a trigger for review whenever a major new tool is adopted or something goes wrong. Keep a simple log of incidents and near-misses to inform each revision.
The best AI policy is short enough to read, specific enough to follow and revised often enough to stay true.
A One-Page Starting Point for Small Teams
If a full framework feels out of reach, begin with a single page: a list of approved tools, a list of data that must never go into them, a rule that a named person reviews any AI-assisted output before it reaches the public, and the name of the person to ask. That is enough to prevent the most common mistakes and to start a conversation across the organization. From there, add risk tiers, vendor questions and disclosure rules as your use grows. The goal is not to slow staff down but to make sure that every new tool strengthens the trust donors, clients and partners place in your work.
