How to Write a Nonprofit AI Use Policy: A Step-by-Step Outline

Before writing anything, ask staff and volunteers which AI tools they use and what for. Make it clear that nobody is in trouble; the goal is an accurate picture. Most organizations find that AI is already drafting grant language, summarizing meeting notes, writing social posts, and answering questions.

That picture tells you what the policy has to cover. A policy written without it tends to ban things people will keep doing anyway, quietly and without guidance.

The heart of a nonprofit AI policy is the data section. Group your information into a few plain categories and say which tools each category may be used with. Public information, such as published reports, can go almost anywhere. Internal information, such as draft plans, can go into approved tools on organization accounts. Sensitive information should not go into AI tools without specific approval.

For nonprofits, sensitive information usually includes donor records and giving history, details about the people you serve, anything about minors, health or case information, and staff personnel records. If you handle information covered by specific legal or funder requirements, have counsel review this section.

List the specific tools staff may use and require organization accounts rather than personal ones, so you control the settings and can remove access when someone leaves. Where a tool offers settings that stop your content being used to train its models, turn them on and note that in the policy.

Say how a new tool gets approved, and by whom. A simple request process keeps people from guessing and gives you a record of what is in use.

AI output can be confidently wrong. Require a person to review anything that goes outside the organization, such as donor letters, grant applications, public statements, and anything given to the people you serve. The reviewer, not the tool, is responsible for what is sent.

Decide where you will be open about AI use. Many nonprofits choose to disclose it when AI is used to communicate directly with clients or to make decisions that affect them, because trust is part of the mission. Funders may also ask how AI was used in an application, so check their guidance.

Aim for one or two pages in plain language. Staff should be able to remember the main rules after one read. Adapt this outline to your organization rather than copying it word for word.

Have leadership adopt the policy, and take it to the board if your governance requires it. Then walk staff through it in a short meeting rather than only emailing it. Questions raised in that meeting often show where the wording needs to be clearer.

Set a review date, at least once a year and whenever you adopt a significant new tool. AI tools change quickly, and a policy that falls behind stops being followed.