AI Policy for Nonprofits That Staff Can Actually Follow

What Should an AI Policy for Nonprofits Include?

An AI policy for nonprofits does not succeed simply because the board approved it or employees signed an acknowledgment form. It succeeds when people can make the right decision in the moment.

That decision may happen just before someone pastes donor information into a public chatbot, connects a meeting assistant to a board call, installs an AI-enabled browser extension, or grants a new application access to organizational files.

A usable policy should answer six operational questions:

1. Who is covered? Identify whether the policy applies to employees, contractors, interns, volunteers, board members, and other authorized users.
2. Which tools are approved? Define permitted platforms, account types, features, extensions, plug-ins, and integrations.
3. Which information may be used? Connect AI rules to the nonprofit’s existing data-classification and privacy requirements.
4. Which activities need review? Explain when staff may proceed, when human validation is required, and when formal approval is necessary.
5. Who is accountable? Name the policy owner, approvers, reviewers, and reporting contacts.
6. What happens after a mistake? Give staff a short, nonpunitive incident-reporting process they can remember.

At 7tech, we recommend organizing these requirements into four layers: policy, standards, procedures, and technology controls. Each layer solves a different operational problem.

Policy states the expectation. Standards define the requirement. Procedures explain the action. Technology controls make the safer action easier to follow.

If one layer is missing, the policy becomes harder to use. A rule without a procedure leaves employees wondering whom to ask. A procedure without controls depends entirely on memory. A technical restriction without a clear explanation can feel arbitrary and encourage workarounds.

The best AI use policy for a nonprofit is not necessarily the longest. It is the policy that removes uncertainty from real work while giving leadership defensible oversight.

Where Is AI Already Entering Your Nonprofit’s Work?

Before drafting an AI policy for nonprofits, identify where AI is already being used across the organization.

AI adoption often happens quietly. A staff member opens a free account to improve a donor appeal. A department activates an automated meeting assistant. A browser extension begins summarizing web pages. A donor, accounting, human resources, or productivity platform adds an AI feature during a routine update.

This is often described as shadow AI. In most cases, however, employees are not intentionally creating risk. They are trying to save time, improve an output, or solve a problem with the tools available to them.

Your inventory process should therefore be practical and non-accusatory. The goal is visibility, not blame.

For every use you identify, record:

• The tool, feature, extension, plug-in, connected application, model, or agent
• The account type, including personal, free, departmental, or organization-managed
• The employees, contractors, volunteers, or departments using it
• The information entered, uploaded, retrieved, or made available through an integration
• The task the tool performs
• The output it creates and who receives that output
• Whether a qualified person reviews the result
• Whether the tool can take action inside another system
• The current business owner and technology owner
• The cost, renewal date, and contractual terms where applicable

This inventory gives leadership a factual starting point. It also helps prevent policy decisions based on assumptions about how staff work.

A nonprofit with a small internal team may need help locating AI features embedded inside existing systems. Reliable technology support for nonprofit organizations can help leadership review accounts, browser extensions, integrations, connected applications, and cloud platforms before writing rules around an incomplete picture.

How Should Nonprofits Classify AI Risk?

An effective AI policy for nonprofits should not approve or prohibit a platform based only on its name. The same tool might be reasonable for brainstorming public event themes and unacceptable for summarizing confidential program records.

Effective AI risk management for nonprofits evaluates the full context of the use.

1. Tool: Which platform, feature, application, plug-in, extension, model, or agent is involved?
2. Account: Is it a personal account, a free account, or an organization-managed business account?
3. User: Who is using it, and do they have the training and authority required for the task?
4. Information: What data can the tool receive, retrieve, infer, store, or expose?
5. Task: Is the system brainstorming, drafting, summarizing, recommending, deciding, communicating, or taking action?

The NIST AI Risk Management Framework provides a useful foundation for this process. Its core is organized around four functions: Govern, Map, Measure, and Manage.

Your nonprofit does not need to reproduce a federal framework inside an employee handbook. It should apply the underlying principle: AI risk depends on context and must be reconsidered when the tool, account, information, integration, or task changes.

Classify the Tool and Account

Your policy should distinguish among:

• Public consumer AI tools
• Business and enterprise AI platforms
• AI features embedded in existing software
• Browser extensions and plug-ins
• Meeting assistants
• Connected applications and integrations
• AI agents that can perform tasks or change information

Account type matters because free, personal, business, and enterprise offerings may have different administrative settings, contractual protections, retention options, data-use terms, or logging capabilities.

Staff should not assume that two accounts on the same platform create the same level of protection.

Organizational work belongs in an approved, organization-managed account—not a personal AI account.

Classify the Information

Use language employees already recognize. A four-level model works for many nonprofits.

Which AI Uses Should Be Permitted, Restricted, or Prohibited?

A practical AI policy for nonprofits should not force employees to interpret abstract principles every time they use AI. Give them four clear categories: permitted, permitted with review, restricted, and prohibited.

How Should an AI Approval Process for Nonprofits Work?

“Ask IT first” is not an approval process. Employees need to know what requires review, where to submit a request, who evaluates it, how the decision is documented, and when approval expires.

A practical AI approval process for nonprofits should cover:

• A new AI platform or account
• An AI feature added to an existing application
• A browser extension, plug-in, meeting assistant, or connected tool
• A new category of organizational information
• A new workflow or a meaningful change to an approved workflow
• An integration with email, cloud storage, donor management, finance software, or another system
• An AI agent that can communicate, change records, or take action
• An exception to an established rule

What Information Should the Request Include?

• The requestor, department, proposed users, and business owner
• The problem the team is trying to solve
• The tool, vendor, feature, and required account type
• The information involved and where it originates
• The proposed task and intended output
• The people affected by the output or decision
• The person responsible for reviewing the result
• The systems, files, or applications the tool can access
• Expected costs, including licensing, setup, integration, training, and staff time
• Relevant vendor terms, retention settings, and data-use settings
• The requested start date, pilot period, review date, and duration
• The expected benefit and how success will be measured

Including cost protects more than the budget. It allows leadership to compare the request with other technology and mission priorities through responsible nonprofit IT budget planning.

Including the expected benefit also prevents the organization from approving technology simply because it is available. A workflow should create enough value to justify the financial, operational, security, and oversight burden it introduces.

Who Should Review AI Requests?

The review group should match the risk of the proposed use. Possible reviewers include:

• Executive leadership
• Operations
• Internal IT
• A managed service provider
• Cybersecurity or compliance advisors
• Legal counsel
• Human resources
• Finance
• Development
• Program leadership

A low-risk writing tool may require only manager and technology approval. A system involving donor data, program records, employment decisions, financial systems, restricted information, or automated action may require broader review.

What Should the Approval Record Include?

Every approval should document:

• The approved tool, account, feature, and use
• The authorized users or departments
• The required account type
• The information that is permitted and prohibited
• The required human-review process
• The systems or integrations the tool may access
• The controls and training that must be in place
• The policy owner and business owner
• The approval date, review date, and expiration date

Reapproval should be required when the use expands, the vendor changes important terms, a new integration is added, different information becomes involved, the system gains the ability to take action, or an incident exposes a new risk.

What Should Staff Do When an AI Mistake Happens?

Employees will make mistakes, so an AI policy for nonprofits should make prompt reporting easier than concealment.

An AI-related incident may include:

• Entering sensitive information into the wrong tool or account
• Using an unapproved application for nonprofit work
• Sharing inaccurate, biased, deceptive, or inappropriate output
• Installing an unauthorized extension, plug-in, or integration
• Discovering that a tool retained or exposed information unexpectedly
• Presenting AI-generated content as verified fact
• Unexpected account activity, excessive usage, or unusual costs
• An automated action affecting the wrong donor, employee, client, record, or system
• A tool accessing more files, messages, or systems than expected

Give staff a short sequence they can remember.

1. Stop. Do not enter more information, share the output, or continue running the workflow.
2. Preserve. Keep prompts, outputs, screenshots, messages, account details, logs, and related records. Do not delete evidence to hide the mistake.
3. Report. Contact the named internal person or reporting channel immediately.
4. Contain. Authorized responders may disable an account, remove an integration, revoke access, reset credentials, contact the vendor, or preserve additional logs.
5. Assess. Determine what information, systems, people, or commitments may have been affected.
6. Improve. Update the policy, training, approval process, or technical control that failed or caused confusion.

Prompt reporting protects the mission. Delayed reporting can turn a manageable error into a more serious incident.

The policy should connect AI events to the nonprofit’s existing incident-response and ransomware-prevention practices. Creating a separate process that no one remembers during a stressful event adds unnecessary complexity.

The CISA AI cybersecurity risk guidance can also help technology and security leaders incorporate AI-related risks into broader cybersecurity planning.

Which Technology Controls Should Support the Policy?

A written rule is necessary, but it should not carry the entire burden. Technology controls can make the approved path easier, reduce accidental misuse, support consistent enforcement, and give leadership better visibility.

Use Organization-Managed Accounts

Require approved organizational accounts for nonprofit work. Central administration makes it easier to apply settings, manage licenses, review users, remove access, and respond when someone changes roles or leaves.

Require Strong Sign-In Protection

Use multifactor authentication, strong passwords, appropriate sign-in restrictions, and role-based access. Shared credentials reduce accountability and make offboarding more difficult.

Control Applications, Extensions, and Integrations

Maintain an approved application list. Review browser extensions, meeting assistants, plug-ins, connected applications, and AI features that can access email, calendars, cloud files, donor records, or other systems.

Nonprofits using cloud-based systems and services should pay particular attention to connected applications. A small convenience feature can receive broad access when permissions are accepted without proper review.

Configure Data and Platform Settings

Review available controls for:

• Prompt and file retention
• Use of organizational data for model training
• Public sharing links
• External collaboration
• Administrative access
• Logs and audit records
• Data export and deletion
• Connected applications and plug-ins
• Automated actions and agent permissions

Maintain Operational Visibility

Keep an inventory of approved tools, account owners, authorized users, integrations, restricted workflows, exceptions, review dates, and expiring approvals.

This visibility supports everyday administration, vendor management, incident response, and broader cybersecurity risk management.

Plan for Offboarding

When employees, contractors, interns, or volunteers leave, remove their AI access, revoke tokens and integrations, transfer organizational work, and confirm that personal accounts do not retain nonprofit information.

For many organizations, these controls require coordination across Microsoft 365, cloud platforms, identity systems, endpoints, applications, security monitoring, and vendor management. A partner providing managed IT services for nonprofits can help translate policy requirements into controls staff do not have to maintain alone.

How Should Nonprofits Roll Out an AI Policy?

Posting the policy in a shared folder is not implementation.

Employees are more likely to follow a rule when they understand what it protects, can recognize the situation, and know where to get a timely answer.

Lead With the Mission

Leadership should explain that the policy exists to protect people and relationships, not to punish curiosity or stop useful innovation.

Connect the policy to outcomes employees already care about:

• Protecting the people the nonprofit serves
• Maintaining donor and funder trust
• Keeping confidential information confidential
• Preventing avoidable disruption
• Giving the board confidence that AI is being managed responsibly
• Helping staff use approved tools without guessing
• Preserving limited staff time and donor-funded resources

Train Employees by Role

Fundraisers, program staff, finance employees, executives, volunteers, and board members face different decisions. One generic presentation will not prepare each group for its actual work.

Use short scenarios that reflect common questions:

• “May I paste this donor email into an AI assistant?”
• “Can a meeting tool join a board, client, or case-management call?”
• “May I summarize these program notes?”
• “Can I connect this tool to our donor database?”
• “May I use my personal account until the organization buys a license?”
• “Who verifies the citations in an AI-assisted grant draft?”
• “Can this tool send messages or update records automatically?”

Provide a One-Page Decision Guide

A quick-reference guide should tell employees:

• Which tools and accounts are approved
• Which information must not be entered without approval
• Which uses always require human review
• Which uses require formal approval
• Which activities are prohibited
• How to report a mistake
• Who can answer questions

The goal is not to make every employee an AI expert. It is to help people recognize three situations: clearly allowed, clearly prohibited, and stop to ask.

Organizations with limited internal technology capacity may benefit from managed or co-managed IT support that gives internal leaders additional help with application review, account controls, onboarding, offboarding, and policy enforcement.

How Should Leadership Maintain and Measure the Policy?

An AI policy for nonprofits should be maintained as a living operational document. Tools change. Embedded features appear. Vendors revise their terms. Integrations expand. Employees discover new uses. Organizational obligations also evolve.

Review the policy on a defined schedule and whenever:

• A significant AI tool or workflow is introduced
• An existing platform adds new AI capabilities
• Different information will be processed
• A vendor changes important data, retention, or account terms
• A new law, contract, grant condition, or privacy commitment applies
• An incident exposes a gap
• Staff repeatedly ask the same question
• Employees bypass the process because it is too slow or unclear
• An approved tool gains the ability to communicate or act automatically

Measure Whether Staff Can Follow the Policy

AI Policy Checklist for Nonprofits

Use this checklist to evaluate an existing policy or guide the first draft.

• Purpose and scope
• Employees, contractors, interns, volunteers, and board members covered by the policy
• Policy owner and responsible approvers
• Approved and prohibited tools
• Required account types
• Information-classification rules
• Permitted, permitted-with-review, restricted, and prohibited uses
• Human-review requirements
• Approval and exception procedures
• Vendor, application, extension, and integration review
• Incident-reporting and escalation steps
• Technology-control requirements
• Training and acknowledgment requirements
• Documentation and recordkeeping
• Approval expiration and reapproval triggers
• Policy-review schedule
• Enforcement expectations
• A named support contact or reporting channel
• Metrics for usability, risk, adoption, and value

Templates can save time, but the final policy should reflect your actual staff, systems, programs, information, contracts, risk tolerance, and compliance obligations.

This guide provides operational information, not legal advice. Ask qualified counsel to review legal or regulatory questions specific to your organization.

What Is the Most Important Principle for a Nonprofit AI Policy?

Nonprofits need AI policies because employees are making real decisions now, not because leadership needs another document sitting on a shelf.

Additional nonprofit sector guidance reinforces the importance of establishing clear expectations as organizational AI use expands.

A useful policy tells staff:

• Which tools and accounts they may use
• What information they may enter or upload
• Which activities require human review
• Who approves tools, integrations, and exceptions
• What to do when something goes wrong

The strongest policy combines clear expectations, practical standards, usable procedures, role-based training, and technology controls that evolve with the organization.

Perfection is not the standard. Clarity is.

An AI policy helps your nonprofit use approved technology appropriately. Responsible AI leadership answers the question that comes first: whether the work should be automated at all.