AI Acceptable Use Policy: What Your Nonprofit Should Include

AI use at work often starts quietly.

Not with a major rollout or with a formal software approval process. Usually, it starts because someone wants to save time.

Commonly used AI bots may feel harmless, but once employees use AI for work, the question becomes bigger than productivity. What tools are they using? What information are they sharing? Who reviews the output? What happens if sensitive data is entered into a tool that was never approved?

An AI Acceptable Use Policy gives your organization a clear answer before those decisions are made one by one.

For nonprofits, this kind of policy does not need to be complicated; it needs to make expectations clear.

AI Use at Work Needs Rules Before It Becomes Routine

The longer AI is used informally, the harder it becomes to manage.

Employees may create personal accounts, test new tools, upload documents, summarize internal notes, or draft public-facing content without understanding how the AI tool stores, processes, or uses that information. This creates a gap between what leadership thinks is happening and what is actually happening.

An AI Acceptable Use Policy helps close that gap. It tells employees which tools are approved, what uses are allowed, what information needs extra protection, and when human review is required.

The policy doesn’t prohibit AI use; it simply gives your team a cleaner way to use it without letting tools, accounts, and data spread in too many directions.

An AI Acceptable Use Policy Should Define Who It Applies To

A strong policy starts by making the scope clear. It should explain that the rules apply to anyone using AI tools for organization-related work. That may include employees, contractors, consultants, vendors, interns, volunteers, board members, and temporary staff.

AI risk doesn’t come only from full-time employees. A contractor may use AI to summarize a document. A vendor may use AI to speed up a report. A volunteer may use a free tool to draft outreach content. A board member may use AI to review internal materials.

If they are using your organization’s information, the expectations should be clear. Your policy should define who is covered, which tools are allowed, and what counts as work-related AI use.

Approved AI Tools Should Be Named Clearly

Employees should not have to guess which AI tools are acceptable.

Your policy should identify which tools are approved for work use, who manages access, and whether different tools are approved for different types of information.

For example, your organization may allow AI for general writing support but not for confidential documents. Or it may approve AI inside a business platform while restricting free personal accounts that leadership cannot manage.

The important point is ownership. 

Your IT department should know which AI tools are being used, who has access, and what settings apply. When tools are not reviewed, AI becomes one more form of shadow IT. Work information starts moving through platforms the organization does not control.

Your Nonprofit’s Sensitive Data Needs Its Own Section

An AI Acceptable Use Policy should clearly state what information is restricted.

• Do not bury sensitive data rules inside a general paragraph.
• Name the categories employees need to recognize.

Depending on your organization, that may include:

• Donor records
• Customer information
• Client files
• Employee data
• Financial records
• Health information
• Legal documents
• Grant documentation
• Case notes
• Student records
• Passwords or access credentials
• Internal strategy
• Confidential contracts
• Proprietary business information

This section should answer a simple question: What information should not be entered into an AI tool unless the organization has specifically approved that use?

The National Institute of Standards and Technology’s AI Risk Management Framework encourages organizations to manage AI risk based on context, including privacy, security, and human oversight. In practice, that means your organization should treat different types of information differently. A general event flyer does not carry the same risk as a client file, donor record, or financial document.

Acceptable Uses Should Be Practical, Not Too Broad

A policy that only says “use AI responsibly” will not help much. Employees need real examples of acceptable use. Your organization may allow AI for:

• Drafting general internal content
• Summarizing non-sensitive meeting notes
• Creating outlines
• Reformatting existing public information
• Brainstorming campaign ideas
• Drafting training materials
• Improving grammar or readability
• Creating first drafts for human review

The list should reflect how your team actually works. For a nonprofit, acceptable use may include drafting general donor communication or organizing public program information. For a small business, it may include internal procedures, sales email drafts, or meeting summaries.

The policy should be specific enough that employees can make good decisions without asking for approval every time.

Prohibited Uses Should Be Just as Clear

Acceptable use is only half of the policy. Employees also need to know what not to do. Your prohibited use section may include:

• Entering sensitive data into unapproved AI tools
• Uploading confidential documents without approval
• Sharing passwords or access credentials
• Using AI to make final hiring, financial, legal, medical, or service eligibility decisions
• Publishing AI-generated content without review
• Creating customer, donor, or client communications that have not been checked
• Using personal AI accounts for business data
• Connecting unapproved AI tools to business systems
• Using AI outputs as facts without verification

This section should be direct. The clearer the boundary, the less likely employees are to improvise with sensitive information.

Human Review Should Be a Requirement, Not a Suggestion

AI can produce useful work. It can also be incomplete, inaccurate, outdated, or too confident. That is why human review belongs in the policy.

Your policy should state that AI-generated work must be reviewed before it is shared, published, submitted, or used to support a decision. Review should include:

• Accuracy
• Privacy
• Tone
• Bias or unfair impact
• Legal or compliance concerns
• Alignment with organizational standards
• Whether sensitive information was used appropriately

This does not mean every AI-assisted sentence needs a committee; it means someone needs to own the final result. The employee using AI is still responsible for checking the work.

AI Should Connect to Your Cybersecurity Policy

Your AI Acceptable Use Policy should connect to the cybersecurity and data rules your team already follows. For example, your AI policy should align with rules around:

• Approved software
• Data handling
• Account access
• Multi-factor authentication
• Vendor access
• Device use
• Incident reporting
• Employee offboarding
• Confidentiality
• Record retention

The Federal Trade Commission has warned that users may reveal sensitive or confidential information when using AI tools, including internal documents and user data. That’s exactly why AI rules should connect to data protection and security practices.

If your organization already has a cybersecurity policy, the AI acceptable use policy can build on it. If you do not, this may be a good time to create both.

Vendors and Contractors Need AI Boundaries Too

AI rules should not stop at your internal team. Any outside partner using your organization’s information should understand what is allowed.

Your policy should clarify whether vendors, agencies, consultants, contractors, or volunteers can use AI tools with your documents, data, creative assets, reports, client information, donor records, or internal materials.

Handle this before work begins. Useful questions include:

• Can this partner use AI with our information?
• Which tools are allowed?
• What types of information are restricted?
• Can our data be used to train external models?
• Who reviews AI-assisted work before delivery?
• What happens to uploaded files after the project ends?

Mistakes Should Have a Reporting Process

A good policy should also explain what employees should do if something goes wrong.

Someone may enter sensitive information into the wrong tool. An AI output may include inaccurate information. A vendor may use an unapproved platform. A staff member may realize they connected an AI tool to a work account without permission.

Employees should know how to report that quickly. Therefore, your AI use policy should explain:

• Who to contact
• What information to include
• What counts as an AI-related concern
• Whether the issue should also be treated as a security incident
• How the organization will review and respond

Employees should feel comfortable reporting mistakes quickly so your organization can review what happened, limit exposure, and decide what needs to change.

The Policy Should Be Reviewed as AI Tools Change

AI tools are changing quickly. A policy written today may need updates as your organization approves new tools, changes platforms, adds vendors, or starts using AI in more structured ways.

Your policy should name an owner and set a review schedule.

That owner may be leadership, operations, IT, compliance, HR, or a cross-functional group, depending on your organization. At minimum, the policy should be reviewed when:

• A new AI tool is approved
• Employees request a new use case
• Sensitive data is involved
• A vendor wants to use AI
• Regulations or funder requirements change
• A security or privacy issue occurs

AI governance does not need to be heavy. It does need someone paying attention.

What to Include in an AI Acceptable Use Policy Template

A useful AI Acceptable Use Policy template should be easy for leadership to adapt and clear enough for employees to follow.

Purpose

Explain why the policy exists and what it is meant to protect.

Scope

Define who the policy applies to and what counts as work-related AI use.

Approved Tools

List approved AI tools and who manages access.

Acceptable Uses

Give examples of AI use that are allowed.

Prohibited Uses

Define what employees should not do with AI tools.

Sensitive Data Rules

Explain what information cannot be entered into AI tools without approval.

Human Review

Require employees to review AI-generated content before it is used.

Approval Process

Explain when employees need permission for a new tool or higher-risk use case.

Vendor and Contractor Rules

Set expectations for outside partners using AI with your organization’s information.

Incident Reporting

Tell employees what to do if sensitive information is shared by mistake or an AI-related issue occurs.

Policy Ownership

Name who maintains the policy and how often it should be reviewed.

Download the AI Acceptable Use Policy Template