Lightweight AI Governance Policy Template

Sample Lightweight AI Governance Policy for Resource-Constrained Nonprofits

This template is designed for small and mid-sized nonprofits that do not have dedicated legal, compliance, or IT departments. It translates responsible AI adoption principles into an actionable internal policy that can be adapted by executive directors, operations leads, program managers, or board members.

It is intended to help organizations establish immediate guardrails against unmanaged AI use, shadow IT, inappropriate data sharing, overreliance on AI-generated outputs, and high-risk uses that may affect the communities they serve.

[Insert Nonprofit Name] – Generative AI Use and Safeguards Policy

1. Purpose and Scope

At [Insert Nonprofit Name], we recognize that generative artificial intelligence (AI) tools may help reduce administrative burden and improve certain internal workflows, allowing staff to devote more time to our mission and the communities we serve. At the same time, these tools introduce risks related to privacy, bias, accuracy, confidentiality, and organizational trust.

This policy establishes the minimum rules for the safe and responsible use of generative AI by all staff, volunteers, interns, contractors, and consultants acting on behalf of [Insert Nonprofit Name].

2. Approved Tools and Account Use

Staff should use only AI tools that have been reviewed and approved by [Insert Role, e.g., Operations Director or Executive Director], unless temporary use is explicitly authorized for a low-risk task.

The use of personal AI accounts, such as personal ChatGPT, Claude, or Gemini logins, for organizational work is prohibited unless explicit case-by-case permission is granted.

Whenever possible, staff should use organization-managed or enterprise-tier accounts. These accounts may offer stronger privacy protections and clearer data controls than free or personal accounts. However, staff must follow this policy regardless of account type.

3. Data Privacy and Confidentiality: Non-Negotiable Red Lines

Public or external AI systems are not secure storage systems. To protect our clients, participants, donors, staff, volunteers, and partners, the following information must never be entered into a generative AI prompt unless explicit written approval has been granted and an appropriate protected environment is being used:

- Personally identifiable information (PII), including names, addresses, phone numbers, email addresses, government ID numbers, or dates of birth
- Confidential client or participant notes, including trauma-informed case notes, legal status details, immigration status, medical or psychological information, or school-related confidential records
- Sensitive staff or volunteer information, including performance issues, disciplinary matters, or private contact information
- Confidential financial information, including donor bank details, unreleased budgets, internal financial planning, or confidential grant strategies
- Any material covered by confidentiality agreements, internal personnel protections, or sensitive partner arrangements

Rule of Thumb:
If you would not post the information on a public website or public social media page, do not enter it into a public AI prompt.

All information must be anonymized or de-identified before use.

If you are unsure whether information is safe to include, do not enter it until you have checked with [Insert Role].

4. Required Human Review

Generative AI must be treated as a first-draft or support tool, not as an autonomous representative or final decision-maker for [Insert Nonprofit Name].

All AI-generated outputs must be reviewed by a human before they are shared internally or externally. This includes, but is not limited to:

- emails
- grant narratives
- donor communications
- newsletters
- website copy
- internal summaries
- social media content
- translated materials
- community-facing communications

The staff member using the AI tool remains responsible for the final output, including its accuracy, factual reliability, tone, cultural sensitivity, and appropriateness for the intended audience.

Outputs involving clients, participants, legal matters, finances, youth, trauma-sensitive issues, or culturally sensitive communication require heightened human review.

5. Prohibited High-Risk Uses

To protect mission integrity, community trust, and vulnerable populations, generative AI must not be used for the following purposes unless a separate, formally approved governance process has been established:

- Making final decisions about participant eligibility, service access, or financial aid
- Ranking, scoring, or prioritizing clients, participants, applicants, or community members without explicit human review and documented justification
- Providing automated psychological support, crisis counseling, trauma counseling, or similar high-risk interpersonal services
- Producing culturally sensitive, trauma-sensitive, or legally sensitive communications without rigorous review by an appropriate staff member, subject matter expert, or community-facing leader
- Generating final organizational statements on controversial, high-risk, or highly sensitive topics without management approval
- Entering sensitive case information into external AI tools for convenience, summarization, or analysis

6. Documentation

For recurring or higher-impact uses of AI, staff should maintain lightweight documentation that records:

- the tool used
- the purpose of the use
- whether sensitive information was removed or anonymized
- who completed the final human review
- whether any concerns or corrections arose during review

Documentation may be maintained in a simple internal log, spreadsheet, or shared governance record designated by [Insert Role].

7. Reporting and Continuous Learning

Staff are encouraged to share safe, effective, low-risk uses of AI that reduce administrative burden and improve internal efficiency.

Any accidental disclosure of sensitive information, suspected misuse of an AI tool, biased or offensive output, or inaccurate, fabricated, or misleading AI-generated content must be reported immediately to [Insert Role/Email].

Good-faith reporting of accidental incidents will not result in punishment. Prompt reporting is essential to organizational learning, trust protection, and collective security.

Where appropriate, [Insert Nonprofit Name] will periodically review this policy, update approved tools, and revise risk boundaries as staff needs, organizational practices, and external conditions evolve.

How to Use This Template

Before adopting this policy, nonprofits should customize the bracketed fields, identify who approves AI tools, decide where AI use will be documented, and define which use cases require senior review. This template should be paired with the AI Readiness Self-Assessment and the Bias, Privacy & Vendor Risk Matrix before expanding AI use.

Use this policy with the rest of the toolkit