Non-profits and small to medium-sized businesses · Austin, TX
What Should Be in an AI Acceptable-Use Policy for a 20-Person Nonprofit?
A short one: who can use which tool, on which data, and who signs off before it touches a donor or client. Everything else in the policy supports those three lines.
Who can use which tool: list what's actually approved, not "AI" as a category. A request to try something new is one line, not a board meeting.
On which data: classify what the team handles as public, internal, or donor- and client-restricted, and say plainly what never goes into a consumer AI tool. Grant records and client files belong in the restricted tier.
Who signs off: anything donor- or client-facing gets a named human reviewer before it goes out — a specific person in the policy, not "someone checks it."
The rest is upkeep: a published do-not-build list, vendor terms that rule out training on the data, and a note on how the policy gets revisited when a new tool shows up. Approved in one meeting, not four — if it takes longer than that, nobody will read it.
Related questions
Questions people ask next.
- What is AI governance, and does a small nonprofit actually need one?
- It is a written policy setting what AI is and is not allowed to touch, and yes, an organization already using AI needs one however small. Most small teams already use AI ad hoc without one.
- What should never go into a consumer AI tool?
- Anything in the donor- and client-restricted tier: grant records, client files, and anything covered by a grant agreement or a regulator. The free consumer version of a chatbot can use what you type to train future models unless you have opted out.
- What tasks should AI never handle without a person checking it?
- Anything donor- or client-facing, anything touching money, and anything a regulator or grant agreement covers. That is what the named human reviewer in the policy is for, and the policy should name a specific person rather than leaving it to someone.
- How long should this take to approve?
- One meeting. If a policy takes four, nobody will read it, and a policy nobody reads is not governance.