Nonprofit AI Policy Template and the Decisions Behind It
What is a nonprofit AI policy template?
A nonprofit AI policy template is a short, fill-in document that sets how staff and volunteers may use artificial intelligence (AI) tools: what they can use them for, what data never goes in, who checks the output, and who owns and reviews the policy. This version has eight sections and fits on one page.
Almost two-thirds of nonprofits already use AI, the Center for Effective Philanthropy found in 2025, so someone on your staff may already paste grant drafts into a chatbot. The open question is what goes in next: a donor list, a client’s case notes, a board memo.
Most templates assume a technology lead. If you are the executive director and also the person who set up the shared drive, this nonprofit AI policy template is sized for you. AI is also one more change for organizations already absorbing funding cuts, the ground our guide to nonprofit crisis leadership covers.
Key Takeaways
- One page is enough. Write the data rule first, because it carries the most risk.
- Personal and confidential data stays out of public AI tools.
- The executive director owns the policy. The board approves the principles.
- Ask staff what they already use before you write rules.
- Set a review date, and review sooner after a new tool or a data mistake.
Does a Small Nonprofit Need an AI Policy?
Yes, if anyone on your staff or among your volunteers uses AI tools. An AI policy sets the rules for all AI use. An acceptable use policy is the narrower part that lists what staff may and may not do with the tools. A small nonprofit can fit both on one page.
In the Center for Effective Philanthropy survey, nonprofits using AI applied it mostly to communications (84%), internal productivity (63%) and fundraising (61%). Nonprofit leaders’ top worries were inaccurate results (73%) and data security and privacy (67%), the two risks a policy manages.
Larger nonprofits were slightly more likely to have AI policies, and 98% of foundations had none on grantee AI use, so do not wait for a funder to set your rules.
What Should a Nonprofit AI Policy Include?
A nonprofit AI policy should include eight sections: purpose and scope, principles, approved and prohibited uses, data protection, human review, disclosure, training, and ownership with a review date. Guides from TechSoup and Candid cover most of the same ground. Each section rests on one decision.
| Section | What it says | Who decides |
|---|---|---|
| Purpose and scope | Why it exists and who it covers | Executive director: add volunteers and contractors who touch your data |
| Principles | Three to five commitments, such as accuracy, privacy and mission fit | Board approves |
| Approved and prohibited uses | Tasks AI may and may not do | Executive director, with staff input |
| Data protection | What may go in, what needs approval, what never goes in | Executive director, with counsel for regulated data |
| Human review | Who checks output before it is shared or used in a decision | Executive director, by role |
| Disclosure | When you tell donors, funders or the public that AI helped | Board sets the principle |
| Training | What everyone learns before using AI tools | Executive director |
| Ownership and review | Contact person, mistake reporting, next review date | Executive director, reporting to the board yearly |
Candid calls its list of when not to use AI the most important section, citing eligibility decisions, crisis or trauma communications, and HR performance or disciplinary reviews. A person should make those calls.
Nonprofit AI Policy Template
Copy the outline below into a document, fill in the brackets and delete what does not apply. It is written for an organization of 3 to 15 staff with no IT lead. The AI policy template hosted by NTEN says it well: “some progress is better than no progress.”
- Purpose and scope. “This policy sets how [organization name] uses AI tools. It applies to staff, volunteers, contractors and board members doing our work.”
- Principles. “We use AI in service of our mission and to support human judgment, never to replace it. We protect the privacy of the people we serve, our donors and our staff.”
- Approved and prohibited uses. “Staff may use [approved tools] to draft, edit, summarize and brainstorm. Staff may not use AI to decide eligibility, to inform hiring or discipline, or to write to someone in crisis.”
- Data protection. “Never enter into a public AI tool names or contact details of clients, donors or staff, case notes, financial or health information about a person, passwords, or confidential material. Public information and internal drafts without personal details may be used. Ask [role] before entering anything else.”
- Human review. “A person reviews AI output before it leaves [organization name] or informs a decision, and the author owns the final version.”
- Disclosure. “We tell [donors, funders, the public] when AI [creates an image, drafts most of a published piece]. Asked whether we use AI, we answer plainly.”
- Training. “Everyone covered reads this policy, completes [a 30-minute session] and signs to confirm.”
- Ownership and review. “[Executive director] owns this policy. Questions go to [name], and mistakes are reported to [name] within [24 hours]. The board approved the principles on [date]. Next review: [date].”
For a longer draft, Fast Forward’s free Nonprofit AI Policy Builder takes about 20 minutes, and the North Carolina Center for Nonprofits lists sample AI policies to compare.
What Data Should Never Go Into AI Tools?
Personal and confidential data should stay out of public AI tools: names and contact details of clients, donors and staff, case notes, financial or health details about a person, passwords and anything under a confidentiality agreement. Public information and internal drafts without personal details carry far less risk. Fill in this section first.
The NTEN-hosted template sorts data into two tiers. Public program descriptions, high-level budget figures and internal drafts such as grant applications can go into AI tools without approval. Personal data and anything under a non-disclosure agreement needs a named person’s approval first. For public AI tools, the template above follows TechSoup’s stricter rule: “Do not share confidential, personal, or sensitive data with public AI tools.”
Organizations covered by the Health Insurance Portability and Accountability Act may not use AI tools with protected health information until the tool passes a security review and a signed agreement is in place, the NTEN-hosted template notes. For student records and other regulated data, ask counsel. This article is not legal advice.
Check whether each tool trains on what you type, and prefer tools with an opt-out, as the template advises. If personal data goes in by mistake, treat it as a data incident and use your crisis communication plan if people need to be told.
The data rule is the one section you cannot fix after the fact.
Who Owns It, and What Does the Board Approve?
The executive director owns the AI policy and names one person staff can ask day to day. The board approves the principles and how much risk the organization will accept, then hears back once a year. Candid advises involving the board early on values and accountability rather than on approving individual prompts.
If the line between governance and management is already blurry, sort out the board’s role before the policy reaches an agenda. Then name a second person who knows the policy. If one person holds all the knowledge, the organization is one resignation away from crisis, the single point of failure that undermines organizational resilience.
How Do You Introduce It Without Frightening Staff?
Introduce the policy by asking staff what they already use, then share a one-page draft and hold a short session to talk it through. Candid warns that fear-based rules can lead staff to avoid disclosing when AI helped them, which hides the very use the policy is meant to guide.
Ethical AI for nonprofits is mostly a people question. Almost two-thirds of nonprofits in the Center for Effective Philanthropy survey said none or only a few staff understand AI well, so start with questions. Name the staff fears about AI and change out loud, then offer a 30-minute kickoff and a one-page cheat sheet, as Candid suggests. The habits of leading people through change apply here too.
How Often Should You Review Your AI Policy?
Review your AI policy every six months while the tools change quickly, and sooner after a trigger event: a new tool, a data mistake, a funder requirement or a new executive director. Write the next review date into the policy itself.
Each time, ask what staff now use and what went wrong. The policy is one piece of a wider change in how you use technology, which our digital transformation guide covers.
Who Can You Think This Through With?
An AI policy asks the executive director to decide about people, data and trust, often alone. Peers, your board chair and free tools such as Fast Forward’s builder help with the document. A coach helps with the decisions themselves, from outside the organization’s politics.
Coaching will not change the board, the funders or the tools. It changes how you respond to them, and six sessions are often enough to show two or three patterns in how you decide. When a question is technical, such as privacy law, we say so during matching.
The Center for Nonprofit Coaching offers one-on-one coaching for the executive through volunteer coaches who donate their time, so six sessions cost $300, $400 or $600 for organizations with operating expenses under $250,000, under $500,000 or over $500,000, 85%+ below market rate. Coaching is for nonprofit leaders only.
This week, fill in the data section and send it to your board chair. The training plan can wait until next month.
If you lead a nonprofit, apply for coaching. If you sit on a board or fund one, you can fund coaching for a nonprofit leader.
Frequently Asked Questions
Can we use an AI policy template as-is?
Use it as a starting point. Fill in the brackets, cut what does not apply and check the data rules against what you actually hold. Candid warns against copying any template unchanged.
Should the policy name specific AI tools?
Keep approved tools in a short attached list, so you can update it without a board vote. Also decide whether staff may sign up with personal email addresses.
Who signs a nonprofit AI policy?
The executive director adopts it, and the board approves the principles at a regular meeting. TechSoup suggests asking each staff member to sign that they have read it.
A Thinking Partner for the Hard Decisions
Six confidential coaching sessions for nonprofit executive directors, from $300. Our volunteer coaches donate their time, which keeps fees 85%+ below market rate.
Apply for Coaching →
