Practical AI Readiness
Nonprofit AI Policy: Four Critical Decisions Your Staff Need Right Now
You don't need a finished AI policy to give your team real guidance. You need four decisions. Here's what they are and why they matter first.
Most nonprofit leaders know they need an AI policy. They also know they do not have one yet. And in the gap between those two facts, staff are making their own calls: using tools that seemed fine, entering information that felt okay, improvising in ways that nobody planned for and nobody reviewed.
A finished nonprofit AI policy is worth building. But it takes time, it needs legal review, and it requires decisions that your organization may not be ready to make all at once.
Here's what you can do right now: Make the four decisions that prevent the most common, and most serious, problems. That's your minimum viable nonprofit AI policy. Not a document. Not a compliance exercise. Four clear calls that give your team actual guidance while you work toward something more formal.
The Four Decisions
This is the most important decision and the one most organizations skip because it feels hard to get exactly right. Don't wait until it's exactly right.
Start with the obvious categories: client records, donor information with personal details, staff personnel files, health information of any kind, legal documents, and anything your organization is contractually or legally obligated to protect.
The rule does not need to be complicated. It needs to be clear enough that a staff member knows, without asking, whether something crosses the line. If client intake forms are on the list, they're on the list. If donor names and giving history are on the list, they're on the list.
Write it down. Communicate it. That alone closes the gap that causes most of the problems.
Your staff aren't waiting for your nonprofit AI policy to start using AI. They are using it now, or they will be soon. The question is whether they have any guidance about which tools are acceptable.
You do not need to evaluate every AI tool on the market. You need a short, current list of what is approved for organizational use, under what conditions, and what is not approved pending further review.
Approved does not mean forever. It means reviewed well enough to use now, with the understanding that terms change, features change, and the list will be updated.
Not approved does not mean never. It means not yet reviewed, or reviewed and found to have unresolved concerns.
Post the list somewhere staff can find it. Update it when something changes.
This is the decision that makes every other decision work.
If a staff member is unsure whether something is allowed, and there is no clear answer and no clear person to ask, they will either do nothing or make the call themselves. Neither of those is a nonprofit AI policy.
Name a person. Give them the authority to answer questions and make judgment calls. Make sure staff know who that person is and how to reach them.
In most nonprofits, this is the executive director, the operations director, or whoever owns technology decisions. It does not need to be a new role. It needs to be a named responsibility.
Someone will eventually realize they shared something they shouldn't have. A tool will behave unexpectedly. A staff member will discover a feature nobody knew existed.
Before that happens, decide how incidents get reported and who handles it.
The reporting path does not need to be complicated. It needs to exist and it needs to be communicated before there's an incident, not after. Critically, staff need to know they can report an honest mistake without it becoming a disciplinary matter. A culture where people are afraid to report problems is a culture where problems stay hidden.
What These Four Decisions Do Not Replace
They do not replace a legal review. They do not replace a full nonprofit AI policy. They do not cover every situation your organization will eventually face.
What they do is stop the worst outcomes from happening while you build toward something more complete. They give your staff real guidance today, and they give your leadership a documented record of the decisions that were made and when.
That is worth more than a perfect nonprofit AI policy that is still six months away.
Next Step
Build Your Full Nonprofit AI Governance Structure
You've made the four decisions. Now scale them into a complete nonprofit AI policy and governance framework.
The Nonprofit Practical AI Readiness program walks you through everything: mapping sensitive data, documenting current AI use, evaluating vendor risk, formalizing your rules, and drafting your full AI policy.
You're already ahead of most nonprofits. Let's finish the work.