Nonprofit & Community AI Policy Template

Purpose: We use AI only when it advances our mission and provides a clear benefit over a reasonable non-AI approach.

Scope: This policy applies to staff, volunteers, board members, contractors, vendors, and AI features within other software.

Human responsibility: A named person remains accountable for every material output and consequential decision.

Privacy: Sensitive information may be used only in approved systems for an authorized purpose with appropriate safeguards.

Accuracy and fairness: Important outputs must be verified and reviewed for unequal or exclusionary effects before use.

Transparency and remedy: We explain material AI use when it affects trust or decisions and provide a way to question or correct harm.

Accessibility: Essential information and services remain available through accessible and non-AI alternatives.

Review: Approved uses are monitored, documented, and reconsidered after material changes, complaints, incidents, or at least annually.

The mission need, intended benefit, affected people, and non-AI alternative are documented.

The proposed inputs contain no unnecessary sensitive or identifying information.

The output can be checked using named sources, expertise, or performance measures.

Possible errors, bias, exclusion, deception, accessibility barriers, and downstream harms are documented.

A qualified person has authority to override the output and stop the use.

The vendor, cost, contract, security, retention, training use, ownership, and deletion terms were reviewed.

People have notice, an accessible alternative, and a clear route to question or correct the outcome.

The approval owner, conditions, monitoring evidence, renewal date, and exit plan are recorded.

We know exactly what information will be entered and why each field is necessary.

Client, donor, employee, volunteer, child, health, financial, credential, and case information is excluded unless specifically authorized and protected.

Fictional, aggregated, redacted, or de-identified information cannot reasonably be linked back to a person.

The provider’s retention, model-training, sharing, deletion, and account controls are documented.

Access is limited to authorized people and multifactor authentication is enabled where available.

The information owner and affected people received any notice or consent the situation requires.

A retention and deletion schedule exists for inputs, outputs, logs, and exported files.

Staff know how to report an accidental disclosure immediately.

What data does the system collect, infer, retain, share, and use for training?

Which subcontractors, models, hosting locations, and security controls are involved?

What independent evidence supports accuracy, safety, fairness, and accessibility claims?

How can our organization configure accounts, permissions, retention, and training controls?

How quickly will the vendor notify us of incidents, major changes, or discontinued safeguards?

Can affected people receive an explanation, correction, appeal, or human contact?

Who owns inputs and outputs, and what copyright or licensing restrictions apply?

Can we export our records, delete our data, end the service, and continue the work without lock-in?

What AI assisted with and why it was used.

What information the system received—and what information was intentionally excluded.

Which parts a qualified person checked, changed, or approved.

Known limitations, uncertainty, or areas where the output should not be relied upon alone.

An accessible non-AI option when AI affects access to information or services.

The person or office to contact with a question, correction, complaint, or accessibility request.

Stop or contain the affected workflow without deleting evidence needed for review.

Protect people first; contact emergency, safeguarding, legal, or security support when the situation requires it.

Record the tool, account, time, people affected, information involved, output, decision, and actions already taken.

Notify the policy owner and the people responsible for privacy, security, programs, communications, and leadership as appropriate.

Determine what affected people should be told, how they can receive support, and how an incorrect record or decision will be corrected.

Identify the root cause, required vendor action, policy or training change, and conditions for restart—or retire the use.