Staff trained on the policy
A policy nobody has read does not reduce risk.
Nonprofit organizations · AI usage policy and governance
A clear AI policy your staff will follow, written for how nonprofits actually work
Nonprofit staff are already using AI. Grant writers draft proposal sections, communications staff write social posts, and program staff summarize meeting notes. Some are using free tools with personal accounts and pasting in donor names, client stories or confidential program data. Leadership often knows this is happening but has not had the time to set rules.
How it often works today
- Staff use free personal AI accounts whose terms may allow the provider to retain or use what is entered, with no organizational oversight.
- Client case details and donor information are occasionally pasted into AI tools to save time, without anyone checking whether that is permitted.
- Some funders now ask whether AI was used in a proposal, and the grants team has no agreed answer or disclosure language.
- The board has asked about AI risk, and the executive director has no written policy or inventory of current use to show them.
We would help you write a short, practical policy: which tools are approved and on what plans, what information must never be entered, how AI-assisted work is reviewed, and how to disclose AI use to funders who ask. Then we would train staff and set up the approved tools so following the policy is easier than ignoring it.
The improved workflow
Survey current use
Run a short, no-blame survey of how staff use AI today, which tools, for what tasks and with what data, so the policy addresses real behavior.
Classify your data
Agree simple categories, such as public, internal, donor and client, and state which categories may be used with which approved tools.
Approve tools and settings
Select approved AI tools on organizational plans, configure data and retention settings, and retire personal accounts for any work-related use.
Write and train
Draft a two to three page policy, review it with leadership and counsel, then train staff with real examples from grant writing, communications and programs.
Review on a schedule
Revisit the policy every six months as tools, funder expectations and regulations change, with a named staff owner responsible for updates.
How we deliver this: AI automation for small business or fractional CTO leadership, scoped in writing and run over 90 days. See pricing or the sample scope.
What we would measure
Personal AI accounts used for work
Should fall to zero as approved tools are adopted.
Policy questions raised by staff
Shows where guidance is unclear and needs revision.
Where people stay in control
- Client, beneficiary and health information is prohibited from AI tools unless a specific, approved use with appropriate data terms is in place.
- All AI-assisted content sent to funders, donors or the public is reviewed and approved by a responsible staff member.
- The final policy is reviewed by leadership and your legal counsel; InTheory helps draft it but does not provide legal advice.
Example
A survey that changed the plan
For example, in an illustrative case a family services nonprofit with 35 staff runs a quick anonymous survey and finds that most staff use AI weekly, mostly on free accounts. A few admit to pasting client notes into a chatbot to draft case summaries. The policy prohibits that immediately, approves one organizational AI tool with retention controls, and sets up a reviewed template for case summaries that uses no identifying details. Staff training happens within two weeks.
Tools typically involved
Microsoft CopilotGemini for Google WorkspaceChatGPT TeamClaude for TeamsGoogle Workspace for Nonprofits
What the first 30 days look like
In the first 30 days we would survey staff on current AI use, review any data obligations in grant agreements and contracts, agree data categories with leadership, and draft the first version of the policy for counsel review. Approved tools would be chosen in parallel.
Common questions
Should we just ban AI tools?
A ban is simple to write but hard to enforce, and staff tend to keep using personal accounts quietly. A clear policy with approved tools usually reduces risk more, because it gives people a safe option for the useful tasks. The policy can still prohibit specific uses, such as entering client case details.
Does the Colorado AI Act apply to nonprofits?
Colorado's AI law, SB 26-189, addresses automated decision-making used in consequential decisions from January 1, 2027. Whether it applies to your organization depends on how you use AI, for example in hiring or eligibility decisions. Your counsel should advise on that; we would help you document how AI is used.
How should we answer funders who ask about AI use?
Agree a short, honest statement that describes how AI is used, such as for drafting or summarizing, and confirms that staff review and stand behind the content. Some funders have specific rules, so check each one's guidelines. We would draft standard language for your grants team to adapt.
The business case
Does it pay for itself?
Illustrative defaults for a nonprofit. Replace them with your numbers.
What this workflow costs today
a month in staff time, before any lost sales
Monthly fee + assumed tools +
Break-even: new clients a month (at first-year value)
Or: staff hours recovered and redeployed
Break-even additional revenue
Value of +1 point of win rate
First 90 days, service fee
Worth a closer lookTest the assumptions
Illustration only, not a forecast or guarantee. Recovered staff time becomes a cash saving only if spending actually declines or the time goes into paid work. Tool costs are an assumption; we replace every number here with yours before recommending a scope.
AI usage policy and governance in other industries
Accounting and CPA firmsArchitecture firmsFinancial advisory firmsLaw firmsMedical and specialty clinicsTax preparation offices
AI usage policy and governance: full guide
Related guides
Questions to ask a fractional CTOAI consultant red flagsGetting staff to adopt new toolsMicrosoft Copilot for small business
Terms used here
Next step
Bring one expensive workflow. Leave with a clear next step.
In 30 minutes we look at one recurring workflow, what it costs you today and whether there is a credible case to improve it. If there is not, we will say so.
Book a 30-minute workflow review
Not ready to talk? Take the 3-minute check
30 minutes with Phil or Martin. No technical brief, no pitch deck. Phil or Martin replies personally, usually within one business day.