AI Acceptable
Use Policy Guide
A starting point for COA-accredited child and family service organizations at any stage of the AI journey.
Staff are already using AI tools today, with or without guidance. The question isn’t whether your organization will engage with AI, it’s whether that engagement is deliberate. COA calls the written answer an AI acceptable use policy. It turns “we’re figuring it out” into a clear, documented stance your board, funders, and MCP partners can see.
Prepared for Date
Tie It to Your Mission RPM 4.04c · FP
Our AI acceptable use policy supports our mission of , our vision of , our values of , and our strategic plan goal of .
Our AI acceptable use policy supports our mission of , our vision of , our values of , and our strategic plan goal of .
Not Using AI? This Still Applies.
Your technology assessment must address AI whether or not you use it RPM 4.01. Staff must be trained on AI even if you prohibit it TS 2.02. Standard RPM 8 is marked not applicable only if your policy actually forbids staff from using AI.
So even an organization with no AI needs a written acceptable use policy, a technology assessment, and training.
The 3-Stage Framework
1
Understand It Yourself
Build a personal baseline: try a real nonprofit-relevant prompt yourself before bringing anything to your team.
2
Establish Your Guardrails
A policy doesn’t need to be long, it needs to answer the ten decisions below clearly enough that any staff member can act on it.
3
Run a Risk-Benefit Analysis Before Each New Use RPM 8.01
Answer COA’s four questions in writing, then start at the low-risk end of the ladder below.
- What problem does it solve?
- Who benefits?
- Do those people want it?
- What are the risks, and how will you reduce them?
Keep the written results. Surveyors ask for them on site.
First Use Cases, in Order of Risk
Start at 1. Earn your way to 5. Each rung gets its own one-page risk-benefit analysis.
1
Grant Research & Drafting in an Enterprise Chatbot
No client data; human review before anything ships.
2
Staff Training Content
Internal-facing; mistakes get caught in review.
3
4
Meeting Summaries
Approved tool only, with your consent process in use.
5
Clinical Documentation & Case Notes
The biggest prize, and last for a reason. PHI at the center of the legal record: compliant vendor, BAA, consent workflow, and a pilot first. AI may draft case notes only if the person who delivered the service reviews and approves each entry PRG 1.04 · FP.
Hiring Is a Use Case Too. If AI screens resumes, it needs regular bias audits HR 2.
5 Components Every Policy Should Cover
Approved Tools
What staff may and may not use.
Prohibited Uses
No client PHI in consumer tools; no unapproved automation.
Confidentiality
How HIPAA, CMIA, and 42 CFR Part 2 apply to AI-assisted work.
Staff Training
Expectations and accountability for anyone using an approved tool.
Building Your Policy: Ten Decisions
These ten decisions are a starting point for an AI acceptable use policy. Work through them and fill in the boxes. Then review what you wrote with your compliance officer, legal counsel, and chief technology officer.
This guide addresses the areas COA describes in its 2026 AI standards. Dark tags mark Fundamental Practices (FP). Use it with your COA standards manual and your accreditation consultant.
1
Sort Your Information Into Levels
A few clear categories, from regulated client data down to public material. The rules follow the information, not the device it is on. Collect and share only the data you need, and anonymize data before it goes into an AI tool RPM 4.04b · FP.
Your information levels2
List the Tools Staff May Use
If it is not on the list, it is not approved. Products that embed AI count, including M365, Zoom, and EHR features, so nearly every organization falls under this. Confirm each vendor agreement actually covers the AI features, not just the product. Use the vendor questions in the template pack RPM 6.05 · FP RPM 6.02 · FP.
Your approved tools3
Choose One Path for Sensitive Information
Name a single approved tool for your most protected data. One clear path is followed more reliably than a set of exceptions.
Your one approved path for sensitive information4
State What Is Off Limits
Short, absolute rules that need no interpretation. A starting set is below. Some decisions can be AI-assisted, but each one must be documented and a person must stay accountable.
Your own off-limits rules5
Say What Happens When Something Goes Wrong
Stop, do not delete anything, report right away. Name a contact and a number, and promise no retaliation for honest reporting.
Bring AI incidents and confidentiality violations into your quarterly risk review RPM 2.01 · FP CYD 6.03 · FP. Start an investigation within 24 hours of any incident involving harm RPM 2.02 · FP. Give the people you serve a way to report problems too.
Who staff report to6
Name a Multidisciplinary AI Oversight Group RPM 8.06
One person or a group with vague duties falls short of full implementation. Give the group five named duties:
- Maintain the policy
- Answer stakeholder feedback
- Investigate harmful outcomes
- Approve and review tools and uses
- Monitor AI’s effect on service capacity
Score each proposed use against COA’s approval factors with the one-page scorecard in the template pack. Review the policy at least annually RPM 4.04d · FP, and again after any new tool, rule change, or close call.
Your AI oversight group7
Publish a Policy the People You Serve Can Read RPM 8.03 · Fundamental Practice
Post the policy on your public website. Surveyors check it there. It must explain five things:
- Why, when, and how you use AI, including what data it collects
- The risks
- The safeguards
- How to give feedback or report harm
- How to opt out
If someone opts out, you serve them without AI or refer them to a provider who can. Write the disclosure language once and use it consistently.
Where the policy will be posted, and how people opt out8
Train the Users and the Reviewers TS 2.02
Training covers four topics:
- Risks and ethics
- What use is acceptable
- The limits of each tool and staff’s oversight role
- Where to go with questions
Add refreshers whenever tools change. Put the policy in the personnel manual and have staff confirm they received it HR 3.02. Document who was trained and when.
Your training plan9
Build Oversight Mechanisms and a Decision Log RPM 8.05 · Fundamental Practice
Test AI tools before you deploy them. Check for bias. Review regularly what data each tool can reach. That last one is Copilot oversharing.
Log every AI-assisted decision that affects rights or safety. COA’s list is not limited to these: diagnosis or treatment; hiring, performance evaluation, promotion, or termination; risk of harm to self or others; resource allocation; eligibility, access to services, triage, and caseload balancing; adoption matching and child custody; and protective actions for children, older adults, or adults with disabilities. Use the log template in the template pack.
How you will track AI-assisted decisions10
Engage Your Stakeholders RPM 8.07
Staff and the communities affected need ongoing ways to influence how you use AI. Then tell them what changed as a result. Adoption follows when people see their input land.
How you will gather and report back stakeholder inputPractical Tip: Split the Document in Two. Keep a public policy for your website (decision 7) and a set of internal procedures. Tool settings and security details belong in the procedures, off the website.
A Starting Set of Off-Limits Rules
No client or organizational information in personal or consumer AI accounts.
No AI-generated clinical judgment: no diagnoses, assessments, or treatment decisions.
AI may assist with decisions that affect rights or safety (hiring and personnel actions, risk-of-harm assessment, resource allocation, eligibility, access to services, triage, caseload balancing, adoption matching, custody, and protective actions for children, older adults, and adults with disabilities) only when the decision is documented and a named person stays accountable for it RPM 8.05.
Nothing AI produces gets filed or sent until a qualified person has reviewed and edited it. Someone is also accountable for reviewing AI output quality on an ongoing basis, not just item by item.
No AI note-takers or meeting assistants in client sessions until a documented consent process is in place.
Your most legally protected records stay out of every AI tool, without exception.
Before You Publish
Claim only the safeguards you have actually turned on. A policy describing controls you do not have is a liability, not a protection.
Surveyors check your policy on your public website RPM 8.03. A policy you cannot demonstrate in practice is worse than no policy.
Give staff a procedure for anything you require of them, not just the requirement.
Confirm what your vendor agreements cover. Do not assume.
A starting point, not legal advice. This guide is an educational resource. Your obligations depend on your programs, contracts, funders, and the populations you serve. Review any policy you adopt with your compliance officer and legal counsel before publishing, and revisit it with them as tools and regulations change. This guide addresses the areas COA describes in its 2026 AI standards. It is not a substitute for the COA standards manual or for guidance from your accreditation consultant.
Finished Online?
Download Your Completed Guide
Your answers are included in the PDF. They are not saved on this page, so download before you leave. In the print window that opens, choose “Save as PDF.”
Prefer a Hard Copy?
Download the Guide and Template Pack
The full guide, plus vendor questions, a risk-benefit analysis, an oversight group scorecard, and a decision log, in one fillable PDF. Print it or type into it. Fill in the form to get your copy.
Need Expert Guidance?
30-Minute AI Consultation
Schedule yours: we’ll help turn this guide into a policy your board can sign off on.
Schedule Your Consultation →Steven Hart, CEO · shart@advantagemicro.net · 415.300.3550
Have a Question?
Send us an email to info@advantagemicro.net
We’re here to help.