AI Acceptable
Use Policy Guide
A starting point for COA-accredited child and family service organizations at any stage of the AI journey.
Staff are already using AI tools today, with or without guidance. The question isn’t whether your organization will engage with AI, it’s whether that engagement is deliberate. COA calls the written answer an AI acceptable use policy. It turns “we’re figuring it out” into a clear, documented stance your board, funders, and MCP partners can see.
Our AI acceptable use policy supports our mission of , our vision of , our values of , and our strategic plan goal of .
Not Using AI? This Still Applies.
Your technology assessment must address AI whether or not you use it RPM 4.01. Staff must be trained on AI even if you prohibit it TS 2.02. Standard RPM 8 is marked not applicable only if your policy actually forbids staff from using AI.
So even an organization with no AI needs a written acceptable use policy, a technology assessment, and training.
Understand It Yourself
Build a personal baseline: try a real nonprofit-relevant prompt yourself before bringing anything to your team.
Establish Your Guardrails
A policy doesn’t need to be long, it needs to answer the ten decisions below clearly enough that any staff member can act on it.
Run a Risk-Benefit Analysis Before Each New Use RPM 8.01
Answer COA’s four questions in writing, then start at the low-risk end of the ladder below.
- What problem does it solve?
- Who benefits?
- Do those people want it?
- What are the risks, and how will you reduce them?
Keep the written results. Surveyors ask for them on site.
Start at 1. Earn your way to 5. Each rung gets its own one-page risk-benefit analysis.
Grant Research & Drafting in an Enterprise Chatbot
No client data; human review before anything ships.
Staff Training Content
Internal-facing; mistakes get caught in review.
Meeting Summaries
Approved tool only, with your consent process in use.
Clinical Documentation & Case Notes
The biggest prize, and last for a reason. PHI at the center of the legal record: compliant vendor, BAA, consent workflow, and a pilot first. AI may draft case notes only if the person who delivered the service reviews and approves each entry PRG 1.04 · FP.
Approved Tools
What staff may and may not use.
Prohibited Uses
No client PHI in consumer tools; no unapproved automation.
Confidentiality
How HIPAA, CMIA, and 42 CFR Part 2 apply to AI-assisted work.
Staff Training
Expectations and accountability for anyone using an approved tool.
Building Your Policy: Ten Decisions
These ten decisions are a starting point for an AI acceptable use policy. Work through them and fill in the boxes. Then review what you wrote with your compliance officer, legal counsel, and chief technology officer.
Sort Your Information Into Levels
A few clear categories, from regulated client data down to public material. The rules follow the information, not the device it is on. Collect and share only the data you need, and anonymize data before it goes into an AI tool RPM 4.04b · FP.
Your information levelsList the Tools Staff May Use
If it is not on the list, it is not approved. Products that embed AI count, including M365, Zoom, and EHR features, so nearly every organization falls under this. Confirm each vendor agreement actually covers the AI features, not just the product. Use the vendor questions in the template pack RPM 6.05 · FP RPM 6.02 · FP.
Your approved toolsChoose One Path for Sensitive Information
Name a single approved tool for your most protected data. One clear path is followed more reliably than a set of exceptions.
Your one approved path for sensitive informationState What Is Off Limits
Short, absolute rules that need no interpretation. A starting set is below. Some decisions can be AI-assisted, but each one must be documented and a person must stay accountable.
Your own off-limits rulesSay What Happens When Something Goes Wrong
Stop, do not delete anything, report right away. Name a contact and a number, and promise no retaliation for honest reporting.
Bring AI incidents and confidentiality violations into your quarterly risk review RPM 2.01 · FP CYD 6.03 · FP. Start an investigation within 24 hours of any incident involving harm RPM 2.02 · FP. Give the people you serve a way to report problems too.
Who staff report toName a Multidisciplinary AI Oversight Group RPM 8.06
One person or a group with vague duties falls short of full implementation. Give the group five named duties:
- Maintain the policy
- Answer stakeholder feedback
- Investigate harmful outcomes
- Approve and review tools and uses
- Monitor AI’s effect on service capacity
Score each proposed use against COA’s approval factors with the one-page scorecard in the template pack. Review the policy at least annually RPM 4.04d · FP, and again after any new tool, rule change, or close call.
Your AI oversight groupPublish a Policy the People You Serve Can Read RPM 8.03 · Fundamental Practice
Post the policy on your public website. Surveyors check it there. It must explain five things:
- Why, when, and how you use AI, including what data it collects
- The risks
- The safeguards
- How to give feedback or report harm
- How to opt out
If someone opts out, you serve them without AI or refer them to a provider who can. Write the disclosure language once and use it consistently.
Where the policy will be posted, and how people opt outTrain the Users and the Reviewers TS 2.02
Training covers four topics:
- Risks and ethics
- What use is acceptable
- The limits of each tool and staff’s oversight role
- Where to go with questions
Add refreshers whenever tools change. Put the policy in the personnel manual and have staff confirm they received it HR 3.02. Document who was trained and when.
Your training planBuild Oversight Mechanisms and a Decision Log RPM 8.05 · Fundamental Practice
Test AI tools before you deploy them. Check for bias. Review regularly what data each tool can reach. That last one is Copilot oversharing.
Log every AI-assisted decision that affects rights or safety. COA’s list is not limited to these: diagnosis or treatment; hiring, performance evaluation, promotion, or termination; risk of harm to self or others; resource allocation; eligibility, access to services, triage, and caseload balancing; adoption matching and child custody; and protective actions for children, older adults, or adults with disabilities. Use the log template in the template pack.
How you will track AI-assisted decisionsEngage Your Stakeholders RPM 8.07
Staff and the communities affected need ongoing ways to influence how you use AI. Then tell them what changed as a result. Adoption follows when people see their input land.
How you will gather and report back stakeholder inputYour answers are included in the PDF. They are not saved on this page, so download before you leave. In the print window that opens, choose “Save as PDF.”
The full guide, plus vendor questions, a risk-benefit analysis, an oversight group scorecard, and a decision log, in one fillable PDF. Print it or type into it. Fill in the form to get your copy.
Schedule yours: we’ll help turn this guide into a policy your board can sign off on.
Schedule Your Consultation →Have a Question?
Send us an email to info@advantagemicro.net
We’re here to help.