AI Acceptable
Use Policy Guide

Understand It Yourself

Build a personal baseline: try a real nonprofit-relevant prompt yourself before bringing anything to your team.

Establish Your Guardrails

A policy doesn’t need to be long, it needs to answer the eight decisions below clearly enough that any staff member can act on it.

Identify Your First Use Case

Start at the low-risk end of the ladder below: no client PHI, a real recurring burden, and a human review before anything ships.

Grant Research & Drafting in an Enterprise Chatbot

No client data; human review before anything ships.

Staff Training Content

Internal-facing; mistakes get caught in review.

Family FAQs in Plain Language

External-facing; review for accuracy and reading level.

Meeting Summaries

Approved tool only, with your consent process in use.

Clinical Documentation & Case Notes

The biggest prize, and last for a reason. PHI at the center of the legal record: compliant vendor, BAA, consent workflow, and a pilot first.

Sort Your Information Into Levels 1.A.5.a(3) 1.A.5.a(4)

A few clear categories, from regulated client data down to public material. The rules follow the information, not the device it is on.

List the Tools Staff May Use 1.A.5.a(1) 1.A.5.a(4) 1.A.5.a(5)

If it is not on the list, it is not approved. Confirm each vendor agreement actually covers the AI features, not just the product. Ask vendors to explain how the tool works, what data trained it, and whether that data represents the people you serve. Your data use agreements should limit how exported data can be used.

Choose One Path for Sensitive Information 1.A.5.a(4)

Name a single approved tool for your most protected data. One clear path is followed more reliably than a set of exceptions.

State What Is Off Limits 1.A.5.a(5)

Short, absolute rules that need no interpretation. A starting set is below.

Say What Happens When Something Goes Wrong 1.A.5.a(6)

Stop, do not delete anything, report right away. Name a contact and a number, and promise no retaliation for honest reporting. Define what counts as an incident, both inside the organization and to the person served, and who must be notified.

Name an Owner and a Governance Committee 1.A.5.a(5) 1.A.5.b

One accountable person, plus a multidisciplinary committee that oversees your AI work. It can include clinicians, IT, legal counsel, and persons served. Its role is to vet new tools, create policies, and check compliance. The owner convenes it. Keep a clear chain of accountability, so that if an AI system contributes to an error or harm, you know who is responsible. Check the tools regularly for bias, data drift (when the data a tool was trained on no longer fits), and unexpected errors. Review policies at least annually, and again after any new tool, rule change, or close call.

Tell the People You Serve 1.A.5.a(2)

Disclose your use of AI in service delivery, and separately for any analysis or processing of their health information. Recording consent is not the whole obligation. Write the disclosure language once and use it consistently.

Train the Users and the Reviewers 1.A.5.a(5)

Regular training for staff using AI tools, and separate training for the people responsible for oversight. Training should cover how the AI works, what it can and cannot do, ethical considerations, and how to use it in daily work. Document who was trained and when.