Who it suits
Any organization with staff or volunteers and no AI policy, or a long one nobody has read.
The problem
Most AI policies fail by being too long. A twelve-page document from a template covers everything and changes nothing, because nobody reads it and nobody can remember it under pressure.
A policy a small team will follow fits on one page and answers eight questions. It names the tools, the account, the never-paste list, and who to ask. It is written in the words your team uses. This checklist is the eight questions. Answer them and you have the policy.
The checklist
- Which tools are approved?
Name them. Two or three is normal. Everything else is not approved until someone asks.
- Which accounts do we use?
The organization's workspace, not personal accounts. Say who sets people up and who removes access.
- What may never go into an AI tool?
Your never-paste list. Client details, account numbers, health information, anything under a confidentiality agreement, passwords.
- What is fine to use it for?
Name the everyday uses, such as drafting, summarizing public material, and cleaning up your own writing. Say it plainly so people are not afraid to use the tool for what it is good at.
- Who checks the output?
The person who uses the tool is responsible for what they send, and AI drafts get read before they go out. Say that once in the policy.
- Do we tell people when AI was involved?
Decide for client-facing work, grant writing, and board materials. A simple rule is better than a clever one.
- Who do we ask?
One named person. Questions go there, not to a group chat.
- When do we review this?
A date, no more than a year out, and the name of the person who owns it.
If you find a problem
If your answers to questions 1 through 3 are "we do not know," stop and run the chatbot checklist first. The policy is only as good as the facts under it. Once you have the eight answers, put them on one page, have everyone read and sign it, and keep the signed copies with your other staff records.