AI Impact HubAI Policy Template
The policy you write together, in one meeting
For whoever owns "we should probably have a policy" — ops, the ED, or the accidental AI person.
Free account to download →Free. One password, and every file in the library is yours.
An Australian nonprofit with no AI policy had staff upload confidential client information to ChatGPT — and the organisation's response was a blanket two-year ban on all AI tools. That is what this template insures against. Roughly 70 to 80 per cent of an AI policy is the same across organisations; borrow this skeleton, spend your time on the decisions, and write it with the whole leadership team in one room.
Six sections make this policy work. Whether you have one or not, tap through honestly: does your current position cover each of these?
Purpose that grants permission
It covers staff, volunteers and contractors, and says out loud that you actively explore AI inside the rules — permission and boundary, not just restriction.
Approved tools, in tiers
A reviewed and paid-for list, an unreviewed default for everything else, and "if unsure, tier up" with a named person to ask.
The traffic-light data rule
Green (public) can go anywhere. Yellow (internal) goes in approved tools only. Red — client records, health information, donor personal and payment details, credentials — never enters any AI tool.
Connectors treated as decisions
AI tools now reach email, shared drives and CRMs in one click. Every new connection is approved by a named role first, and reviews check for permission creep.
Disclosure
You say when AI has materially helped produce something carrying your name, and a person remains accountable for it either way.
A review that actually recurs
Every two months, fifteen minutes, three questions — because capabilities change monthly, and policies written a year ago said nothing about connectors.
Nothing scored yet — start at the top.
A policy is not bureaucracy. It is insurance against the overreaction that follows a preventable mistake.
- Approved tools in three tiers — and the rule: if unsure, tier up
- The traffic-light data rule: Green anywhere, Yellow in approved tools only, Red never enters any AI tool
- The connector clause — every new integration is a policy decision, not a tick-box
- A disclosure line you adjust to your comfort
- The two-month review: fifteen minutes, three questions, on the calendar
- The one-meeting co-writing method, with the interview prompt that runs it
Take it with you.
Share it freely inside your organisation. That is what it is for.
Free account to download →