How to write an AI policy for your nonprofit
By Ben Serunyigo, co-founder of Nimara · Updated October 2026
Picture last week at your organization. Someone used ChatGPT to tidy up a grant report. Someone else asked an AI tool to summarize a messy spreadsheet. Nobody broke a rule, because there isn't one yet. This guide helps you write that rule, in plain words, with your team.
An AI policy is a short set of rules your team agrees on before using AI, whether you're a US nonprofit or a UK charity. It should answer six questions: who is in charge, which tools are approved, what information never goes into AI, who checks the work, when you tell people AI helped, and what you do when something goes wrong. Write it together in one meeting, have your board or executive director approve it (in a UK charity, that's your trustees), and review it every six months.
- 1Where nonprofits and charities are today
- 2What the US and UK are doing about AI
- 3What the law says, and what's coming
- 4The six questions
- 5Write it in one meeting
- 6Reports worth your time
Where nonprofits and charities are today
If you feel behind, you're not alone: around the world, most nonprofits and charities are already using AI, but far fewer have written down how.
Source: NTEN and The Bridgespan Group, State of Nonprofit AI Adoption and Governance, September 2026, 917 nonprofit staff and executives in the US and around the world.
Country surveys point the same way. In the US, almost two in three nonprofits say they use AI in their work (CEP, 2025). In the UK, 79% of charities are using AI in 2026, but only 36% of small charities have an AI policy (Charity Digital Skills Report 2026, with the small-charity figure as reported by UK Fundraising).
Small organizations often hold the most sensitive stories with the fewest people, and many still have no written AI rules. If that's you, a short policy is one of the most useful things you can do this year.
Accuracy and trust are big worries too. In the US, 73% of nonprofit leaders told the Center for Effective Philanthropy they're concerned AI may produce misinformation or wrong results (CEP, 2025). In the UK, 35% of charities say they don't trust AI tools, more than double the year before (Charity Digital Skills Report 2026). A good policy speaks to those worries directly by saying where AI helps and where people stay in the room.
What the US and UK are doing about AI
Both governments have big AI plans, and neither one is written for nonprofits or charities. Here's the part that matters if you lead one.
If you're in the US
- A national plan, not a law. In July 2025, the White House published America's AI Action Plan, with more than 90 recommended federal actions. It's about growth and fewer rules, it doesn't fund nonprofit AI work, and there's still no federal AI law.
- Free training from the sector. There's no single free federal AI course, but your staff and volunteers still have options. Goodwill offers Google's AI Essentials course for free and OpenAI Academy is free to join, while TechSoup has an on-demand AI course with Microsoft.
If you're in the UK
- A national plan. The government's AI Opportunities Action Plan came out in January 2025 with 50 recommendations, and a year later the government said 38 of them had been met.
- Free AI courses for every adult. Anyone in the UK can take free AI courses on the AI Skills Hub, some of them under 20 minutes long, and the government wants 10 million workers to have AI skills by 2030. Charity Excellence and Microsoft also offer free AI courses made for charities.
What neither plan does is write your rules. There's no legal requirement for nonprofits or charities to have an AI policy, and no AI law that tells you what to put in one. Your policy is how your organization shows funders and the people you serve that you use AI with care.
Sources: The White House, America's AI Action Plan; Wilson Center, America's AI Action Plan after one year; UK government, AI Opportunities Action Plan: One Year On and free AI training for all; Civil Society, free AI training for UK charities.
What the law says, and what's coming
Neither the US nor the UK has an AI law for nonprofits or charities. But the laws you already follow still apply when AI is involved, so here's a short version of what applies in each country.
If you're in the US
- Privacy. Most privacy law in the US is state law, so which rules cover you depends on your state and your size. Colorado, Oregon, Delaware, Minnesota and Maryland have privacy laws that can cover nonprofits, although many small nonprofits fall below their thresholds (Wagenmaker & Oberly).
- Health and student records. If you run a clinic, or handle health information for a clinic or hospital, HIPAA may apply, and any AI tool that touches that information needs a Business Associate Agreement first. If a school shares student records with you, FERPA and your written agreement with the school set the rules.
- Fair treatment and hiring. Civil rights laws still apply when AI helps make a decision about a person. In hiring, Illinois requires employers to give notice when they use AI, and New York City requires a bias audit and a notice to candidates before automated hiring tools are used.
- Honest claims. The FTC says that "using AI tools to trick, mislead, or defraud people is illegal" (FTC, 2024).
If you're in the UK
- Data protection. UK GDPR and the Data Protection Act 2018 apply to charities in the same way they apply to companies, and there's no exemption for charitable status.
- Automated decisions. Since February 5, 2026, the Data (Use and Access) Act has allowed more decisions to be made by automated systems alone, but only if you tell people about the decision, let them challenge it and let them ask for a person to step in (UK government).
- Equality. The Equality Act 2010 applies to AI tools, including in hiring, so check them for unfair results and make reasonable adjustments for disabled applicants.
- Trustees. In England and Wales, the Charity Commission says trustees remain responsible for decisions when AI is used, and that charities should consider whether an internal AI policy would help (Charity Commission, 2024). The voluntary Charity Governance Code, updated in 2025, now suggests a policy for technology and AI tools as well (Trowers & Hamlins).
What's coming: in the US, Colorado has passed a law, due to start in 2027, that gives people a notice and a human review when automated systems help make big decisions about them, like jobs or housing. It's being challenged in court, so the details may still change (Holland & Knight). In the UK, an AI bill has been expected for some time but hasn't appeared yet (Lewis Silkin). If your policy already says "we explain how AI was used, and a person can look again," you're ready either way.
Here's the simple rule: even where a law doesn't strictly apply, treat personal information as if it does. The people you serve and your funders expect it.
The six questions your policy must answer
You don't need a long document: two pages your team actually reads beat twenty pages nobody opens. Answer these six questions, and you have a policy.
1Who is in charge?
Pick one person to be your AI lead, and they don't need to be technical. They keep the list of tools, answer questions and bring the policy back for review. Then decide who approves the policy, which is usually you as executive director or chief executive, or your board (your trustees, in a UK charity). Write down names or roles, not "the team".
2Which tools are approved?
List every AI tool your team may use. For each one, write down who owns it, where it keeps your data, and whether it uses your data to train its AI, and turn that setting off where you can. If you're a UK charity using a tool from a US company, check that the company is signed up to the UK Extension of the EU-US Data Privacy Framework (the "UK-US data bridge"). If someone wants to try a tool that isn't on the list, they ask the AI lead first, and that one habit prevents most problems.
3What information never goes into AI?
Give your team a traffic light that's easy to remember when someone is busy and in a hurry.
- GREENPublic information and drafts with no names are OK in any approved tool.
- YELLOWInternal information, like budgets or grant drafts with no names. Only in approved tools, with training on your data turned off.
- REDAnything about a person: the people you serve, donors, volunteers and staff, plus health, money, housing, immigration and safety details. Never in chat tools or personal accounts.
4Who checks the work?
Write one rule everyone can repeat, like ours:
AI can hold the pen. Only a person signs.
A person checks every fact before anything leaves your organization. And AI never decides who gets help, money or a job, though it can sort, summarize and flag. A person makes every decision about a person.
5When do you tell people AI helped?
People trust you more when you're open about AI, so decide where you'll say so: in email signatures, reports, grant applications and images. A simple line works: "Written with AI assistance. Reviewed by a person."
And tell the people you serve when AI is part of a service that affects them, and always offer them a person instead.
6What happens when something goes wrong?
Something will go wrong at some point, and that's normal. Decide now what your team does: stop using the tool, tell the AI lead the same day, fix the harm, and tell anyone affected quickly. Then write down what happened and what you changed, so it doesn't happen twice.
How to write it in one meeting
You can do this with the people you already have, and here's how we'd run it.
Our free AI Policy Kit has everything for this meeting: the policy in two versions, a staff card, a session guide and eleven scenario cards. We built it on Canadian privacy law, so check its legal notes against the laws that apply to you.
Keep it working
A policy only helps if people use it, and these four habits keep it alive:
- Keep a register. One spreadsheet lists every AI tool and automation, who owns it and how to switch it off.
- Train new people. Walk every new staff member and volunteer through the staff card when they start.
- Report to your board or trustees. Ask three questions each quarter: what are we using, what went wrong, and what are we changing? See the 12 questions your board should ask →
- Review every six months. AI tools change fast. Update the tool list and the rules, and get the policy approved again.
If AI works inside your systems
Some AI does more than write: it can sort forms, update records or send messages. That's where a person saying yes matters most.
In 2025, government AI safety institutes from several countries, including the UK, tested AI helpers on 156 tasks in each of nine languages. They checked whether the helpers leaked private information or fell for fraud. Even the best result in any language was only about 57% of tasks handled safely (International Network joint testing report, 2025). That's why these rules matter so much once AI can act on its own:
- Start read-only. The helper can read and draft. It gets more access only when you decide that in writing.
- A person says yes first before it sends, deletes, pays or changes a record.
- Give it its own account, never a staff member's login, so you can shut it off without locking anyone out.
- Every automation has an owner and an off switch, listed in your register.
If your systems aren't connected yet, that's the place to start, since AI works best on clean, connected information. See how we connect systems first →
Reports worth your time
You don't have to read all of these. But if your board asks "where did this come from?", here's where to point them.
- Global · NTEN and The Bridgespan Group · September 2026State of Nonprofit AI Adoption and Governance →
A recent picture of how nonprofits use and govern AI, from 917 staff and leaders in the US and around the world. Read it to see where written guidance and staff training stand.
- Center for Effective Philanthropy · September 2025AI With Purpose →
How 451 US nonprofit leaders feel about AI, including their worries about accuracy and how few funders have talked with them about it.
- Zoe Amar Digital · July 2026Charity Digital Skills Report 2026 →
The yearly check on UK charities' digital skills, with 807 charities taking part. Read it to see how you compare on AI use, skills and board confidence.
- Charity Commission · April 2024Charities and artificial intelligence →
The regulator's short note for trustees in England and Wales. Trustees stay responsible for decisions, and an internal AI policy is worth considering.
- NIST · 2023 and 2024AI Risk Management Framework →
A voluntary US framework for managing AI risks, with a separate profile for generative AI. Good for teams moving AI into their systems.
- Information Commissioner's OfficeGuidance on AI and data protection →
The UK data protection regulator's guidance on using AI with personal information. It's under review after the new data law, so check for updates.
- National Cyber Security Centre · 2024AI and cyber security: what you need to know →
Plain questions about AI and security for boards and senior managers. Hand it to whoever looks after your IT.
- UK government · freeAI Skills Hub →
Free AI courses for every adult in the UK, some of them under 20 minutes, which pair well with your policy meeting.
- Goodwill and Google · freeGoogle AI Essentials through Goodwill →
A free AI basics course for your US staff and volunteers. Check that free places are still open before you share it.
Five common mistakes
- Copying a template from another country. A policy cites the laws of the place it was written for. Yours should reflect your state's privacy laws or UK data protection law, and the work you actually do.
- Banning AI outright. Staff often keep using it on personal accounts, where you have no control at all. Clear rules work better than a ban.
- Writing it alone. A policy written by one person misses how the work really happens. Include the front line.
- No owner. If nobody is named as the AI lead, nobody updates the tool list, and the policy goes stale.
- Forgetting the people you serve. Say how you'll tell them about AI and how they can ask for a person.
Questions people ask
Does the law require a nonprofit or charity to have an AI policy?
No law in the US or the UK requires one yet. But privacy, equality and employment laws still apply when you use AI, and a written policy is the clearest way to show you follow them. In England and Wales, the Charity Commission also suggests charities consider having one.
What do the US and UK AI plans mean for my organization?
Not much in your day-to-day work. America's AI Action Plan is about growth and fewer rules, and the UK's AI Opportunities Action Plan comes with free AI courses for every adult in the UK. Neither one requires you to have an AI policy, so your own policy is still how you show funders and the people you serve that you use AI with care.
How long should our AI policy be?
Short enough that people read it, which for most nonprofits and charities means two to five pages. Put the most-used rules on a one-page staff card.
Should we ban ChatGPT?
Usually no: bans tend to push staff toward personal accounts, where you can't see or protect what they share. It's safer to approve the tools you trust, set clear rules on information and check the work.
Do we need a lawyer to write it?
You can write the first version yourselves using a template. Have a lawyer or privacy professional review it before approval, especially if you handle health, children's or other sensitive information.
Who should approve the policy?
Your board or executive director in the US, and your trustees in a UK charity. Many boards approve the policy itself and let the executive director or chief executive keep the tool list up to date.
Do we have to tell donors when we use AI?
It's a good idea, and being open about it protects trust. In the UK, the Fundraising Regulator says charities should make AI-generated content and chatbots clear to donors. Say where AI helped in reports, appeals and grant applications, and keep a person responsible for everything you send.
You don't have to start from a blank page.
Our free kit has the policy in two versions, a staff card, an AI register, a board brief and a session guide, all in plain language and free to use and change. We built it on Canadian privacy law, so the staff rules, register and board brief work anywhere, but check the legal notes against the laws that apply to you.
Get the free kit →Read Nimara's own AI policy
If you want help putting it in place, we help nonprofits and charities set their AI rules, train their teams and build AI into everyday work, now or when they're ready. Book a Call →
AI can hold the pen. Only a person signs.
Updated October 2026. This guide is general information, not legal advice. Written with AI assistance. Reviewed by a person.
