An AI policy for not-for-profits (with a free builder)
By Antonio Sawlwin, Red Dog AdvisoryPublished 4 November 20267 min read
If your charity has staff or volunteers, someone is probably already using an AI chatbot to draft an email, tidy a grant application or summarise meeting notes. That is fine. The risk is that nobody has said what is OK, and what is not.
A short policy fixes that. It does not need to be long. It needs to be clear enough that a new volunteer can follow it on their first day. Use the builder below to get a first draft, then edit it to suit.
Build a draft AI policy in five minutes
Answer a few questions and get a one-page policy you can edit and take to your board. Nothing you type is saved or sent anywhere.
[ORGANISATION NAME]: AI USE POLICY (DRAFT) 1. Purpose This policy explains how staff and volunteers at [Organisation name] may use artificial intelligence (AI) tools, so we get the benefit of them without putting the people we serve, our supporters or our reputation at risk. 2. Approved tools Staff and volunteers may only use AI tools approved by the CEO or Manager. A list of approved tools is kept and updated by that person. 3. What AI may be used for 3.1 Drafting emails, newsletters, social posts and other communications. A person reads, edits and approves everything before it is sent or published. 3.2 Summarising our own non-confidential documents and meeting notes. Meetings are only recorded or transcribed by AI when everyone has been told and can opt out. 4. What must never be entered into a public AI tool Do not enter any of the following into a free or publicly available AI chatbot or other generative AI tool: - Names or details of clients or people we support - Health, disability, cultural or other sensitive information - Information about children or young people - Donor names, contact details and giving history - Staff and volunteer records, including HR matters - Bank details, passwords and other credentials If you are not sure whether information is safe to enter, leave it out or ask first. 5. People stay accountable AI output is a draft. The person who uses it is responsible for its accuracy, tone and fairness. AI must not be the only basis for a decision about a person, such as a service, a referral or a job. 6. Being open about our use of AI Where the public deals directly with an AI tool, for example a chatbot or phone assistant, we say so clearly. Our privacy policy states that we use AI tools and what for. Where AI has materially shaped a document, we are open about it if a funder or partner asks. 7. Privacy Privacy law applies to personal information that goes into an AI tool and to the output it produces. We collect and use the minimum personal information needed and only for the purpose it was given to us. 8. Problems and questions Anyone who thinks a mistake has happened, such as entering information that should not have been shared, must tell the CEO or Manager straight away. Reporting a mistake early will not be treated as a disciplinary matter. 9. Review This policy is reviewed every 12 months and approved by the Board. Approved by: ____________________ Date: ____________ Draft prepared with the Red Dog Advisory AI policy builder. It is a starting point, not legal advice.
This draft is a starting point, not legal advice. Have your board review it, and check any funder or contract requirements.
What a good small-organisation policy covers
- Which tools are allowed, and who can approve new ones.
- What AI may be used for, such as drafting, summarising and research.
- What must never be entered, such as client details, health information and donor records.
- Who is accountable. A person always checks and owns the output.
- Openness. Say so when the public is dealing with an AI tool.
- What to do if something goes wrong, and a regular review date.
Why the "never enter" list matters most
Privacy obligations apply to personal information that goes into an AI tool and to what it produces. The Office of the Australian Information Commissioner (OAIC) recommends, as a matter of best practice, that organisations do not enter personal information, and particularly sensitive information, into publicly available AI chatbots.
For a charity that supports people, that usually covers client names and circumstances, health and disability details, and anything about children. Make that list specific, so no one has to guess.
Does the Privacy Act apply to us?
Not every not-for-profit is covered. The OAIC says the Privacy Act applies to a not-for-profit with annual turnover over $3 million. It also applies in other cases, such as an organisation that provides a health service, or one that is a contracted service provider for an Australian Government contract. Small organisations can also opt in. Check the OAIC page below for your situation. Even if the Act does not apply to you, funders and the people you support will expect you to treat their information with care.
Getting it adopted
- Draft it with the builder, then change the wording to sound like your organisation.
- Name one person who owns it and approves new tools.
- Take it to your board for approval and note the date.
- Walk staff and volunteers through it in 15 minutes. Use real examples.
- Put it in your induction pack and review it at least once a year.
If a chatbot or AI receptionist talks to the public, say so clearly and make sure your privacy policy covers it. The OAIC guidance below covers this.
If you would like help choosing tools or setting this up safely, book a free business check and we will start with what you actually do day to day.
Sources and notes
- OAIC: Guidance on privacy and the use of commercially available AI products
- OAIC: Privacy for not-for-profits, including charities
Want a second opinion on your numbers?
Book a free business check. We will look at where enquiries come from and where they are being lost, then tell you honestly what would help first.