No. 16
The One-Page AI Policy Every Small Business and Nonprofit Should Have
Your staff are probably already using AI. A simple, one-page policy protects your customers, your data and your team. Here's a plain-language template you can adapt today, and the reasoning behind each line.
The Tea the short version
- Your team is probably already using AI tools, with or without a policy.
- A good policy fits on one page and answers four questions: what's allowed, what's never allowed, who decides, and what happens when something goes wrong.
- Protect customer data first. That's where most real risk lives.
- Copy the template below, adapt it, and review it every six months.
Here's something I tell every nonprofit board and small business owner I work with: your team is already using AI.
Someone's drafting emails with it. Someone pasted a grant narrative into it last week. Someone's using a free transcription app in client meetings. None of that is necessarily bad. But if you don't have a policy, everyone is making up their own rules, and you won't find out until something goes wrong.
The good news: you don't need a 40-page governance document. You need one page that people will actually read.
Why one page
Long policies don't get read. A one-page policy can be printed, posted by the coffee maker, and reviewed in a staff meeting in 15 minutes. That's the version that changes behavior.
It also fits how most small organizations actually work. The U.S. Census Bureau's research finds that most AI-using firms keep it narrow, three or fewer business functions, and that 66% use AI only to help people with tasks rather than replace them (Census Bureau working paper). Your policy should match that reality: practical, focused on everyday use.
If you want a deeper framework later, the NIST AI Risk Management Framework is the gold standard, and it's free. But start with this.
The template
Copy this. Change the bracketed parts. Delete what doesn't apply.
[Organization Name] AI Use Policy Last reviewed: [date]. Next review: [date + 6 months]. Owner: [name].
Why we have this policy. AI tools can help us work faster and serve people better. They can also make mistakes, leak information and treat people unfairly. This policy keeps us on the right side of that line.
1. Approved tools. You may use these tools for work: [list]. Use your work account, with data-training turned off where the tool allows it. Want to try a new tool? Ask [owner] first.
2. Never put these into an AI tool:
- Customer, client or donor personal information (names with addresses, phone numbers, Social Security numbers, financial or health details)
- Passwords, login codes or security information
- Confidential contracts, legal matters or personnel issues
- Anything someone shared with us in confidence
3. Always:
- A human reviews anything AI produces before it's used or sent
- Check facts, names, numbers, dates and quotes. AI can make things up
- Be honest. If AI substantially wrote something public, like a report or article, we'll say so when it matters
4. Never let AI decide about people. AI may not make or be the deciding factor in hiring, firing, discipline, pay, eligibility for services, or anything else that significantly affects a person. A human decides and can explain why.
5. No autonomous actions without approval. AI tools may not send messages to customers, move money, delete data, change accounts or accept agreements on our behalf without a human approving each action.
6. Recording and transcription. Get consent from everyone before using AI to record or transcribe a meeting or call.
7. If something goes wrong. If you think AI produced something harmful, shared something it shouldn't, or made a mistake that reached a customer, tell [owner] right away. You won't be in trouble for reporting. We fix problems faster when we hear about them early.
8. Review. [Owner] reviews this policy every six months, and whenever we add a major new tool.
The thinking behind each line
A template is only useful if you understand why it says what it says. Here's the reasoning, from years of watching what actually goes wrong.
Approved tools (line 1). The biggest real-world risk isn't a rogue AI. It's someone using a random free app with terms that let it keep and train on whatever you paste in. Business versions of the major tools often offer stronger data protections and settings to stop your data being used for training. Pick a short list and stick to it.
The "never" list (line 2). This is the most important line on the page. Once data goes into a third-party tool, you've lost some control over it. If you serve vulnerable people, like clients of a food bank, a clinic or a housing program, that data deserves extra care. In Washington, health-related data has special legal protection under the My Health My Data Act, and that can apply to gyms, wellness businesses and nonprofits too.
Human review (line 3). Large language models generate text by predicting likely next words. They're not looking facts up in a database unless they're specifically connected to one, and even then they can misread what they find. That's why they can produce a confident, well-written sentence that's completely false. Review isn't optional.
No decisions about people (line 4). Automated systems can bake in bias from historical data. If past hiring favored one group, a model trained on that history may learn to favor them too. States are starting to require human involvement. California's No Robo Bosses Act takes effect July 1, 2027. I wrote about it in Your Boss's Algorithm Now Needs a Human.
No autonomous actions (line 5). AI "agents" that take actions are arriving in everyday software. They can be tricked by hidden instructions in a web page or email, a technique called prompt injection. A human approval step is your safety net. More in Who Holds the Kill Switch?
Recording consent (line 6). Washington is a two-party consent state for recording private conversations, which means everyone must agree. AI note-takers make it easy to forget that. Don't.
Reporting without fear (line 7). If people are afraid to report mistakes, you'll find out from a customer instead. Make it safe.
How to roll it out
- Draft it with two or three people who actually use AI at work. They know what's happening.
- Review it in a staff meeting. Read it aloud. Ask what's unclear.
- Have everyone sign or acknowledge it.
- Post it somewhere people see it.
- Revisit in six months. The tools change fast. Your policy should too.
Pour me another: Does your organization have an AI policy yet? Tell me through the contact form. If enough of you want help, I'll put together more templates and examples.
Sip slow, stay curious.D
Receipts 2 sources cited in this post
- Census Bureau working paper census.gov
- NIST AI Risk Management Framework nist.gov
Your host
Dei’Marlon “D” Scisney
Founder & Principal Data Engineer, The Data Guys™
Data engineer, teacher and civic technologist. Vice-Chair of Seattle’s Community Technology Advisory Board. Raised by his grandmother in Evansville, Indiana; building community technology centers in Seattle’s Central District and back home in Evansville.
I am not a lawyer, and nothing here is legal advice. Facts were current when this was written, and every claim links to its source. Spot something that has changed? Tell me and I’ll update it.