The AI Guidelines Your Board Keeps Asking For. Already Written.

1. Human Control & Oversight. AI tools support human decision-making; they never make final decisions autonomously. All AI outputs require human review before implementation. High-stakes decisions (program eligibility, hiring, resource allocation) maintain mandatory human oversight. Staff retain ultimate authority and accountability for all decisions.

2. Validation & Reliability. Every AI-generated output undergoes verification before use. All factual claims, statistics, and references must be cross-checked with at least 2–3 authoritative sources. Suspicious or overly confident claims trigger additional scrutiny. Subject matter experts review technical, specialized, or high-stakes content.

3. Inclusiveness & Bias Mitigation. AI systems must not discriminate against or harm the vulnerable populations you serve. Run bias impact assessments before deploying AI in client-facing applications, test performance across demographic groups, and give affected individuals a way to report concerns.

4. Accountability & Transparency. Clear ownership, documentation, and audit trails for all AI use. Maintain records of verification steps and human review, and establish clear escalation procedures when AI outputs raise concerns.

5. Data Privacy & Protection. Constituent data remains confidential and secure. Never input personally identifiable information about donors, clients, or constituents into commercial AI platforms without explicit consent. Follow applicable privacy laws (GDPR, CCPA, HIPAA where relevant), practice data minimization, and securely dispose of AI outputs containing sensitive information.

6. Social Impact & Mission Alignment. AI adoption must advance your mission and values. Question whether AI adds genuine value for each use case, prioritize applications that improve service delivery and community impact, and avoid AI use that could undermine trust with the communities you serve.

7. Explainability. Understand how your AI tools work and be able to explain their use to boards, funders, and communities. Staff receive training on AI capabilities and limitations, and vendor transparency guides tool selection.

GREEN LIGHT (encouraged with standard review). Administrative and operational efficiency: meeting note summaries and action items, routine email drafts (with review), calendar coordination, translation of materials (with native speaker verification), research assistance for grants and reports, data analysis and visualization. Content development at draft stage only: blog and newsletter drafts, social media ideas, internal training materials, document templates. Technical: database query help, spreadsheet formulas, basic coding with technical review, formatting and accessibility improvements.

YELLOW LIGHT (permitted with enhanced review). Donor communication drafts (two-level review), grant proposal research and initial drafting (expert review plus compliance check), annual report content (multi-level review), press release drafts (senior leadership approval). Program development: needs assessment analysis, program design research, outcome measurement, and survey design — each with expert or supervisor validation. Human resources: job description drafting with HR review, interview question development (never candidate evaluation), training curricula with SME review, performance review templates (never actual evaluations).

RED LIGHT (prohibited or extreme caution). Absolutely prohibited: autonomous decision-making without human review for hiring, program eligibility, or resource allocation; processing confidential client information (medical records, legal status, mental health, trauma histories) through commercial AI platforms; mental health counseling or crisis intervention; legal advice for clients without verified resources; medical diagnosis; child welfare assessments; resume screening without robust human oversight and bias testing; final compliance documents or legal contracts without attorney review. Extreme caution (expert consultation mandatory): crisis communications, correspondence about traumatic events, major donor solicitations over $10,000 without management approval, government or foundation reporting with compliance requirements, any application affecting vulnerable populations’ access to services, financial modeling without financial expertise validation.

Tier 1 — Low-risk content (single human review). Internal meeting notes, routine scheduling, staff brainstorming. The creator reviews for accuracy, appropriateness, and tone, fact-checks claims, and documents AI assistance in file notes.

Tier 2 — Medium-risk content (two-level review). Social media posts, blog articles, donor thank-you notes, internal newsletters. Creator edits and fact-checks, verifies brand alignment, checks for bias. Supervisor gives final approval with a fresh perspective and documents AI assistance if content is public-facing.

Tier 3 — High-risk content (multi-level review). Major donor communications, grant proposals, press releases, annual reports. AI drafts or researches only. Creator edits heavily and fact-checks comprehensively; a subject matter expert verifies accuracy; legal/compliance reviews as applicable; senior leadership approves; final proofreading and documentation close it out.

Tier 4 — Critical content (comprehensive review plus expert consultation). Legal documents, regulatory filings, crisis communications, client-facing policy documents. A human expert creates the content with AI assisting research only, followed by dedicated fact-checking, multiple SME reviews, mandatory legal counsel review, executive approval, compliance sign-off, and a complete audit trail.

Universal fact-checking protocol. For all AI-generated content verify: names and titles, exact quotations and sources, organization names, all numbers and dates, sequences of events, scientific and technical claims, and citations (confirm DOIs exist and papers are real). Research shows ChatGPT fabricates references 47% of the time and provides fully accurate citations only 7% of the time — always verify citations in scholarly work.

Before deploying AI for client-facing applications, ask: Who will be affected? What are the potential harms to vulnerable populations? How will bias be detected and monitored? Does the training data represent the diversity of people you serve? Are there proxy variables (ZIP codes, names, language patterns) that could encode discrimination?

Testing: test model performance separately across racial, ethnic, gender, age, disability, and language groups; examine training data for representation of marginalized communities; review for historical biases embedded in data.

Ongoing monitoring: collect disaggregated performance data, keep feedback channels open for clients and staff, review AI performance and equity metrics quarterly, and engage community members in evaluating applications that affect them.

When bias is detected: immediately pause the tool for affected applications, investigate root causes with a diverse team, implement fixes, re-test with affected populations, document the incident, and consider discontinuing the tool.

Why this matters: healthcare algorithms have favored white patients over Black patients, reducing Black patients identified for extra care by more than 50%. Facial recognition systems misclassify Black women at rates up to 35% while misclassifying white men at only 1%. These harms directly contradict nonprofit missions and values.

Never input into commercial AI platforms: personally identifiable information about clients, donors, or constituents; immigration status or legal information; medical or mental health records; financial information tied to specific individuals; information about specific minors without explicit parental consent; attorney-client privileged communications; proprietary organizational strategies before they’re public.

Permitted: de-identified aggregated demographic data, public information, anonymized program outcome data, general organizational information, and template documents without personal details.

Data minimization: collect only what’s truly necessary, remove unnecessary data after use, audit data retention quarterly, and dispose of data securely.

Vendor security bar: clear privacy policies with regulatory compliance, disclosed training data sources, enterprise-grade encryption at rest and in transit, acceptable retention and deletion policies, security certifications (SOC 2, ISO 27001), and no broad data-rights claims in the terms of service — 92% of AI vendors claim these, so negotiate them out.

Organizational practices: role-based access controls, multi-factor authentication, audit logs, annual vendor security reviews, an incident response plan, and staff training on data protection.

U.S. copyright rule: works must have human authorship to receive copyright protection. AI-generated content without significant human creative input enters the public domain immediately. To maintain copyright, use AI as a research and drafting tool only, and edit all AI outputs with original human expression.

Materials needing strong copyright: curriculum and training materials for potential licensing, original research reports, proprietary program methodologies, marketing materials with significant investment, and publications intended for distribution or sale.

Vendor contracting: negotiate clear terms on output ownership, IP rights, data portability, service level agreements, liability and indemnification, and exit clauses protecting organizational data.

Data centers contribute roughly 1% of global electricity consumption. Right-size your AI use: pick the smallest model sufficient for each task, favor text over image generation, and minimize video generation. Prefer vendors with low power usage effectiveness and renewable energy commitments. Use simple, clear prompts, batch similar queries, question whether AI adds value beyond a spreadsheet, and track usage to find optimization opportunities.

Before adopting any AI tool, assess: organizational fit (mission alignment, clearly defined need, vendor nonprofit commitment, sustainable cost); technical capability (functional requirements, capacity fit, integration, scalability); data governance (privacy policy, training data disclosure, encryption, certifications, no problematic IP claims); bias and fairness (documented bias testing, training data diversity, regular audits); transparency (explainable decisions, honest limitations); human oversight (review processes, override mechanisms, audit trails); and pilot testing (trial period with success metrics, staff training, feedback mechanism, exit strategy).

Executive Director: final authority on AI strategy and policy, board communication, budget allocation, crisis response. AI Governance Lead: day-to-day implementation, tool evaluation, training coordination, quarterly reviews, incident investigation. Data Protection Officer: privacy compliance, data governance enforcement, vendor security assessment, breach response. Program representatives: use case identification, bias impact assessment, community feedback. IT/technical: capability assessment, security implementation, performance monitoring. Legal/compliance (as available): contract review, regulatory verification, risk assessment.

Decision authority: the Board approves the AI policy and reviews the annual governance report. The Executive Director approves tool purchases over $5,000 annually and authorizes high-risk applications. The AI Governance Lead approves low-risk trials and standard applications. Staff use approved tools within guidelines and report concerns immediately.

All staff using AI (annual): capabilities and limitations, hallucination recognition, bias awareness, data privacy, appropriate vs. prohibited use, verification and documentation. Supervisors (bi-annual): review protocol oversight, bias impact assessment, incident response, quality assurance. Governance team (quarterly): emerging developments, legal and regulatory updates, vendor evaluation, risk assessment. Board members (annual): governance overview, risk and opportunity landscape, oversight responsibilities.

Track: efficiency gains (time saved, cost reductions, capacity increases), quality indicators (accuracy after verification, errors caught in review, stakeholder satisfaction), risk metrics (errors or harms, privacy near-misses, bias complaints), and governance effectiveness (policy compliance, training completion).

Quarterly review: incident reports, performance trends, new tools and use cases, approved-tool list updates, training needs, and policy revisions. Annual board report: strategy progress, cost-benefit analysis, risk management effectiveness, significant incidents, and future opportunities.

When AI errors or harms occur: immediately halt the affected process and mitigate harm; notify the Executive Director within 24 hours; investigate root causes within 72 hours; implement corrective actions within one week; update policies and training within two weeks.

These guidelines position AI as a powerful tool serving nonprofit missions. Human judgment remains central to all decisions affecting people’s lives. Verification precedes publication. Vulnerable populations receive extra protection through bias testing and human oversight. Transparency and accountability govern all AI applications. Data privacy is non-negotiable for sensitive constituent information. These are living guidelines — review them regularly as technology evolves, regulations develop, and your experience grows.