Nonprofit AI policy template: one page, six sections
Nearly half of nonprofits have no formal AI policy, according to the 2026 Nonprofit AI Adoption Report from Virtuous and Fundraising.AI. Meanwhile 81% of those surveyed use AI individually and ad hoc. Those two facts are connected. Without a written answer to “what am I allowed to do?”, careful staff stay away and confident staff paste in whatever they like.
This page gives you a one-page AI use policy you can adapt in an afternoon. We use it with the nonprofits we help roll out Claude; if you are still choosing a plan, read our Claude for Nonprofits guide first. The template works for any approved AI tool, not just Claude.
Why one page is enough to start
A long framework gets written once and never read. A one-page policy gets pinned in the staff channel and actually used. You can add detail later as workflows mature. What matters on day one is that six questions have written answers, a named owner, and a review date.
Anthropic’s Claude for Nonprofits plugin includes a skill to check what your AI policy allows, and its use case library has policy templates. Those are useful starting points. The defaults lean American, though, so Indian and UK organisations will need to adjust the data and legal sections. Whatever template you start from, someone in your organisation adapts it and leadership approves it.
The template
Copy the wording below and replace anything in [brackets].
1. Purpose. “[Organisation] uses AI tools to save staff time on drafting, summarising and analysis, so we can spend more time on programmes and people. AI supports our work. It does not make decisions about the people we serve.”
2. Approved tools. “Staff may use [Claude Team on our organisational account at claude.ai, signed in with your work email]. Personal AI accounts, free chatbots and browser extensions are not approved for work data. To request a new tool, write to [policy owner].”
Name the tools. “AI tools” is too vague to follow.
3. What data can go in. Use a traffic-light table:
| Colour | Rule | Examples |
|---|---|---|
| Green | Use freely | Published reports, programme manuals, anonymised aggregates, public funder guidelines, draft communications |
| Amber | Approved projects only, with a named reviewer | Donor names and giving history via an approved connector, internal budgets, de-identified survey responses, staff policies |
| Red | Never, unless a designed and approved workflow exists | Aadhaar or other ID numbers, health and disability records, caste or religion, case notes on named children, survivor information, bank details |
Adjust the examples to your work. A child-rights organisation will have a longer red list than an environmental advocacy group.
4. Who reviews what. “Every output that leaves [Organisation] has a named reviewer before it is sent.” Then list roles, not just “staff”:
- Grant proposals and funder reports: [Fundraising lead]
- Beneficiary-facing content and translations: [Programme lead, fluent in the language]
- Figures and outcome data: [M&E officer], taken from [system of record], never from AI output
- Board papers: [Executive director]
5. Disclosure. “We tell [funders / partners / beneficiaries] that we use AI for drafting when [they ask / in our standard proposal annex / always]. We never present AI-generated quotes, case stories or figures as real.” Some funders now ask directly, so decide your stance before the question arrives.
6. Ownership, review and incidents. “[Name, role] owns this policy, the approved tool settings and our shared reference material. We review it every [six months] or when the law changes. If you paste something you shouldn’t, or spot an AI error in something already sent, tell [owner] the same day. Data slips follow our [data breach procedure].”
India and UK notes
India (DPDP Act). Under the Digital Personal Data Protection Rules, most substantive obligations apply from May 2027. Your organisation is the data fiduciary. If staff put personal data into an AI tool, that use must be covered by your consent notice, and the tool belongs on your data map. Children’s data is treated most strictly, so keep it in the red column unless you have mapped the flow and consent basis. Section 6 of the template should point to a real incident route: our DPDP breach response plan template for NGOs gives you one.
UK (UK GDPR). You need a lawful basis for any personal data processed with AI, should apply data minimisation, and will often need a Data Protection Impact Assessment where AI use is likely to be high risk. The ICO’s section on security and data minimisation in AI is the most practical place to start.
Where the red column comes from
The red list is not arbitrary. It mirrors the records that sit inside case management software and beneficiary systems: case notes, safeguarding concerns, health and identity data. If a workflow genuinely needs that data, design it inside the system that already controls access, rather than copying it into a general chat.
Putting the policy to work
Three things make the difference between a policy that exists and one that changes behaviour:
- Launch it in a meeting, not an email. Walk through the traffic lights with real examples from your own files.
- Tie it to the rollout. The policy is week one of our 30-day Claude rollout plan for NGOs. Staff get the policy and the approved tool on the same day.
- Revisit at day 30. You will find amber cases you didn’t anticipate. Add them.
Ready to put Claude to work in your organisation?
A policy is the first step. The next is choosing two workflows and setting up your data rules in the tool itself. Book a Claude rollout planning call with EdZola. Bring your draft policy and one workflow, for example your next funder report, and we’ll map how Claude fits, what your team needs to review and what it will cost to run.