AI Policy for Not-for-Profits: What Staff Can and Cannot Put Into ChatGPT or Copilot

Many not-for-profits already have staff using AI, whether leadership has formally approved it or not. The real question is not whether tools such as ChatGPT, Copilot, or other assistants exist. The real question is whether people know what they are allowed to put into them.

For smaller NSW not-for-profits, unmanaged AI use can quickly create risk around client notes, grant material, HR issues, board documents, and internal reports. That is why AI policy has become one of the most practical starting points inside the NFP Technology Health Check NSW.

Why this matters now

Most organisations do not get to choose whether staff become curious about AI. They already are. Team members use it to rewrite email, summarise notes, brainstorm grant language, clean up reports, and draft communications under time pressure.

The risk is not curiosity. The risk is unmanaged use when staff are unsure whether they can paste:

• client details
• case notes
• complaints
• board papers
• contract language
• HR matters
• funding reports
• internal spreadsheets

Without clear rules, staff fill the gap with guesswork. That is not fair to them and it is not safe for the organisation.

What an NFP AI policy should do

A useful AI policy should be short enough to follow and clear enough to enforce. It should do four things:

1. explain what AI tools staff may use
2. explain what information must never be entered
3. explain when human review is required
4. explain who owns policy, exceptions, and updates

If a policy becomes abstract or overly legalistic, people stop using it.

Acceptable AI use

For many not-for-profits, acceptable use may include:

• rewriting generic communications that contain no personal or confidential information
• summarising public documents
• brainstorming workshop agendas, event copy, or non-sensitive content ideas
• creating first drafts of generic project plans
• improving grammar or tone in material that has already been cleared for external sharing
• helping staff think through public information or policy structure

These use cases can save time without exposing sensitive material.

Prohibited AI use

A strong default rule is simple: staff must not place confidential, personal, or sensitive organisational information into AI tools unless the organisation has explicitly approved that workflow and understands the data-handling implications.

That usually means staff should not paste:

• client names, notes, addresses, identifiers, or service history
• HR issues, complaints, performance matters, or disciplinary content
• board papers and confidential leadership discussions
• contract drafts that contain sensitive negotiation points
• passwords, credentials, system screenshots, or vendor admin details
• raw incident reports or cyber event details
• sensitive funding, payroll, or financial data

This is the rule most teams need spelled out clearly.

Special rules for client notes and case information

Client notes are one of the highest-risk AI use cases for not-for-profits. Even where staff are under time pressure, pasting case details into a public AI tool should be treated as prohibited unless there is a formally approved environment, appropriate controls, and a clear legal and governance basis.

If staff need AI-supported case administration, the organisation should first answer:

• where is the data going
• what controls exist
• what approvals were obtained
• how outputs are reviewed
• whether personal information is being exposed unnecessarily

In most smaller NFPs, the safest immediate policy is to prohibit client-detail entry into general AI tools.

Grant writing and reporting rules

Grant and reporting work is a more nuanced area. AI can be useful for structure, clarity, and editing, but staff should be careful with sensitive internal numbers, unannounced strategy, personal details, and confidential funder commentary.

A workable rule is:

• use AI for structure and editing of non-sensitive draft text
• do not paste confidential client information, board commentary, or unpublished internal detail
• require human review before anything is submitted externally

That approach is practical without pretending all AI use must stop.

A practical AI policy outline

Most smaller not-for-profits can start with a policy that covers the following headings:

1. Purpose

Why the organisation allows limited AI use and what outcomes it is trying to support.

2. Approved tools

Name the specific tools staff may use. If the answer is none yet, say that clearly.

3. Prohibited data

List the information categories that must never be entered without explicit approval.

4. Human review requirements

State that AI outputs are drafts only and must be checked before use.

5. Sensitive use cases

Call out client notes, HR matters, board content, contracts, funding data, and incidents.

6. Ownership and escalation

Name who approves exceptions, updates the policy, and handles questions.

7. Training

Explain how staff will be briefed and how the policy will be reinforced.

Board governance questions to ask now

Boards do not need deep technical detail. They do need basic governance questions answered:

• Are staff already using AI tools?
• What information are they prohibited from entering?
• Which tools, if any, are approved?
• Who owns the policy?
• How are staff being trained?
• What evidence can management provide that the policy is real and understood?

If management cannot answer those questions clearly, AI governance is probably not mature enough yet.

Red flags that policy is missing in practice

Common warning signs include:

• staff say they use AI but no written guidance exists
• different teams have different rules
• client or HR material is being copied into generic AI tools
• Copilot or another tool has been enabled without a clear use policy
• there is no named owner for AI decisions
• leadership assumes the MSP or vendor is covering the governance issue

AI governance is a leadership responsibility, even if technology teams help administer it.

How this links to Microsoft 365, cyber, and data handling

AI policy should not sit alone. It should line up with Microsoft 365 permissions, data classification, external sharing, and broader cyber oversight. Otherwise staff are receiving mixed signals. For example, if client files are already loosely shared in SharePoint and Teams, adding AI use on top of that can amplify existing weaknesses rather than create entirely new ones.

That is why this topic works best alongside Microsoft 365 Security Checklist for Not-for-Profits and the broader NFP Technology Health Check NSW.

Next step

If your organisation needs an AI policy, staff briefing, or a practical review of current AI risk, start with the NFP Technology Health Check NSW. The review is designed to separate acceptable AI use from risky habits and give leadership a clear, board-ready next step.