How to Create an AI Acceptable Use Policy for Your Organization in 2026

The Short Answer

An AI acceptable use policy doesn't need to be complex. For most small businesses and nonprofits, a one- to two-page document covering five areas is sufficient: what AI tools are approved and how to get new ones approved, what data can and cannot be shared with AI tools, what AI-generated content requires human review and disclosure, what uses of AI are prohibited, and what happens if the policy is violated.

This guide provides a framework you can adapt for your organization. It's designed for teams without dedicated legal or compliance staff — practical, enforceable, and aligned with how people actually use AI tools at work. It is not a substitute for legal advice; review your specific policy with qualified counsel if you operate in a regulated industry.

Why You Need a Policy Now

Without a policy, your organization has a policy by default: whatever each employee decides is okay. That creates several risks:

• Employees pasting sensitive client, donor, or business data into public AI tools.
• AI-generated content published without human review or disclosure.
• Inconsistent use creating quality, brand, and legal exposure.
• Unclear accountability when AI-assisted work causes problems.
• Team members avoiding AI tools entirely because they're unsure what's allowed, losing productivity.

A clear policy addresses all of these. It doesn't need to restrict AI use — in fact, a good policy should encourage responsible AI use by making the rules clear. People are more likely to adopt tools when they know the boundaries.

Policy Framework: The Five Sections

Section 1: Approved Tools and Approval Process

List the AI tools your organization has reviewed and approved for work use. For each, note any specific limitations.

Example:

• ChatGPT (OpenAI): Approved for drafting, editing, research, and analysis. Do not enter sensitive personal data, financial information, or confidential business strategy.
• Claude (Anthropic): Approved for all work purposes as ChatGPT above. Same data restrictions apply.
• Canva AI: Approved for design and visual content creation.
• [Add other tools your team uses.]

Approval process: Define how employees can request new AI tools. A simple form or Slack/Teams message to a designated person is sufficient for small organizations: 'What tool, what would you use it for, what data would it access, is there a free trial we can test first?'

Section 2: Data Privacy and Confidentiality

This is the most important section. Define what data can and cannot be shared with AI tools.

Never share with public AI tools:

• Personal identifying information (names, addresses, contact details of clients, donors, employees).
• Financial data (account numbers, budgets with identifying details, salary information).
• Protected health information (if applicable to your organization).
• Confidential business information (unannounced products, strategic plans, legal matters).
• Authentication credentials (passwords, API keys, access tokens).
• Third-party confidential information (client data, partner information covered by NDA).

Safe to share: General business writing, public information, de-identified examples, marketing copy, brainstorming, research questions, coding assistance (without proprietary code).

Default rule: If you wouldn't post it publicly on your organization's website, don't paste it into a public AI tool. For tools with enterprise data protection (Teams/Enterprise plans), check your specific agreement — data handling terms vary.

Section 3: Human Review and Disclosure

Define when AI-generated content requires human review before use, and when AI use should be disclosed.

Require human review before:

• External communications (emails to clients/donors, public statements, marketing materials, social media posts).
• Any content with factual claims (data, statistics, quotes, references).
• Content representing the organization's official position.
• Grant applications, proposals, and funding requests.
• Any content with legal, financial, or regulatory implications.

Disclosure guidelines:

• External content substantially created by AI should be labeled (e.g., 'This article was drafted with AI assistance and reviewed by our editorial team').
• Donors and funders should be informed if AI was used to draft grant applications or reports, per most major foundations' emerging guidelines.
• AI-generated images in public-facing content should be disclosed.
• Internal use does not require disclosure but benefits from transparency.

Default rule: AI is a tool like spell-check or a calculator — you're responsible for the output. If you wouldn't send something without reviewing it, don't send AI-generated content without reviewing it.

Section 4: Prohibited Uses

List specific uses of AI that are not permitted. This is your 'red lines' section.

Common prohibited uses:

• Using AI to create deceptive or misleading content.
• Generating content that impersonates real people without their consent.
• Using AI to make decisions about individuals without human review (hiring, lending, disciplinary actions).
• Uploading copyrighted material to AI tools without permission.
• Using AI tools for any illegal purpose.
• Circumventing security or privacy controls using AI.
• Creating deepfakes of colleagues, clients, donors, or public figures.

Add organization-specific prohibitions based on your industry, values, and regulatory environment. For example, a mental health nonprofit might prohibit using AI to generate clinical advice; a financial services firm might prohibit using AI for investment recommendations without licensed advisor review.

Section 5: Training Requirements and Consequences

Training: Require all employees who use AI tools to review the policy and complete a brief acknowledgment. For small organizations, this can be a 15-minute team discussion. For larger ones, consider a short written or video training module.

Staying current: Designate someone to review the policy quarterly. AI tools and capabilities change rapidly — your approved tools list and data guidelines should evolve.

Consequences: State that policy violations will be addressed through existing HR processes. Consistency with your other policy enforcement is more important than AI-specific consequences.

Culture: Frame the policy as enabling responsible AI use, not restricting it. The goal is clarity and confidence, not fear. Encourage questions — if someone isn't sure whether a use is appropriate, they should ask rather than guess.

Implementation Steps

1. Draft the policy using this framework (1-2 hours).
2. Have it reviewed by your leadership team and, if available, legal counsel (1-2 weeks).
3. Share it with your team in a discussion format, not just an email — address questions and edge cases live (30-60 minutes).
4. Collect signed acknowledgments (5 minutes per person).
5. Add an 'AI Use Policy' item to your quarterly compliance or operations review.
6. Update the policy when you add new approved tools or when significant regulatory changes occur.

For Nonprofits: Additional Considerations

Nonprofits face specific AI governance considerations beyond standard business concerns:

• Donor data: Donor names, contact information, giving history, and communication preferences are confidential. They should never be entered into public AI tools. This is both an ethical obligation and, in many jurisdictions, a legal one.
• Grant applications: Many foundations now ask about AI use in their application process. Be prepared to disclose and explain your organization's AI practices. Never use AI to fabricate outcomes data, beneficiary stories, or financial information in a grant application.
• Beneficiary privacy: If your organization serves vulnerable populations, the privacy bar for AI use should be higher. Assume all beneficiary information is sensitive and should not be shared with AI tools.
• Mission alignment: Ensure your AI tool choices align with your organization's values. A climate advocacy nonprofit using AI tools from a company with a poor environmental record creates a values conflict.
• Board awareness: Brief your board on the organization's AI policy. Board members may have specific concerns or risk management questions that should inform the policy.

Keep It Current

AI governance isn't a one-time exercise. Schedule quarterly policy reviews. Key questions each quarter:

• Are employees using new AI tools that should be added to the approved list?
• Have there been any incidents or near-misses that suggest policy gaps?
• Have relevant laws or regulations changed?
• Is the policy enabling or restricting productive AI use?
• Are training materials up to date with current tool capabilities?

The goal is a living policy that keeps pace with both the technology and your organization's evolving needs.