How Should We Train Staff and Volunteers — and Address Unauthorized or 'Shadow' AI Use in 2026?

The Short Answer

Training staff and volunteers on AI requires three things: (1) basic AI literacy — what AI is, what it's good and bad at, what the risks are, (2) role-specific guidance — how each role should and shouldn't use AI in their actual work, with concrete examples, and (3) a psychologically safe environment where people discuss AI use openly, learn from each other, and surface problems quickly.

Shadow AI is addressed not by banning or surveilling but by: making approved AI tools easier to access and better-supported than unapproved alternatives, creating clear bright-line rules (what you absolutely cannot do), providing safe channels for people to discuss what they're actually using and why, and responding to unauthorized use with curiosity and redirection rather than punishment — the goal is to understand what need the unauthorized tool was filling and provide an approved alternative that fills it.

Why Shadow AI Is a Bigger Deal for Nonprofits

Shadow AI — staff and volunteers using personal AI accounts and unapproved tools for organizational work — is a significant risk for any organization. For nonprofits, the risks are amplified:

Data exposure risk is higher because the data involved is often about vulnerable people. A for-profit employee pasting customer purchase data into consumer ChatGPT is a privacy problem. A nonprofit caseworker pasting client crisis notes into consumer ChatGPT is potentially a safety problem for the client.

Volunteers are an additional vector. Volunteers may use personal AI tools to help with organizational tasks — drafting communications, analyzing data, generating content — without any awareness of the organization's data privacy obligations. They're trying to help, but they lack the context to know what's safe.

Smaller organizations have less visibility. In a 10-person nonprofit, there are no IT monitoring systems, no data loss prevention tools, no automated alerts when sensitive data leaves approved systems. Shadow AI detection depends entirely on human observation and self-reporting.

The consequences of error are more severe. When a business's shadow AI use results in a data breach, the consequences are primarily legal and financial. When a nonprofit's shadow AI use exposes beneficiary or client data, the consequences can include physical safety risks, immigration consequences, loss of housing or benefits, or erosion of trust that prevents vulnerable people from seeking help.

The AI Literacy Training Program

Module 1: What AI Is and Isn't (30 minutes)

Cover: AI as a pattern-matching tool, not a thinking being. The fundamental capabilities and limitations of current AI. Why AI confidently produces incorrect information and how to spot it. The importance of human judgment in all AI use. This module is the same for all staff and should be completed before anyone uses AI for organizational work.

Module 2: The Risks That Matter for Our Organization (45 minutes)

Cover: the four risks that are most relevant to your nonprofit's work — data privacy, accuracy and misinformation, bias and fairness, and security and intellectual property — with specific examples drawn from your actual programs and stakeholders. This is where you explain why rules exist: not because 'policy says so' but because specific harms could affect specific people your organization serves. This module should be customized to your organization; generic risk training doesn't change behavior.

Module 3: How to Use AI Effectively (60 minutes, hands-on)

Cover: how to write effective prompts, how to verify AI output, how to iterate to improve results, and hands-on practice with real work from each participant's actual responsibilities. This module must be hands-on — staff using AI on their own work during the training. At least half the session should be practice, not presentation.

Module 4: Our AI Policy and What It Means for You (30 minutes)

Distribute the one-page AI policy reference. Walk through the non-negotiables. Answer the questions staff actually have: which tools can I use? What data can I share? What do I need to review? Who do I ask when I'm not sure? What do I do if something goes wrong? This module should feel like practical enablement, not compliance training.

Module 5: Role-Specific Guidance (45 minutes, by team)

For each role in your organization, provide specific guidance: what AI tasks are recommended, what AI tasks require caution and supervisor consultation, what AI tasks are prohibited, examples of good AI use in that role, and data-handling rules specific to that role's access. Role-specific guidance is what makes AI training actionable — general principles don't tell a caseworker whether they can use AI to help write case notes, but role-specific guidance does.

Volunteer AI Training

Volunteers need the same core AI literacy as staff but delivered in a format appropriate to their engagement level and time commitment.

For regular, long-term volunteers (board members, weekly volunteers): Modules 1 and 2 at minimum, plus role-specific guidance if their volunteer work involves AI-appropriate tasks. Distribute the one-page AI policy reference.

For episodic or short-term volunteers: A 15-minute briefing covering: the basic rule (don't put client, donor, or organizational data into AI tools without explicit approval), a single point of contact for AI questions, and what to do if they've already used AI in ways they're now uncertain about.

For all volunteers: Include AI guidelines in volunteer orientation materials. Make the AI policy accessible (not buried in a volunteer handbook nobody reads). Provide a simple way to ask questions or report concerns.

Addressing Shadow AI: Detection, Response, and Redirection

Detecting Shadow AI

Signs that shadow AI is happening in your organization: staff producing polished written work significantly faster than before, sudden improvements in writing quality or consistency, staff mentioning AI tools you haven't approved, team members being evasive about their work processes, or volunteers producing professional-quality content without asking for support.

Active detection approaches: periodically ask in team meetings 'What AI tools are people actually using? No judgment — we want to know what's working so we can support it.' Include AI tool use in regular check-ins — frame as 'share what's working' not 'report what you're using.' Survey staff anonymously about their AI use — you'll get more honest answers than in direct conversation.

Responding to Shadow AI

When you discover unauthorized AI use, your response determines whether the person (and others who hear about it) will hide or disclose future AI use.

The wrong response: 'You used an unauthorized AI tool. That violates policy. Don't do it again.' This teaches the person to hide their AI use better, not to use AI more responsibly. It also signals to everyone else that disclosing AI use is risky.

The right response: 'Thanks for letting us know / I'm glad we caught this. Help me understand — what were you using [tool] for? What made it useful? Was there something our approved tools couldn't do? Let's figure out how to address that need within our guidelines.' This treats shadow AI as a signal about unmet needs — the person found a tool that solved a problem the organization's approved tools weren't solving. Your job is to understand the need and provide an approved way to meet it.

Redirection: Making Approved AI Easier Than Shadow AI

The most effective shadow AI prevention is making approved AI tools the path of least resistance. If the approved tool is harder to access, less capable, or more cumbersome than the unapproved alternative, people will use the unapproved alternative regardless of policy. Ensure approved AI tools are: easy to access (single sign-on, no complicated approval process), well-supported (people know how to get help), and capable of meeting actual work needs (if staff need AI image generation and your approved tool doesn't do it, they'll find one that does — approve one before they do).

Creating a Speak-Up Culture Around AI

The goal is an organizational culture where: people discuss their AI use openly because they've seen that openness is rewarded, not punished; AI mistakes are reported quickly because people trust the response will be proportionate and constructive; and team members share effective AI practices with each other because helping colleagues use AI well is valued.

This culture is built through: leadership modeling (leaders openly discuss their own AI use, including mistakes and what they learned), celebrating good AI practices (recognize people who use AI effectively and responsibly, not just those who avoid AI risks), and proportionate response to problems (treat AI mistakes as learning opportunities unless they involve deliberate violation of clear rules).

A culture of hidden AI use is dangerous because the organization loses visibility into a significant portion of its work. A culture of open AI use is protective because problems surface quickly and best practices spread. The difference between these cultures is almost entirely determined by how leadership responds when AI use — authorized or not — comes to light.