Six headings, under 500 words, a rule for what never goes into a tool, and a prompt that drafts it for you. Ten minutes on the next agenda.
Somebody on your board has read a headline. They are going to ask, probably at the next meeting, "What are we doing about AI?" One wrong answer is a shrug; the other is a twelve-page document with a definitions section. The right answer is one page they can read while the treasurer's report is handed out, discuss for ten minutes, and approve.
A one-page policy tells staff what is allowed, so they stop guessing or hiding. It tells the board that someone thought about the risk. And it gives you something to hand a funder or an insurance carrier, many of which now ask about AI use on renewal forms.
Purpose. Two sentences. "We use AI drafting tools to save staff time on routine writing. This policy says what is allowed, what is not, and who decides."
Approved tools. The specific tools and plans staff may use, and the login they use them under. If you have a paid team plan with training turned off, say so. Anything not listed is not approved until someone adds it.
What never goes in. This is the section that matters most, and it should be nearly word for word:
Human review. The tool drafts and a person decides. Every AI-assisted draft is read by a person before use. No eligibility, service, financial, or personnel decision is made by a tool. And some things are never automated: crisis or grief communications, eligibility or service decisions, messages to a person in a vulnerable moment, the personal ask to a major donor, board conflict.
Who to ask. One named role, usually the executive director, for questions and for adding tools. One sentence on what happens if something on the "never" list gets pasted in by mistake: tell that person the same day, no penalty the first time.
Review date. A specific month, twelve months out. A policy without a review date is one nobody reads twice.
If you have written your organization brief, the tool already knows who you are. What it lacks is your tool list, your named role, and your review month. Paste this into Claude or ChatGPT and fill in the brackets.
Read the result against the list above. If the model softened a rule ("should avoid" instead of "never"), change it back. Add your organization's name and the date. Send it to your board chair a week before the meeting with a request for ten minutes on the agenda.
This is a working policy for a small organization, written by you with help from a drafting tool. It is not legal advice and it has not been checked against your state's privacy laws, funder contracts, or insurance requirements. If you hold health information, information about minors, immigration or housing details, or anything under a government contract, have your attorney or insurance carrier look at the page before the board approves it. The page is short, so the review is too.
Approving a policy does not make the practices true. Post the "never" list where staff work, check the tool settings, and ask out loud once in a while whether anything on the list has been pasted in. A policy no one follows is worse than no policy.