Small non-governmental organisations (NGOs) and civil-society groups often adopt generative artificial intelligence tools informally. Staff and volunteers might draft donor appeals, summarise dense evaluations, or translate project updates using consumer platforms. Without clear organisational rules, however, casual adoption exposes an organisation to severe data protection, legal, and operational risks.
A practical policy does not need to be an intimidating legal manual. For a grassroots civil-society organisation, a single page provides sufficient clarity while enabling productive, safe experimentation. Authoritative sector guidance—including the International Committee of the Red Cross (ICRC) Policy on Artificial Intelligence released in November 2024 and NetHope's Humanitarian AI Code of Conduct released in 2024—stresses that AI adoption must uphold human dignity, data protection, and human accountability.
Core Rules for Responsible AI Use
A workable one-page acceptable use policy should give personnel clear boundaries across four operational areas:
- Permitted tasks: Define ordinary, low-risk administrative workflows where text generation or data summarisation creates efficiencies. Approved tasks typically include drafting internal agendas, proofreading proposals, summarising lengthy reports, writing spreadsheet formulas, and drafting boilerplate correspondence. High-stakes activities—such as evaluating community needs, allocating emergency resources, scoring partner grants, or making beneficiary selection decisions—must remain strictly human-led.
- Strict data boundaries: Draw an absolute line around personal and operational data. Public commercial AI tools often retain submitted inputs for continuous model training. Staff must never paste personally identifiable information into unvetted tools, including beneficiary names, community locations, health data, protection casework, or child safeguarding records. Similarly, confidential donor agreements, staff grievances, financial account credentials, and system passwords must remain entirely off external AI platforms.
- Human oversight and accountability: Mandate meaningful human control over all outputs. Generative AI tools routinely produce inaccurate citations, biased interpretations, or invented facts. The staff member submitting or publishing the final work remains personally responsible for its accuracy, fairness, and tone. Before any proposal, public blog post, or monitoring document is shared externally, a designated project manager or communications lead must check all claims, figures, and sources.
- Disclosure and audit trails: Establish clear norms for informing external stakeholders. If an organisation deploys an automated tool to interact with beneficiaries—such as an automated text channel or enquiry chatbot—affected people must be informed immediately that they are communicating with a machine. When submitting major grant proposals or evaluation reports, state transparently if AI tools assisted the research or drafting. Internally, teams should keep a brief record noting which tools are used and who maintains administrative oversight.
Adaptable One-Page Policy Template
You can adapt the following points directly into a single-page document for your organisation's internal operations:
- Purpose: This policy defines safe, ethical, and responsible artificial intelligence use across all organisation projects, operations, and communications.
- Scope: These rules apply to all full-time employees, part-time staff, field officers, volunteers, contractors, and trustees using AI tools on work devices or for organisational business.
- Approved Uses: Personnel may use approved AI platforms for drafting initial text, copy-editing, language translation, administrative summarisation, and basic analysis. AI must never make automated decisions regarding beneficiary eligibility, disciplinary matters, or recruitment.
- Prohibited Data: Users must never enter personally identifiable information of beneficiaries or community partners, protection casework, bank details, unreleased grant contracts, or staff personal records into external AI tools.
- Verification Mandate: Human staff retain full accountability for all final outputs. All facts, figures, and attributions generated with AI assistance must be reviewed and verified by a line manager prior to publication or submission.
- Transparency: We disclose AI use in donor proposals, external research, and public campaigns whenever AI tools have materially contributed to the final product, and we inform community members whenever automated systems support communications.
- Approved Tools: Staff may only use AI software registered on the organisation's approved tool list; unapproved consumer applications must not process internal documents.
Governance and Review Schedule
Artificial intelligence tools, institutional funder requirements, and local privacy laws evolve continuously. A policy filed in a folder and forgotten will fail to protect your team.
Assign one member of your leadership team—such as a programmes director, monitoring coordinator, or operations manager—to maintain the organisation's list of approved software and handle team questions.
Conduct a formal review of your AI policy every six to twelve months, or whenever the organisation considers adopting a new digital platform for field work. Use this routine check to collect feedback from staff, review whether any accidental data exposure occurred, and confirm that the terms of service of approved tools still meet your organisation's data protection standards.
Checklist
- Identify approved administrative tasks and prohibit automated decision-making on aid distribution.
- Ban the entry of beneficiary personal data, safeguarding records, and internal confidential files.
- Require a named staff member to verify the accuracy of all AI-generated content before release.
- Define clear rules for disclosing AI assistance to donors, partners, and community members.
- Maintain a central register of approved tools and administrative account holders.
- Schedule a mandatory policy review every six to twelve months to assess emerging tools and risks.
