I read a lot of news about AI, and lately the stories that stick with me are the ones where it goes wrong, in organizations of every size, from nonprofits to global consulting firms. The details differ, but they leave me with the same worry.
My concern is that AI needs far more supervision than it gets. This month, the Wikimedia Foundation reported unauthorized activity on its platforms that it believes came from AI agents operated by OpenAI, although it found no evidence its systems or data were compromised. I also see the everyday version in my own work: I am constantly editing and correcting AI-written copy.
Yet in one recent survey, nearly half of nonprofits had no AI policy. Below, I look at what has gone wrong for others, what a short policy should include, and the free tool I built to help you draft one.
What AI Misuse Has Already Cost Others
Policy gaps are not abstract. Three cases show how quickly things can go wrong:
- A nonprofit took its chatbot offline. In 2023, the National Eating Disorders Association pulled its AI chatbot, Tessa, after users complained it offered harmful and unrelated advice. The organization said it was investigating and took the program down until further notice.
- A major firm refunded a government client. In October 2025, Deloitte Australia agreed to partially refund the AU$440,000 paid for a report with apparent AI-generated errors, including a fabricated quote from a court judgment and references to research papers that do not exist. A revised version disclosed that generative AI was used. A grant report or board memo that no one checks carries the same kind of risk.
- Private data may travel further than staff expect. In March 2026, The Register reported a researcher’s claim that data brokers are selling access to private chatbot conversations captured through browser extensions, including cases where healthcare workers had pasted patient data into chatbots. These are one researcher’s claims, but they show why a rule about what never goes into an AI tool matters.
A policy cannot prevent every error. It does set expectations in advance: what can go into a tool, what a person must check before anything goes out, and who is responsible when something goes wrong.
How Common the Policy Gap Is
A benchmark survey of 346 nonprofits, run by Virtuous and Fundraising.AI in December 2025, found that 92% use AI tools in some capacity and 47% have no AI governance policy. The same survey found that 65% describe their AI use as reactive and individual, and 81% use AI ad hoc without documented workflows.
The 2026 report from NTEN and the Bridgespan Group, based on 917 respondents, shows why that gap matters. Among staff, 44% said AI is used informally by individuals and is not organization-supported, compared with 32% of executives. And 35% of staffers held somewhat or very negative perceptions of AI in their workplaces, compared with 10% of executives.
In other words, leaders and staff may be describing two different organizations. Written ground rules help put everyone in the same one.
A note on the data: the first survey was run by a fundraising software company and a responsible-AI collaborative, and the second went to NTEN’s and Bridgespan’s own lists and partners. Read both as snapshots of those communities, not the whole sector.
What a Short Policy Covers
A good AI policy does not need to be long. The Virtuous report describes governance as simple, shared guidance that answers three questions: what AI use is encouraged, what requires approval, and what is off limits, especially with donor data or confidential information. Here is how that translates into a one-page policy:
- Encouraged uses. Name the everyday tasks staff can use AI for without asking, such as drafting, research, and internal brainstorming.
- Uses that need approval. Anything that speaks for the organization, such as donor communications, grant writing, and public messaging.
- Off limits. Confidential data, sensitive donor information, and any final output that no person has reviewed.
- An owner. A named person or group who answers questions and updates the policy. In the NTEN and Bridgespan survey, seven in 10 executives said their organizations had one.
- A review date. AI tools change quickly, so set a time to revisit the policy.
The Virtuous report also notes that organizations seeing results often describe simple, one-page guidelines created in a single meeting. The point is clarity, not volume.
What the Board’s Role Is
Boards do not need to write the policy, but they should approve it and ask three questions before they do:
- Who owns it? One named person or group should be accountable for questions and updates.
- What data is off limits? Staff should be able to say, without guessing, which donor and client information never goes into an AI tool.
- When do we review it? Put the next review on the calendar before the policy is adopted.
Then make sure staff hear about it. The NTEN and Bridgespan report authors found that staff more often describe AI adoption as unfolding around them rather than planned, while executives describe deliberate strategy. A policy that is shared and explained in a short staff conversation is one practical way to close that gap.
Start With a Draft
If your organization has no policy yet, the hardest part is the blank page. I built GovernAI to get you past it. It is free: answer a short set of questions about how your organization works, and GovernAI drafts an AI use policy your board can review, in your organization’s name. It is designed to get you a first draft in about fifteen minutes.
GovernAI runs on your own Anthropic API key, so no data passes through PSC’s servers, and your key is stored only in your browser. You can get a key at console.anthropic.com.
One important note: GovernAI is a drafting aid, not legal advice. Have counsel review any policy before your board adopts it.