Using AI tools safely at a small charity

This guide is for anyone at a small charity who uses, or is thinking about using, AI tools: chat assistants and writing tools that draft text, summarize documents or answer questions. Used well, they can turn an evening of writing into an hour. Used carelessly, they can leak private information, invent facts or put words in your charity's mouth that nobody checked. After reading, you'll have a short set of house rules your team can agree on this month.

What can go wrong

Three risks matter most for a small charity.

• Privacy. Many AI tools, including most chat assistants, run on the provider's own servers, so what you type is sent to that company. The staff of the Federal Trade Commission's Office of Technology have noted that customers may reveal sensitive or confidential information when using a company's AI models, including internal documents and their own users' data. Some companies promise not to use customer data for other purposes, such as training their models. The FTC staff say companies that break such promises may be liable under laws the FTC enforces, but a promise only protects you if you've read it and your settings match it.
• Accuracy. AI tools can write confident sentences that are wrong: a statistic that doesn't exist, a deadline that's out of date, a quote nobody said. In grant applications, donor letters and anything about law or money, a wrong fact can cost you.
• Trust. Donors, families and partners trust your charity's voice. A thank-you letter that reads like a form, or a photo or story that isn't real, can damage that trust quickly.

Good uses for a small team

• First drafts of newsletters, social posts, event invitations and job descriptions, which a person then rewrites.
• Plain-language rewrites of something you wrote, to make it shorter or easier to read.
• Summaries of long public documents, such as a funder's guidelines, followed by reading the parts that matter yourself.
• Brainstorming: names for a campaign, questions for a volunteer survey, ideas for a workshop.
• Translation drafts, which a fluent speaker checks before anything goes out.

Five house rules

1. Choose the tool on purpose. Agree which tools your charity uses. For each, read the terms and privacy settings: does the company keep what you type, and can it use it to train its models? Turn off anything you don't want, if you can. Our guide to free and discounted tech lists nonprofit programs from technology companies; check the AI terms of any you use.
2. Keep private information out. Remove names and details before you paste anything in, or don't use the tool for that task. Our data privacy guide explains what counts as personal information.
3. A person checks every fact. Check every number, date, name, law and quote against the original source before you use it. If you can't find the source, take it out.
4. A person signs off. Anything that goes out in your charity's name, such as a grant application, a donor letter or a public post, is read and approved by a person who is responsible for it.
5. Be honest about it. Don't use AI to create fake photos of the people you serve, invented stories or testimonials. If a funder's guidelines ask whether you used AI, answer truthfully.

Write it down

Put your house rules on one page, and have the board or your leader approve it. Include:

• which tools are approved, and who manages the accounts;
• what must never be typed in;
• who checks facts and who signs off;
• what to do if someone pastes in something they shouldn't (tell the person responsible, change any shared password, and follow your data breach steps; our cybersecurity guide covers those).

If you want a fuller framework, the U.S. National Institute of Standards and Technology (NIST) publishes an AI Risk Management Framework, released on January 26, 2023 and intended for voluntary use, to help organizations manage risks from AI. Its main functions are Govern, Map, Measure and Manage. NIST added a Generative AI Profile on July 26, 2024, to help organizations identify risks specific to generative AI. It's written for larger organizations, but the four functions are a useful way to think: decide who is responsible, know where you use AI, check how it's working, and fix problems.

Your AI checklist

• We agreed which AI tools our charity uses.
• We read each tool's terms and privacy settings, and changed the settings we needed.
• Everyone knows what must never be typed into an AI tool.
• A person checks every fact before it's used.
• A named person signs off on anything sent in our charity's name.
• We never use AI to make fake photos, stories or testimonials.
• Our house rules are written on one page and approved.
• We know what to do if private information is pasted in by mistake.

AI tools won't replace the people who know your community. Used with a few clear rules, they can give those people more time for the work only they can do. If you'd like help writing your house rules, ask a member charity with technology skills on the Exchange.