AI tools are already part of daily work. Staff use them to draft emails, summarize documents and plan lessons, often before leadership has made a decision about them.
What matters now is whether your organization has decided how it should be used. Here are a few questions to help you find out. They apply to schools, nonprofits and businesses, and the stakes for each are at the end.
Do you know which AI tools your staff use?
Start with an inventory. Ask people directly, and make it clear nobody is in trouble for the answer.
Expect more than one tool. Free chat assistants are the obvious ones. AI also arrives inside software you already pay for: writing help in email, summaries in video calls, image generators in design tools. Many of those switched on with an update, and nobody chose them.
“Staff tell us right away when we ask which AI tools they use,” says David High, Service Manager at Dynamic Network Solutions. “They were never told where the line is, so each of them drew their own.”
What information is allowed to go into them?
This is the question that matters most. Text pasted into an AI tool leaves your building, and what happens to it next depends on the tool and the account.
Free personal accounts and business accounts usually run under different terms. A business account signed in with your organization’s credentials generally keeps your data under your existing agreement with that vendor. A personal account on the same tool may not.
Write down what never goes in. Student records, donor and client details, health information, financial account numbers, personnel matters, and anything covered by a contract or a confidentiality agreement. Keep the list short enough to remember.
Which tools are approved, and who decides?
An AI tool is a vendor with access to your data. It deserves the same review as any other vendor: who runs it, where the data is stored, whether your data trains their models, and how you get it back or deleted.
Name the person who approves new tools. Without one, the first person to sign up makes the decision.
Who checks what AI produces?
AI writes confidently, including when it is wrong. A summary can drop the one sentence that mattered. A drafted letter can cite a policy you do not have.
Decide where a person reviews the output before it goes anywhere: to a parent, a donor, a client, a funder or a regulator. The person who sends it is responsible for it.
Can your AI tools see more than they should?
Assistants built into Microsoft 365 and Google Workspace can read whatever the person using them can read. That is how they are designed.
The risk is old permissions nobody cleaned up. A folder shared with the whole organization years ago was hard to find by browsing. An assistant finds it in seconds when someone asks the right question. Check who can see what before you turn these tools on.
Is anyone recording meetings with AI?
AI note takers join video calls, record them and send a transcript to everyone on the invite. Some join automatically once one person has connected them to a calendar.
Recording laws vary by state, and several require consent from everyone on the call. Maryland is one of them. Decide whether note takers are allowed, on which meetings, and how people on the call are told.
Does anyone know the policy exists?
A policy in a shared drive that nobody has read does not change what people do. Cover it at onboarding, give staff a one page version, and revisit it at least once a year. The tools change faster than most policies do.
The same questions, different stakes
Schools answer to student data privacy laws as well as their own policies. Many AI tools set a minimum age in their terms of use, so a tool approved for staff may not be allowed for students. Student use of AI in coursework needs its own decision, separate from staff use.
Nonprofits hold donor records and often sensitive information about the people they serve. Volunteers and part time staff are the most likely to use personal accounts, so the policy has to reach them too. A grant report or impact figure drafted with AI needs a person to check every number.
Businesses carry confidentiality obligations to their clients, and many contracts limit where client data can be processed. Read your client agreements before staff paste client material into any tool. If you work in a regulated field, the rules that already govern your data apply to AI tools as well.
Where we come in
If you answered “not sure” to a few of these, you are in good company. Most organizations we talk to are somewhere between no policy and a draft nobody finished.
We help clients write an acceptable use policy for AI, check permissions before assistants go live, and train staff on what the policy means day to day. It is part of our vCIO work, and we are happy to talk it through whether or not you are a client.