An AI Policy for Your Nonprofit's Communications

The most useful structure I have found comes from AI Fluency for Nonprofits, a free course Anthropic built with GivingTuesday and released in December 2025. It takes about six hours, and one of its modules deals directly with writing an organisational AI policy that reflects your mission and values.

The course is built on what Anthropic calls the 4D Framework: Delegation, Description, Discernment and Diligence. It was written to describe individual skills, but each one maps neatly onto a decision a policy has to make.

Delegation: which work AI does, and which it doesn’t. The framework defines this as deciding whether, when and how to engage with AI at all. In a policy, that becomes a short list of tasks where AI is welcome and a shorter list where it isn’t.

Description: what staff may put into a tool. Describing a task well means giving the tool context. Context is where donor names, beneficiary stories and unpublished figures leak out. So this section sets the data rules.

Discernment: who checks the output. The framework calls this accurately assessing what AI produces. In a policy it means naming what must be checked, by whom, before anything is published or sent.

Diligence: who answers for it. Taking responsibility for what you do with AI and how you do it. This is where disclosure lives: when you tell donors, partners and the public that AI was involved.

Communications teams need one more section the framework doesn’t name: images and people’s stories. These carry consent, dignity and safeguarding obligations that a general policy rarely covers in enough detail. If your organisation works with children or vulnerable communities, this section matters more than the other four combined.

The point of the structure is that every rule in the policy should answer one of these five questions. A rule that answers none of them is probably a preference, and belongs in a style guide.

1. Name the tools and the accounts. Start from the organisation’s approved list if there is one. If there isn’t, list the tools the communications team uses and which account each goes through. An organisation account, where you control the data settings, is a different thing from a personal free login. Check each tool’s settings on whether your inputs are used for training, and write down what you found.
2. List the tasks AI is good for in your team. First drafts of routine copy. Summarising a long report before a meeting. Turning a report into a set of social posts. Drafting alt text. Reformatting a budget table. A concrete list does more than a principle, because it tells a new staff member what is normal.
3. Give it your own material. Paste in your messaging guide, boilerplate and a past piece you were happy with. A draft that starts in your voice needs less fixing than one that starts in the internet’s.
4. Check every fact, figure and quote against its source before anything leaves the building. AI tools produce confident numbers, and an impact report is the worst place to find out one was invented.
5. Label AI-generated content where a reader would care. On my own site, research pieces produced with AI carry a note at the top saying so. Readers can decide what weight to give them. That is a fair trade, and it costs one sentence.
6. Make a named role responsible. Not a committee. Someone who can answer the question “is this allowed?” within a day.
7. Set a review date. Six months is about right. The tools change faster than most policies do.

1. Don’t paste in what you wouldn’t email to a stranger. Donor records, beneficiary details, safeguarding case notes, unpublished financials, board papers. If a tool isn’t approved for that data, the data doesn’t go in.
2. Don’t generate images of real people or places and present them as real. A generated photo of a classroom in a fundraising appeal tells a donor something happened that didn’t. With children, rule it out entirely.
3. Don’t let AI write a beneficiary’s words. A quote is something a person said. Editing a real quote for length is normal practice. Inventing one, or “improving” one until it says what you wanted, is not.
4. Don’t put AI-produced figures in a report without tracing them. Every number in an annual or impact report should lead back to a source someone in the organisation can name.
5. Don’t submit AI-drafted applications without reading the funder’s rules. Some already set them. UK Research and Innovation asks applicants to declare substantive AI use, and rules out applications or sections generated without human involvement. Others will follow, so check before you submit.
6. Don’t write a policy nobody reads. If it runs past two pages, staff will skim it once and go back to deciding alone.

The policy is the easy part. Agreeing what goes in it takes longer, so plan for a few weeks rather than an afternoon.

1. Find out what people already use. Ask staff, without judgement, which tools they use and for what. In most teams the answer is “more than you thought”. A policy written without this is a policy for an organisation that doesn’t exist.
2. Take the course together. AI Fluency for Nonprofits is free. If the people writing the policy have worked through it, the conversation starts from a shared vocabulary instead of a mix of enthusiasm and suspicion.
3. Put the right people in the room. Communications and fundraising, plus whoever owns safeguarding and data protection. Those last two hold the rules your section has to connect to, and they own the wider policy it sits inside.
4. Link to what already exists. Your safeguarding policy, data protection policy and brand guidelines already answer half the questions. Point to them rather than rewriting them.
5. Write one example per section. One thing that is allowed and one that isn’t, each in a sentence. Examples are what people remember.
6. Publish it internally and put the review date in the calendar. Then use the first review to fix what turned out to be unclear.