A one-page AI policy for a nonprofit board

A nonprofit board's AI policy can fit on one page. It needs to say which tools people may use for board work, what must never be entered into them, who checks the output before it becomes a record, and whether meetings can be recorded. Adopt it by a vote and review it once a year.

The policy

Copy this and change the parts in brackets. Have counsel look at it if your board handles health, student or other regulated information.

Use of AI tools in board work

1. Scope. This policy covers directors, officers, committee members and staff when they use AI tools for board business, including agendas, minutes, reports and board correspondence.

2. Approved tools. Board work may be done only in tools on the approved list kept by [the secretary], using an organization account. Personal accounts are not used for board documents.

3. What stays out. Do not enter executive session material, legal advice, personnel matters, donor or client personal information, or [other categories] into any AI tool unless the tool is approved for that purpose.

4. A person is responsible. AI may draft. A named person reviews every draft against the source before it is shared. Nothing produced by an AI tool is a record of the board until the board approves it where approval is required and the responsible person adopts it.

5. Meetings. Board and committee meetings are not recorded or transcribed, by a person or a tool, unless the board has agreed in advance. Executive sessions are never recorded. Any recording or transcript is deleted once the minutes are approved.

6. Vendors. A tool goes on the approved list only if its terms say that the organization's content is not used to train models, and say how long content is kept.

7. Review. The board reviews this policy and the approved list every year.

Why each part is there

Organization accounts. A director who pastes board minutes into a personal chatbot account has put the organization's records somewhere it can't see or delete.

What stays out. The list in section 3 is the material that does the most damage if it leaks or turns up in a dispute.

A person is responsible. AI tools can get names and numbers wrong. A vote count or a name that is wrong in the minutes is the secretary's problem, whoever drafted it.

Recording. A recording is a word-for-word record of who said what, which is the opposite of what minutes are meant to be. Our post on AI note-takers in board meetings goes through the trade-offs.

Vendors. Two questions settle most of it: is our content used for training, and how long do you keep it.

Adopting it

Put the policy in the packet, give directors a meeting to react, and adopt it by motion at the next one. Record the motion and file the policy with your other board policies.

How Karma Compass fits

Our own answers to section 6: board records in Karma Compass are not used to train models, and requests to AI models go only to endpoints with zero data retention. One exception is that Google may hold a request flagged for abuse for up to 90 days. Our security page has the details.

Compass drafts minutes on every plan, and agendas on the Pro plan. A draft stays a draft until a person adopts it. That is section 4 in practice.

For more on using general chatbots for minutes, see Can we use ChatGPT or Claude for board minutes?