Somewhere in your organization this week, someone is pasting text into a free AI tool. A development director shortening a grant narrative. A program manager turning rough notes into a case summary. An office manager rewriting a donor thank-you. None of them asked permission, because it didn't occur to them that they needed to — it felt like using a spell checker.
That instinct is mostly good. These tools genuinely help a small team do more, and in a sector where everyone is stretched, that matters. The problem is narrower than "AI is risky": it's that nobody has told staff which information may be pasted in, and most free tools reserve the right to keep whatever they receive.
What actually leaves the building
In nonprofit assessments, the pattern is consistent. The tool isn't the issue — the content is:
- Donor records. A spreadsheet pasted in to "clean this up" or "write a segmentation summary" — names, giving history, sometimes contact details and employer information.
- Client and participant information. Case notes summarized, intake narratives rewritten, outcome stories polished for a report. For organizations serving vulnerable populations, this is the most sensitive data you hold.
- Unpublished financials and grant material. Budgets, draft applications, board documents — pasted in for editing help, now sitting on a server you have no agreement with.
- Login details and internal process documents. Occasionally, and usually by accident, inside a larger block of pasted text nobody reread before sending.
Why a ban is the wrong move
Blocking AI tools outright does two things. It removes a real productivity gain from a team that needs it, and it pushes the behavior onto personal phones and home laptops where you have no visibility at all. The schools version of this problem looks identical — we wrote about teachers adopting classroom apps for the same reason. People route around rules that make their jobs harder.
The one-page policy that works
- Name the approved tool. Pick one — ideally a paid or business tier that contractually does not train on your data — and tell everyone that's the one. One sanctioned option beats five unsanctioned ones.
- Draw a bright line on content. Never paste: donor records, client or participant information, financial account details, login credentials, or anything that identifies a specific person you serve. Safe: general writing help, public information, your own already-published text, brainstorming with names removed.
- Teach the substitution habit. Replace real details with placeholders before pasting. "Write a thank-you for [DONOR] whose gift funded [PROGRAM]" gets the same result with none of the exposure.
- Require a human check before anything goes out. AI-written grant copy and donor communications get read by a person who knows the facts. Confident and wrong is a real failure mode.
- Make asking easy. One named person answers "can I use this for X?" within a day. Staff will ask if asking is fast and judgment-free.
Put ten minutes on the next staff meeting agenda: name your approved tool, state the bright line on donor and client data, and demonstrate the placeholder habit once. That single conversation closes most of the exposure. Our free nonprofit IT assessment includes a review of what tools your team is actually using — and the findings are yours either way.
Your staff are not being careless. They are being resourceful with tools nobody gave them rules for. Give them the rules, and you keep the productivity without quietly handing your donor file to a company you have never evaluated.
Andrew — Founder, NextGen Strategy Partners
Veteran-owned managed IT for the nonprofits, schools, behavioral health providers, and medical & dental practices of McHenry & Lake Counties. Request a free security assessment →