Should our nonprofit have an AI policy? Yes — and writing it is the easy part.

The minute a donor's name, her giving history, the note about her husband's diagnosis, or the reason she paused her monthly gift goes into a prompt, personal information has moved into a system your organization doesn't control and can't audit.

What's already happening in your office

Your staff are using AI.

Imagine Canada's research has about eight in ten Canadian nonprofits using AI in some form — and roughly one in ten with anything written down about it.

Yes, you need one.

Canada has no national AI law. AIDA — the Artificial Intelligence and Data Act — died on the Order Paper in January 2025. Which means the rules that apply to you today are the privacy rules that already did.

The Privacy Commissioner has also set out, jointly with every provincial and territorial privacy office, what regulators expect from organizations that use generative AI rather than build it. Three of those belong on your page in plain words.

An inference the tool makes about a real, identifiable person — a capacity estimate, a likelihood-to-give score, a tidy summary of what a donor "seems to care about" — is that person's personal information, carrying every obligation that comes with it.

Anonymize what goes into prompts. Strip names and identifiers before anyone pastes.

And verify a tool's accuracy claims before you use it for anything that affects a person.

PIPEDA's application to charities is narrow and turns on commercial activity, and it shifts by province — BC's PIPA covers non-profits expressly, and Quebec's Law 25 is stricter than anything else in the country. A policy helps you meet your obligations. It is not a legal opinion and neither is this article. If you hold health information, or you can't tell which act applies to you, ask a lawyer.

The policy is one page. The practice is the rest.

Writing the policy takes an afternoon. Getting your team to tell you what they're already using takes trust you have to build first.

What a usable policy actually covers

Which tools are approved, by name. The actual list — the ChatGPT account you pay for, Copilot, the transcription feature in your Zoom plan.

What never goes into a prompt. Donor records, client and service-user information, anything about a child, health details, HR files, anything you wouldn't read out loud in your own lobby.

Who decides, and how fast. One named person. Plus a route for "I found a tool that would save me six hours a week" that doesn't take a quarter.

What you tell people. Whether AI touched a donor communication, a grant narrative, a case note. The harder version — is it ethical to use AI on our donors without telling them — is worth settling before a donor asks you cold. Blackbaud's 2026 research found 76% of donors say disclosure matters to them; that's US data, but I wouldn't bet on Canadian donors feeling differently.

Where the data physically goes. Most tools your team uses are hosted in the United States, which means US authorities can compel access under the CLOUD Act no matter where the person lives. For health information, immigration files, or anything involving kids in your programs, decide on purpose whether a US-hosted tool belongs near it.

What to do this month

Book forty-five minutes and call it an amnesty. Ask everyone what they're already using, and promise nobody is in trouble.

Then write the never-list. One page, ten lines, the things that never go into a prompt. Circulate it that week.

Name the person who decides.

If you'd rather work from a structure than a blank page, the free AI policy builder walks you through the decisions and produces a draft shaped for a Canadian nonprofit.