AI Governance Policy for Associations: Guide and Template

In the same month, three things happen at a mid-sized professional association. A staff member pastes a member's complaint, including details about her medical leave, into a free AI chatbot to help draft a reply. A committee chair posts an AI-generated image of "members at our annual conference" on social media. And a board member's AI note-taker joins a closed executive session and emails a transcript to everyone on the invite, including a vendor. Nobody broke a rule, because there wasn't one.

An AI governance policy sets those rules before something goes wrong. For a member organization, it's usually a two- to four-page document that defines who it covers, which tools are approved, what data can and can't go into them, when to disclose AI use, where a person must review or decide, and how to handle copyright and other intellectual property. The board approves it, a named person owns it, and it gets reviewed at least once a year.

This guide explains each part, gives you a ready-to-adapt template written for associations, clubs and nonprofits, and lays out a 90-day rollout. For the practical side of using AI, from drafting content to spotting churn signals, see our companion guide to AI for associations. This isn't legal advice; for employment, privacy or copyright questions specific to your organization, consult a qualified attorney.

Why Your Organization Needs an AI Policy Now

Your staff and volunteers are almost certainly using AI already, in standalone chat tools, in features built into email and office software, in transcription apps and in image generators. Without a policy, each person makes their own call about what's acceptable. Some will be too cautious and miss real benefits; others will take risks they don't see.

Oversight of risk is part of the board's job. Our guide to nonprofit board responsibilities explains how the duty of care applies to decisions like this one.

Who Owns AI Governance

Clear roles matter more than a long document. Here's a structure that scales from a staffed association to an all-volunteer club.

In small organizations, one person often holds several roles. That's fine as long as someone is named.

Step 1: Map Current Use

Before you write rules, find out what's happening. Send a short, blame-free survey to staff, board members and key volunteers:

1. Which AI tools have you used for association work in the last three months?
2. What did you use them for?
3. What kind of information did you enter, for example public text, internal documents or member data?
4. Did you use a personal account or an organizational account?
5. What would you like to use AI for if it were clearly allowed?

Also check the software you already pay for. Email platforms, office suites, video meeting tools and design apps increasingly include AI features, sometimes switched on by default. List them, along with whatever settings control them.

Step 2: Define Scope and Principles

Scope

Spell out who and what the policy covers:

• People: employees, board members, committee members, volunteers acting on the organization's behalf, and contractors.
• Tools: standalone generative AI tools, AI features inside software you already use, AI meeting assistants and note-takers, image, audio and video generators, and any predictive or automated decision tools.
• Activities: any work done for the organization, on any device or account.

Principles

Keep principles short enough that people remember them. For example:

1. People are accountable. AI assists; a named person is responsible for every output we use.
2. Protect member trust. We don't put confidential information into tools we haven't approved.
3. Be accurate. We check facts, figures, names and dates before anything is published.
4. Be open. We tell people when they're interacting with AI or when content is substantially AI-generated.
5. Be fair. We don't let AI make decisions about individuals.

Step 3: Set Up an Approved Tools Process

A simple three-tier list works for most organizations.

How a tool gets approved

Anyone can request a tool. The policy owner reviews it against a short checklist and decides within a set time, for example 10 business days.

• Data use: Does the vendor use inputs or outputs to train models? Can that be turned off by contract or setting?
• Retention and deletion: How long are inputs kept? Can you delete them?
• Access controls: Can you manage users centrally, require multi-factor authentication and remove access when someone leaves?
• Security: Does the vendor describe encryption and security practices, and will it notify you of a breach?
• Terms: Who owns outputs? Are there restrictions on commercial use?
• Cost and ownership: Who pays, and who holds the account? Organizational tools should never live in someone's personal account.

Record each decision in the approved tools list with the date, the tier, the permitted data classes and any conditions. Our guide to association data security has a broader vendor question list you can reuse.

Step 4: Write Clear Data Rules

Data rules are the heart of the policy. Most associations can use four classes.

Add three practical rules:

• Minimize. Remove names and identifying details when they aren't needed for the task.
• Use organizational accounts. Never use personal AI accounts for confidential work.
• When unsure, ask. Treat unclear data as one class higher until the policy owner answers.

Step 5: Set Disclosure Rules

Disclosure protects trust. Decide when your organization will say that AI was involved.

Always disclose

• Automated assistants: Anyone chatting with an automated assistant on your website or app should be told it's automated and how to reach a person.
• Synthetic media: Images, audio or video that depict realistic people or events but were generated by AI should be labeled, or not used at all.
• AI note-takers and recording: Tell participants before a meeting is recorded or transcribed. Recording consent laws vary by state, and some require every participant's consent. Don't use note-takers in executive sessions or confidential meetings.

Never do

• Fake testimonials or reviews. The Federal Trade Commission's 2024 rule on fake reviews and testimonials names AI-generated fake reviews among the practices it prohibits for businesses. Never publish AI-generated quotes attributed to real or invented members.
• Synthetic voices or likenesses of real people without their written consent.

Use judgment

For routine drafts that a person substantially edits, such as a newsletter or event description, labeling each piece is usually unnecessary. A general statement on your website, for example on the About page or next to your privacy policy in the footer (see our checklist of nonprofit website features), covers it:

We sometimes use AI tools to help draft and summarize content. A member of our team reviews and edits everything we publish, and people, not software, make decisions about memberships, awards and member matters.

Step 6: Require Human Review and Set Prohibited Uses

Review by risk

Prohibited uses

The policy should list uses that are off-limits, including:

• Deciding membership approval, denial, suspension or discipline.
• Selecting recipients of scholarships, grants, awards or honors.
• Scoring certification exams or deciding eligibility for credentials.
• Making or screening hiring, promotion or termination decisions.
• Generating legal documents, contracts or official governance records without qualified review.
• Impersonating a real person.

Hiring deserves special care because some jurisdictions regulate automated tools in employment. New York City, for example, has required since July 5, 2023 that employers using an automated employment decision tool have it audited for bias within the past year, publish a summary of the audit and notify candidates. If you use any AI in recruiting, check the rules where you and your candidates are located.

Step 7: Address Copyright and Intellectual Property

AI raises two different IP questions for associations: can you own what AI helps you create, and could AI output infringe someone else's rights?

Ownership of AI-assisted work

The US Copyright Office concluded in its January 29, 2025 report on copyrightability that outputs of generative AI can be protected only where a human author has determined sufficient expressive elements, and that providing prompts alone isn't enough. Using AI as an assistive tool, or including AI-generated material in a larger human-authored work, doesn't bar protection for the human contributions.

The Office's registration guidance, published March 16, 2023, also asks applicants to disclose AI-generated content that is more than de minimis when registering a work and to limit the claim to the human author's contributions.

What this means in practice:

• Have people create assets you want to own and protect, such as your logo and other brand elements, publication covers, signature course content and standards documents. AI can help brainstorm, but substantial human authorship should be documented.
• Keep records of who wrote, edited or arranged important works and how AI was used.
• Check contracts with designers and writers so they disclose AI use and assign rights to the organization.

Avoiding infringement

• Don't upload copyrighted material you don't control, such as licensed reports, members' unpublished papers or purchased images, into tools whose terms let them keep or train on it.
• Review AI output that closely resembles existing works, especially images and long passages, before you publish it.
• Respect speaker and author agreements when you repurpose recordings or articles with AI.

When an IP question involves real money or a signature asset, ask an intellectual property attorney.

Step 8: Train, Handle Incidents and Review

Training

A 45-minute session covers what most people need: the principles, the data classes with examples, the approved tools list, how to request a tool and how to report a problem. Add it to staff onboarding and to the orientation you give new volunteer leaders (our guide to volunteer recruitment covers onboarding), and ask everyone covered to acknowledge the policy once a year.

Incidents

Treat AI mistakes like any other data or quality incident:

• Report fast. Anyone who puts restricted or confidential data into an unapproved tool reports it to the policy owner within 24 hours, without fear of blame for reporting.
• Contain. Delete the conversation if possible, check the vendor's deletion options and assess whether it's a data incident under your security plan.
• Correct. If AI-generated errors were published, correct them visibly and promptly.
• Learn. Update the policy, training or tools list if the incident revealed a gap.

Review cycle

Review the policy every six months for the first year, then at least annually, and whenever a major new tool or law appears. The policy owner reports to the board once a year on tools approved, incidents, training completion and proposed changes. Put that report on your board meeting agenda at a fixed time each year so it doesn't slip.

AI Policy Template

Adapt this template to your organization. Replace bracketed text, delete what doesn't apply and have the board approve the final version.

[ORGANIZATION NAME] ARTIFICIAL INTELLIGENCE USE POLICY
Approved by the Board of Directors on [DATE]. Next review: [DATE].

1. PURPOSE
This policy explains how [Organization] uses artificial intelligence (AI)
tools responsibly, protects member and donor information, and maintains
the accuracy and trustworthiness of our work.

2. SCOPE
This policy applies to employees, board and committee members, volunteers
acting on behalf of [Organization], and contractors. It covers standalone
AI tools, AI features in other software, AI meeting assistants, and
image, audio and video generators, used on any device or account for
[Organization] work.

3. PRINCIPLES
a. A named person is accountable for every AI-assisted output we use.
b. We protect confidential information.
c. We check accuracy before publishing.
d. We are open about AI use where it affects people.
e. People, not AI, make decisions about individuals.

4. ROLES
Board: approves this policy and receives an annual report.
[Executive Director/President]: accountable for compliance.
Policy Owner [NAME/TITLE]: maintains the approved tools list, reviews
requests, handles incidents and schedules reviews.
All covered persons: follow this policy and report problems.

5. APPROVED TOOLS
Only tools on the Approved Tools List may be used for [Organization]
work. Tools are approved, approved with conditions, or not approved.
Requests go to the Policy Owner, who responds within [10] business days.
Organizational tools must be held in organizational accounts.

6. DATA RULES
Public: may be used with any approved tool.
Internal: approved tools only.
Confidential (member and donor records, contact lists, financial
details, personnel matters): only tools approved for confidential data,
using the minimum necessary information.
Restricted (payment card or bank data, Social Security numbers, health
or disability information, information about minors, legal matters,
unpublished exam content, executive session discussions): never.
When unsure, treat data as the higher class and ask the Policy Owner.

7. DISCLOSURE
a. Automated assistants are labeled and offer a way to reach a person.
b. Realistic AI-generated images, audio or video are labeled or not used.
c. Participants are told before meetings are recorded or transcribed.
   AI note-takers are not used in executive or confidential sessions.
d. We never publish AI-generated testimonials, reviews or quotes, and
   never create synthetic voices or likenesses of real people without
   written consent.

8. HUMAN REVIEW
All member-facing and public content is reviewed by a person before
publication, including every fact, figure, name, date and link.
Education content is reviewed by a qualified subject matter expert.

9. PROHIBITED USES
AI may not be used to decide membership status or discipline; select
recipients of scholarships, grants or awards; score exams or decide
credential eligibility; make or screen employment decisions; or produce
legal or governance documents without qualified review.

10. INTELLECTUAL PROPERTY
Signature assets (logo, publications, core course content) are created
by people, with AI use documented. We do not upload third-party
copyrighted material to tools that retain or train on inputs. Contracts
with creators require disclosure of AI use.

11. TRAINING AND ACKNOWLEDGMENT
Covered persons complete AI training at onboarding and acknowledge this
policy annually.

12. INCIDENTS
Report suspected misuse or data exposure to the Policy Owner within
24 hours. Good-faith reports will not result in discipline for the act
of reporting.

13. REVIEW
This policy is reviewed [every six months during its first year and
annually thereafter], and when significant new tools or laws arise.

A 90-Day Rollout

Frequently Asked Questions

What should an AI policy include?

At minimum: scope, roles, an approved tools process, data rules, disclosure rules, human review requirements, prohibited uses, intellectual property guidance, training, incident reporting and a review schedule. The template above covers each one.

Does a small nonprofit need an AI policy?

Yes, though it can be short. Even an all-volunteer club has members' contact details and photos, and volunteers using free AI tools. A one-page policy covering data rules, review and disclosure prevents the most common problems.

Who should approve an AI policy?

The board should approve it, because it involves risk, member trust and potentially legal exposure. Day-to-day decisions, such as approving individual tools, can be delegated to a named policy owner.

Can we copyright content created with AI?

Only the human contributions. The US Copyright Office says prompts alone aren't enough for protection, but works where a person contributes sufficient creative expression, including arranging or modifying AI output, can be protected for those human parts. Ask an IP attorney about important assets.

Should we tell members when we use AI?

Yes, where it affects them: label automated assistants, disclose realistic AI-generated media, announce recording and transcription, and publish a short general statement about how you use AI and how people review it.

How often should an AI policy be updated?

Every six months in the first year, then at least annually, and whenever you adopt a significant new tool or a relevant law changes.

Next Steps

1. This week: name a policy owner and send the five-question current-use survey.
2. This month: adapt the template, build your first approved tools list and pick the data rules that fit your organization.
3. Next board meeting: present the policy for approval with a short summary of current use and risks.
4. Within 90 days: train everyone covered, publish your website statement and schedule the first review.

If your policy will cover AI meeting assistants, align it with how you take and approve meeting minutes, since official records still need a person to write them and the board to approve them.