One of your board members is going to ask.

If that question lands on you — and it lands on whoever the board thinks is "good with this stuff" — you have two options. Spend weeks reverse-engineering what a Canadian nonprofit AI policy needs to contain. Or start from one that already knows.

Not having a policy yet isn't negligence. Hardly anyone has one — 5% of Canadian nonprofits, by the most generous count. The hard part was never the writing. It's knowing what belongs in the document: which privacy law actually applies to you, what the CRA expects when AI touches donation receipts, what your board approves once versus what staff update as tools change. That knowledge is what you're buying.

Your board approves it once. Your staff update it forever.

The template's two-part structure is the reason it survives contact with reality: Part A is the stable policy your board signs. Part B is the living guidelines staff own. A new tool shows up? Part B changes. The board never has to re-approve the framework.

Part A — what your board approves

Twelve sections. Every one of them earns its place.

01

Purpose

Why the policy exists, anchored to your mission — with a marked spot to make it yours.

02

Scope

Covers staff, contractors, volunteers, and board — on work devices, personal laptops, and phones. If it's your organization's work, the policy applies.

03

Principles

Human oversight, privacy, equity, transparency, accountability. Five commitments in plain words, not poster slogans.

04

Risk Classification

The three-tier system — what staff may use freely, what needs review, what's off-limits without approval. With examples you customize to your actual work.

05

Data Boundaries

The list of what never enters a free AI tool: donor records, client information, HR files, credentials, Indigenous community data. Written to be memorized.

06

Vendor & Tool Requirements

What to verify before adopting any tool — does it train on your data, where the data lives, what happens when you leave. Includes the CLOUD Act problem nobody mentions.

07

Accountability

Named reviewers for every category of output, the fact-checking requirement, and the bias and dignity review for content about the communities you serve.

08

CRA Compliance

For registered charities: Regulation 3501 on donation receipts, CG-013 on fundraising, CG-027 on public policy work. The section your lawyer will be relieved to see.

09

Indigenous Data Sovereignty

OCAP® and CARE principles, and the consultation obligations that apply before AI touches community-held data. Retained even if you don't work with Indigenous communities yet — it sets the framework for when you do.

10

Incident Response

A five-step procedure that treats mistakes as reports, not confessions. Blame-free by design, because hidden mistakes compound.

11

Transparency & Disclosure

What staff, board, donors, and community are told about your AI use — with ready-to-adapt public disclosure language.

12

Policy Review

Annual review plus the five triggers that reopen it sooner. The policy stays alive instead of aging in a drive.

Part A closes with a board motion, pre-written — moved, seconded, dated — and a version control table. Your board chair reads it out, hands go up, done.

Part B — what your staff actually use

Two pages. On purpose.

The staff guidelines compress the whole policy into something a person can hold in their head on a busy Tuesday: the approved tools list, the traffic light (green go, yellow second-pair-of-eyes, red stop-and-ask), the never-enter list, what happens before anything goes public, and who to ask when unsure — with no penalty for asking. The rule the whole document serves:

If it would harm someone — or your organization — if it were exposed, it doesn't go into a public AI tool.

From inside the template

The kind of practical this is.

Here's an example the staff guidelines use to teach the data boundary — try it on your own team:

✗ Unsafe "Write a thank you letter to Margaret Chen who gave $25,000 to our capital campaign. She's a retired judge in Kelowna."

✓ Safe "Write a thank you letter to a major donor who made a significant gift to a capital campaign. Tone: warm, personal, reference the project."

The safe prompt gets you 90% of the same output. You fill in the personal details yourself. On free plans, tools training on what you type is usually on by default — which means the unsafe version may have just donated Margaret to someone's model.

What you might be thinking

Asked and answered.

"We already asked ChatGPT to draft us a policy.": Most AI-drafted policies are American boilerplate — no PIPEDA, no CRA obligations, no Indigenous data sovereignty, no two-part structure that survives tool churn. A policy that misses what Canadian law expects isn't a head start. It's a false sense of finished.
"We're too small for this.": The customization marks (✎) exist exactly so a three-person shop can strip it to fit. Small organizations aren't exempt from privacy law or donor trust — they just have less room to absorb a mistake.
"Shouldn't a lawyer write this?": A lawyer should review it — the template says so itself, on the page. But paying legal rates to draft from zero is how a policy becomes a six-month project. Hand them this instead; the review gets shorter and the invoice gets smaller.
"Is this legal advice?": No. It's a governance template built from sector research, written so your board can make informed decisions and document them. The full disclaimer is at the bottom of this page.

Ready before your next board meeting.

$129

The policy comes in the kit — with the Practice Framework Workbook, the done-for-you tools, and the companion white paper, Navigating the Algorithmic Frontier. One price, everything.

Get the kit — $129

You don't need the whole governance question solved today. A signed policy is a fine place to start.