A policy without practice is a filing exercise.

Here's what boards don't always hear directly: even when the organization hasn't "adopted AI," staff may already be using it. Usually because they're stretched and the tool helped. Not because they're being reckless.

That's the situation this workbook is built for. Not "should we use AI" — that ship sailed when your comms lead discovered ChatGPT could draft the newsletter. The real question is whether the use that's already happening has shared boundaries, named reviewers, and a team that knows what to do when something goes sideways. Most organizations adopted AI the way they adopted email: one person started, it worked, others followed. Nobody wrote the email policy first either.

"What's the worst thing that could happen if this goes wrong?"

That one question runs the whole framework. Mild embarrassment — green, go ahead. A donor loses trust — yellow, second pair of eyes. Someone gets harmed or their privacy violated — red, stop and ask. And if a use case is hard to classify, it's yellow until you decide otherwise.

All ten modules

From "what are we even using?" to a practice that survives week one.

Module 1

Why This Matters Right Now

The governance gap, Canada's regulatory patchwork (PIPEDA, Law 25, Bill 194, the voluntary code), and the donor trust math. Your board's fiduciary duty, named plainly.

Module 2

Know What You're Already Doing

The AI inventory — every tool in use, including the ones people adopted on their own. Most organizations are surprised by what this turns up. Plus the five vendor questions to ask before any tool touches sensitive data.

Module 3

The Green / Yellow / Red Framework

The classification system your staff can run in the moment — instead of a 30-page policy nobody reads. You sort your real use cases, in the room, together.

Module 4

The Never-Enter Data List

Short enough to memorize. Print it, tape it next to the screen, make it part of onboarding. With the safe-vs-unsafe prompt pairs that make it click.

Module 5

Human Review and Accountability

AI drafts. Humans decide. Walkthroughs for the three scenarios that actually come up: communications, donor engagement, and client-facing tools — each with its own checklist.

Module 6

When Something Goes Wrong

Something will. The blame-free incident protocol — because if people are afraid to report mistakes, they hide them, and hidden mistakes compound.

Module 7

Indigenous Data Sovereignty

OCAP® and CARE, and the question that reframes everything: not "is this allowed under our privacy policy?" but "are we operating under the direction of the people this data belongs to?"

Module 8

Writing Your Policy

The three-layer structure — board policy, staff guidelines, one-pager — with sample language to copy, paste, and adapt for each.

Module 9

Training Your Team

The minimum training checklist. Can your staff name five never-enter items without looking? That's the test — not whether they sat through a lecture.

Module 10

Keeping It Alive

The five review triggers and a review plan, so the policy stays a living document instead of a binder on a shelf.

Also inside

The parts you'll use more than you expect.

The Smallest Viable Policy. If you're very small and very stretched, skip straight here — governance for a team of three, ready in an hour. Grow it when you're ready.

The Language Bank. Ready-to-adapt wording for the moments that stall people: introducing the policy to your board, the motion language, answering the board member who asks "why do we need this?", announcing it to staff, responding when a donor asks about AI, grant application language, vendor questions, and the incident report template.

The Canadian resource directory. CCNDR, Imagine Canada, the RAISE program, the Privacy Commissioner, OCAP® training, and more — plus the full source list behind the research, so you can check our work.

A policy is only as strong as the moments when people are tired and moving fast. That's why the guardrails have to be simple and real.

What you might be thinking

Asked and answered.

"We already have a policy.": Then this is the half you're missing. A policy answers "what are the rules?" The workbook answers "does anyone follow them at 4pm on a Tuesday?" — training, review habits, incident response, and the conversations that make the rules feel like the team's own decisions instead of leadership's homework.
"My team will see this as one more compliance thing.": The workbook is built as conversations, not compliance. Your team sorts their own real use cases, writes their own never-enter list, names their own reviewers. People follow rules they helped make. They file rules they were handed.
"We don't have 2–4 hours.": One session or spread across a week — and if even that's too much right now, the Smallest Viable Policy is in here for exactly your situation. Stretched is the design assumption, not the edge case.
"Is this legal advice?": No. It's a facilitation framework built from sector research, designed so your team can make informed decisions and document them. The full disclaimer is at the bottom of this page.

A few honest conversations. A structure that holds.

$129

The workbook comes in the kit — with the board-ready Policy Template, the done-for-you tools, and the companion white paper. Ten modules, the Smallest Viable Policy, the Language Bank, and the Canadian resource directory. One price, everything.

Get the kit — $129

Your team is already mid-experiment. This just gives the experiment guardrails.

The policy is paper. This is the part that holds.