Insights
The AI tool your staff already installed
A ban does not work and a free-for-all is a breach waiting to happen. The one-page policy, the inventory, and the three guardrails that let a small organization adopt AI safely.
Walk your office and ask who has used ChatGPT, Gemini, or Copilot for work this month. The honest answer, in almost every organization we have assessed, is “most of us.” Some of that use touched member, donor, patient, or customer data. None of it was governed. That is not a staff problem; it is a leadership vacuum, and it is fixable in about thirty days.
Write the one page people will read
An AI acceptable-use policy for a small organization fits on a page: which tools are approved, which data must never be pasted into them, who approves a new tool, and what to do if something goes wrong. Longer than that and it will not be read. We base ours on the NIST AI Risk Management Framework, translated into plain English.
Inventory before you regulate
You cannot govern what you have not listed. Ask each team what they use and for what. You will find three tiers: general chat assistants, AI features inside tools you already pay for (your CRM, your email platform, your church-management system), and the automations somebody built on a free trial. Each gets a different rule.
Three guardrails that do most of the work
- Data rules by classification. Public information can go anywhere. Internal information stays in approved tools under your organization’s account. Personal, financial, and health information never goes into a consumer AI tool — full stop.
- Organizational accounts, not personal ones. Approved tools are licensed to the organization so that data-retention and training settings are controlled centrally and access ends when employment does.
- A human approves anything that leaves the building. AI can draft the donor letter, the member follow-up, the grant narrative. A named person reads it before it is sent, and the system keeps a log.
Then get the benefit
Governance is not the goal; it is the permission slip. Once the rules exist, the workflows that save real staff time — member follow-up that never falls through the cracks, acknowledgements in your voice, first drafts of reports — can be built on top of the tools you already own. That is the shape of most of our implementation work, and it starts with the policy, not the platform.
MIKE McGEE · Founder, ForEffect · ABOUT
One call, no deck
Start with a conversation.
Tell us what keeps you up at night. We read and reply to every note — usually within one business day — and the first conversation is about your organization, not our services.
Book a 20-minute conversation
Pick a time that suits you. No slides, no pitch — twenty minutes on what your organization is dealing with and whether a fractional executive is the right shape of help.
Choose a time