AI Use Policy | M.A.I. Consulting

The situation

Staff are using AI without rules, or under a prohibition that moved the use out of view.

Programme, fundraising and operations staff draft with AI, sometimes on documents containing beneficiary or donor information. Either no rules exist, or a prohibition memo exists and the work continues on personal accounts where nobody can see it. When a funder's due-diligence pack asks about AI governance, there is nothing to attach.

In the 346-organisation benchmark, 47% have no AI governance policy while 92% use AI source. The gap, not the technology, is what creates the exposure.

What you hold at the end

A policy the board approves and staff follow, because it states what they may do.

Permitted uses by role, as a table: role, tasks permitted, tools permitted.
Red lines: inputs that never enter a tool, and decisions that are never delegated.
A data classification table, four classes, each mapped to the tools it may enter.
An approved tool list with the settings each tool must have and the date it is next reviewed.
Disclosure rules for funders, beneficiaries, publications and board papers.
An escalation path and a 24-hour incident procedure.
A review cycle every six months, alongside the re-score.

The policy is an internal governance document written with your data protection lead. It is not legal advice, and it does not certify you against any standard. Where a legal opinion is needed, we will say so and stop.

Examples

Three clauses, written as they would appear.

Illustrative extracts. Your clauses are drafted from your own tool inventory, data and funder requirements.

Permitted use

Section 3.4

Programme staff may use an approved tool to draft donor narrative reports from internal notes and the previous report, provided that no beneficiary name, case identifier or location below district level is entered, and that every figure is verified against the source file before the draft leaves the department.

Data classification

Section 5.3

Personal and beneficiary data is Class 4. It may not be entered into any AI tool, approved or otherwise, unless the tool is covered by a data processing agreement listed in Annex B and the use is recorded in the register kept by the data protection lead.

Disclosure

Section 8.1

Where an approved tool has contributed to a document submitted to a funder, the submission states so in the form agreed with that funder, and the responsible officer remains the author of record.

Specific annex

Annex D: casework

Caseworkers may use an approved tool for anonymised summarisation of published guidance only. No case file, referral or client communication may be entered, in whole or in part, and no eligibility or safeguarding decision may be informed by tool output without a documented human review.

An umbrella policy covers the organisation. Specific annexes add rules for one department or use where the umbrella is not enough: casework data, fundraising, HR records, procurement.

How we get there

Drafted with the people it governs, then taken to the board.

Inventory first. What your teams already do with AI, and on which data. Rules written without this are the ones staff route around.
Interviews with the people who use the tools and with your data protection lead.
Drafting clause by clause, each one tested against a real task the team has to perform.
One board round, then the approved version, the annexes and the tool list.

Typical duration: Three to four weeks

Price

Fixed price and fixed scope, agreed in writing.

Priced on organisation type and size, with specific annexes priced individually. Fixed in writing after a 30-minute call. Training and policy bought together cost less than bought apart.

Price this service Back to all five services

Thirty minutes establishes whether this is the right service.

If a different one fits better, or none does yet, we will say so on the call.

Book a call Take the free readiness check