For your board
AI Adoption
Policy
The governing instrument. Plain language your board can adopt, grounded in the privacy law that actually applies to you.
A policy your board adopts.
Procedures your team can follow.
Spencer Morley Consulting writes AI adoption policies and companion procedures for non-profits and charities across Canada. The policy sets the rules your board stands behind. The procedures tell staff and volunteers what to do with the AI tools they already use. Both are built on the privacy law that applies to your organization.
Book a 15-minute callWho this is for
Organizations that answer to a volunteer board.
The same two documents, sized to your organization:
- Registered charities
- Non-profit societies and associations
- Community and social service agencies
- Sport, recreation, arts and culture organizations
- Foundations and member-based organizations
Every engagement is scoped on a short call, because a five-person society and a multi-site agency need different documents.
What will you receive?
Spencer Morley Consulting writes both.
AI Adoption
For staff and volunteers
AI Adoption
Procedures
The operating companion. This is what a staff member or volunteer opens when they have an AI tool in front of them and a decision to make.
What the procedures cover.
Most AI policies stop at principles. The procedures are where they become usable. A typical set for a non-profit covers:
- which tools are approved, and who can add one to the list
- what may never be entered into a public AI tool, including donor, client and participant information
- when a person must review AI output before it goes into a grant application, report or donor letter
- when donors, clients and the people you serve are told that AI was used
- how volunteers are covered, and how they are trained
- how a mistake or privacy incident is reported, and to whom
- how often the procedures are reviewed
Exact contents follow your existing policies and what your staff and volunteers actually use.
How the work runs
Built to connect to the policies you already have.
Six phases, from first conversation to documents your board can adopt. A key distinction is how we reconcile your existing policies: the new AI policy is written inside your policy handbook, not beside it.
- Phase 01
Discovery & grounding
Executive director & board sponsor
What staff and volunteers actually use, what the board expects, and which privacy rules and funding agreement terms apply.
- Phase 02
Policy cross-reference
Where the value is
Your existing policies are read for conflicts and gaps, so the AI policy attaches to them instead of sitting beside them.
- Phase 03
Precedent & guidance check
Comparable adopted policies and current guidance are checked against present law before they inform the draft.
- Phase 04
Two-tier drafting
Policy + procedure
A board policy sets principles and authority. Companion procedures set the day-to-day rules for staff and volunteers.
- Phase 05
Review & refinement
Draft language is tested with your staff lead and IT provider before the board sees it.
- Phase 06
Board-ready finalization
Both documents are finalized in your format: the policy for board approval, the procedures commonly approved by the executive director.
Phase 2 cross-references the AI policy against
- Privacy policy
- Confidentiality and volunteer agreements
- Human resources policies
- Acceptable use of technology
- Records retention
- Board governance & delegation
Stress test
between phases 4 and 5
between phases 4 and 5
Before the second draft, the policy and procedures are run against written scenarios (hypothetical, roles only), such as a volunteer pasting client notes into a free AI tool, or a grant report drafted with AI. Each finding is resolved through a draft change, an operational action or a recorded decision; material revisions are retested.
A policy that stands on its own has nothing holding it up.
When a new policy sits beside your existing handbook instead of inside it, nothing in the other policies points at it, and shared language is written twice. Duplicated language drifts apart at the first amendment.
So we write the AI policy into the handbook you already have. We reconcile definitions, responsibilities and reporting routes, and identify any companion changes your other policies need, with an owner for each.
What your policy must contain
Seven parts every non-profit AI policy needs.
Use these to judge any template you are handed, or to scope the policy your organization actually needs.
Purpose and scope
Why the policy exists and who it covers: staff, volunteers, contractors and the board.
Approved and prohibited uses
Which AI tools may be used and for what, and what is off limits: above all, entering donor, client or participant information into public AI tools.
Information handling
How personal information may and may not be used with AI, consistent with the privacy law that applies to you and the terms of your funding agreements.
Incident reporting
How a suspected privacy breach involving AI is reported, and who is accountable for the response.
Accountability
Who owns the policy, approves new tools and reports to the board on how AI is being used.
Training
Training for staff and volunteers as a condition of using AI tools, sized to their role.
Board-ready framing
Plain language a volunteer board can review, approve and hold management to.
The law behind it
Which privacy law applies to a non-profit?
It depends on your province and on what you do. The documents are built on the answer.
- British Columbia: the Personal Information Protection Act applies to non-profits for all of their activities.
- Quebec: the private-sector privacy act applies to non-profits too, whether or not an activity is commercial.
- Alberta: the Personal Information Protection Act applies to non-profits incorporated under the Societies Act or the Agricultural Societies Act, or registered under Part 9 of the Companies Act, only for their commercial activities, such as selling or sharing a donor or membership list. Other non-profits are fully covered.
- Elsewhere in Canada: the federal PIPEDA applies to a non-profit only when it engages in commercial activity.
Funding agreements, especially with government, can carry privacy terms of their own. Phase 1 reads those too.
General information about how the law applies, not legal advice.
A few useful answers.
Who writes AI adoption policies for non-profits in Canada?
Spencer Morley Consulting, an Edmonton-based firm founded in 2023, writes AI adoption policies and companion procedures for non-profits and charities across Canada. Each policy is grounded in the privacy law that applies to the organization and written for board adoption.
Do volunteers need to be covered?
Yes. Volunteers often handle the same donor and client information as staff, so the procedures apply to them, with training sized to their role.
Is this part of your AI training?
No. It is a standalone engagement. Many organizations start with the policy and procedures, then train staff and volunteers against them.
Will it be tested before the board sees it?
Yes. Before the second draft, the policy and procedures are run against written scenarios, and every gap is resolved before the documents go to the board.
How is it priced?
Each engagement is scoped on a short call, because the size of your organization, the information you hold and the policies already in place all change the work.
Tell us what you’re facing.
Book a time to talk, or send a note with the form and we will reply by email.
Book a 15-minute callWe respect your privacy. We don't share form submissions with third parties for their marketing. Privacy policy