AI Usage and Governance Policy

uses artificial intelligence tools to help us serve our mission. This policy exists so that we use those tools in a way that is safe, honest, and accountable to the people we serve.

By AI tools we mean software that generates text, images, code, or other content, or that helps sort, score, or decide. This includes tools you open on purpose, features built into software we already use, and vendor systems that make decisions in the background.

The goal is not to slow good work down. It is to make sure that a person stays responsible for what we produce, that private information stays protected, and that no one is harmed by a confident mistake.

Everything in this policy follows from a few commitments. When a situation is not covered by a specific rule, use these to decide.

• A person stays responsible. AI can help with a task, but a named human owns any decision that affects a person, and can change it.
• Mission before novelty. We use AI where it helps us serve people better, not because a tool is new or fast.
• Protect the information. We keep private and sensitive information out of tools that are not approved for it.
• Be honest. We do not present AI-made work as something it is not, and we keep a record of how AI was used.
• Serve everyone. We check that a tool works for all the people we serve, and we always keep a way to get help without using AI.
• Leave a way to be questioned. Anyone affected by a decision can ask why and challenge it.

Whatever you type into an AI tool, treat as shared. Before you enter anything, decide what kind of information it is. A simple way to sort it, and you may adjust these labels, is by how sensitive it is.

When you need to work with real material, remove the private parts first, or use made-up stand-in information. Aggregate numbers are usually fine. A named person's details are not.

A tool being free, popular, or already inside our software does not tell us how it handles our data. Staff may use AI only through tools that has reviewed and approved for the kind of information involved. A personal account is not an approved tool.

Our current approved tools are listed below. To request a new one, contact , who reviews it before it may be used with any non-public information.

If a tool has not been reviewed, treat it as public and keep all sensitive information out of it until someone with the authority to approve it has signed off.

Good results come from a steady, human-led method, not from clever prompts. Use this approach for any real work.

Define the task, and give safe context

Say what you want: the purpose, the audience, what a good result looks like, and any limits. Provide the material and examples the tool needs, and no more. Strip out anything private, following Section 3.

Verify before you use

Never pass an AI answer straight into real work. Run these five checks first.

1. Math. Recompute any number yourself.
2. Sources. Confirm any fact or citation against the real source. Assume citations, links, and quotes can be fabricated even when they look real, and open them to check.
3. Scope. Check that it did not overreach or invent a requirement.
4. Supported facts. Make sure every claim is backed by something you provided.
5. Owner. Confirm the right person reviews and approves before it goes out.

Not every use of AI needs the same care. The right level of caution follows the stakes of the task and who is affected, not the tool. We sort uses into four levels.

When a use does not clearly fit a level, or someone wants an exception, they ask , who decides and records the answer.

For any use that affects a person, a human stays meaningfully in control. That means a real person, with the knowledge, the authority, and the time to change the outcome, is responsible for it. A signature on whatever the tool produced is not oversight.

It also means the people affected can find out that a decision was made, understand the basis, and challenge it. For each restricted use, we name the human owner and give affected people a real way to appeal and reach a person who can answer.

When AI helps with real work, keep a short record so anyone can later understand what happened. A few notes attached to the work are usually enough: what information was used, what the tool produced, how it was checked, who approved it, what was kept, and whether the use of AI was disclosed.

Be honest about AI use in a way that fits the audience. A quick internal draft may need nothing said. A public message, a fundraising appeal, or anything a person will rely on may need it made clear. We never present AI-made images or stories as real events that did not happen, and we do not use a real person's likeness or voice without the right to do so.

Even careful people hit incidents: information sent to the wrong place, a message pretending to be a colleague, a fake voice or image, or a tool used that was never approved. The first response is a short sequence you can run under pressure.

1. Recognize the warning signs, especially pressure to move fast or go around the normal process.
2. Stop, and do not act on the request yet.
3. Preserve it. Do not delete or try to fix it yourself, because that can destroy the record we need to respond.
4. Report it through our trusted route, below.

Urgency is a warning sign, not a reason to skip this process. Slow down and report through a channel you already trust.

Most AI we use comes from a vendor we do not control. Before adopts a new tool, whoever proposes it answers these questions, and reviews the answers.

• Scope. What is the tool for, who does it affect, what information flows into it, and how would we leave and get our data back?
• Data and training. Will our information be used to train the vendor's models? If we cannot turn that off, that is itself the answer for sensitive data.
• Retention and deletion. How long is our data kept, and can we have it deleted on request?
• Evidence. What proof supports the vendor's claims about accuracy, fairness, security, and accessibility? A missing answer counts as a risk.
• Contract. How and how fast are we told about a breach, who carries the cost if something goes wrong, and how do we end the relationship cleanly? Route the hard terms to counsel.

Some uses may sit under state, federal, funder, or sector rules. Using AI in hiring, benefits, or eligibility is among the most regulated. When a real rule may be in play, treat it as a question for . This policy helps us spot the trigger and ask. It is not legal advice.

This policy is owned by , who keeps it current and answers questions about it. We keep governance simple and ongoing, organized around four habits.

• Govern. The culture, roles, and accountability that everything else runs inside. This policy is part of it.
• Map. Keep an honest inventory of where AI is used, including embedded and vendor tools, each with a named owner.
• Measure. Watch how our uses are performing, including any harm, not just the benefits.
• Manage. Act on what we find, from adjusting a use to pausing or stopping it.

AI oversight is a standing item for on a schedule, with a short and honest set of measures. We review and update this policy at least once a year, and sooner when something important changes.

Who is responsible