How to Let Staff Use AI Safely

Why it matters

Staff are already using AI, with or without a policy. A short policy, the right accounts and a clean permission setup let you get the time savings while keeping client, patient and donor data out of the wrong places.

Step by step

1. Adopt a short AI use policy: approved tools, data that never goes in, human review.
2. Use business or nonprofit plans with admin controls, not personal accounts.
3. Before Copilot, find and fix files shared too widely.
4. Pilot with a small group for 30 days and measure time saved.
5. Set up a simple way to request a new tool.

Common mistakes

• Banning AI, so staff use personal accounts anyway
• Pasting client or donor data into free consumer tools
• Turning on Copilot before fixing oversharing
• No human review before AI written content goes out

Free tools for this

• Template2 pages

  AI Acceptable Use Policy

  A short starter policy: approved tools, data that never goes in, who reviews.

  PDFWord
• Checklist1 page

  Microsoft 365 Copilot Readiness

  Find and fix oversharing before Copilot shows people what they should not see.

  PDF

Questions people ask

Can staff use ChatGPT or other AI tools at work?

Yes, with a simple policy first: which tools are approved, what data must never be pasted into them, and a person who reviews anything that goes out. Without a policy, staff will use AI anyway, just without guardrails.

Is Microsoft 365 Copilot safe to turn on?

Copilot can only show people what they already have access to. The risk is that many organizations share more than they realize. Clean up oversharing and permissions first, then pilot with a small group.

Can we use AI tools with patient or client data?

Only with tools approved through your governance process and covered by the right agreements, such as a BAA for health data. That decision belongs with your compliance lead and legal counsel. I help build the process that gets you there.

Is it OK to use AI notetakers in meetings?

Be careful. California generally requires everyone on a call to agree before it is recorded, so announce it every time. Use an approved tool, know where transcripts are stored, and keep notetakers out of meetings about clients or patients unless that use has been approved.