Co-written AI policy
For NGOs, nonprofits and foundations: an artificial intelligence use policy people apply, not a charter people sign. Your team writes it in three workshops; we hold the pen and the method.
- Length
- Four to six weeks
- Method
- Three workshops with a pilot team, a test on ten real cases
- Pilot team
- 5 to 8 people from your organisation, field staff included
How is it different from a charter?
A charter states principles. A policy says what to do, on Monday morning, faced with a specific case. Its amber light is wide, its red short and justified: a rule that is too strict pushes use into the shadows.
Adapted
To your law, to sector standards and to your donors’ rules.
Integrated
Into your existing policies, without a separate system.
Tested
On ten real cases brought by your team, before it is adopted.
Equipped
A register, procedures and a check, so that it gets applied.
What does the policy include?
Two levels of text, and the toolkit to apply them.
The charter
One to two pages: the principles and the red lines. What you display, including to your donors.The use policy
Six to ten pages: scope, uses in green, amber or red, data rules by sensitivity and account type, human checking, transparency, images, buying a tool, training, incidents, review.The register of tools and uses
For each tool: the subscription, the data allowed, the person in charge, the review date.The decision tree
One page: “Can I use AI for this?” The policy in thirty seconds.The procedure to approve a new use
A one-page form, with the threshold that triggers an impact assessment. So that no department decides alone.The tool purchasing grid
The clauses to require from a supplier: audit right, notice of model changes, data ownership, exit right.The transparency statement
Standard wording for your reports, your publications and your images.The incident reporting form
What happened, who to tell, what to do. To learn from mistakes.The integration map
What changes in each of your policies: data protection, safeguarding, code of conduct, IT charter, communication, procurement, human resources.The roll-out kit
A one-page sheet for all staff, ten questions and answers, a fifteen-minute presentation for team meetings.
How do we write the policy?
Over four to six weeks, in the full version.
Preparation
Before the workshops
We read your existing policies and, if there was one, your diagnostic.
Workshop 1
3 h
Principles and red lines; your real uses sorted into green, amber or red; your data sorted by sensitivity.
First version
Drafting
We adapt it to your law and to sector standards, and integrate it into your existing policies.
Workshop 2
3 h
The edge-case test: ten real cases brought by the team, such as translating a victim’s testimony or illustrating a publication with a generated image. The policy must settle each one clearly, or we fix it.
Second version
Drafting
The corrected policy, and its annexes.
Workshop 3
2 to 3 h
Governance and roll-out: roles, the register filled in during the session, the communication plan, indicators, the review date.
Adoption
1 h
A presentation to your leadership or your board. In France, informing or consulting the works council (CSE) where required.
3-month check
In the full version
A short survey, a check of the register, and the edge-case test run again.
What we ask of you
- A pilot team of 5 to 8 people: leadership, programmes, monitoring and evaluation, safeguarding, communication, IT or administration, human resources, and ideally a board member.
- Field staff in contact with communities, in the pilot team or consulted. A wider consultation of communities is possible as an option.
- Your existing policies.
- Ten real cases for the edge-case test.
- Two conditions written into the quote: your leadership present at workshops 1 and 3, and an adoption date set from the start. Without them, a policy stays a dead letter.
What do you build on?
Every legal point is written as a point to be checked by a lawyer or your data protection officer.
GDPR
For organisations based in the EU or targeting people in the EU: data minimisation, legal basis, an impact assessment when a use is likely to seriously affect people, a contract with the supplier, transfers outside the EU.
EU AI Act
Article 4 on AI literacy, in force since 2 February 2025, and the link with training. Article 50: since 2 August 2026, AI-generated text published to inform the public must be disclosed, unless a human has reviewed it editorially. And spotting the rare uses that could be “high-risk”.
National law
An analysis of the law in the countries where you are based and where you work: the personal data protection law, the supervisory authority, the rules specific to your sector.
Sector standards
The IASC operational guidance on data responsibility (2023); the ICRC handbook on data protection in humanitarian action; SAFE AI; your safeguarding and accountability policies.
Donors
The AI rules of your main donors.
How do you know it is applied?
We test a policy the way we test an evaluation instrument: by putting cases to it.
Share of staff who know the policy
Reading or training certificate
Share of tools actually in use that appear in the register
The diagnostic survey, or a short survey
Share of new uses that went through the approval procedure
Register
Incidents reported. A rise at first is a good sign: a reporting culture is taking hold.
Reporting form
Share of uses on unauthorised accounts
The diagnostic indicator, measured again
How clear the policy is: share of edge cases settled without ambiguity
The workshop 2 test, run again at 3 months
Which policy format suits us?
Essential
- For whom
- Up to about thirty people, in a single country.
- What it includes
- The charter, the policy, the register, the decision tree, the transparency statement, the reporting form and the roll-out kit; three remote workshops.
Full
- For whom
- Several countries, or sensitive data.
- What it includes
- Everything in Essential, plus the impact assessment procedure, the purchasing grid, the full integration map, two national laws, the board presentation, the 3-month check and an English version.
Network or donor
- For whom
- A network, or a donor who wants to set minimum requirements for its partners.
- What it includes
- A shared framework policy adapted for each member, or minimum AI requirements for your partners.
As an option, or within twelve-month AI steering: a half-day annual review, because tools change fast. The solidarity rate applies.
Request a quoteWhat is this policy not?
Not legal advice
Legal points are to be checked by a lawyer or your data protection officer.
Not a ready-made charter
Your team writes it: that is what gets it applied.
Not an IT security policy
It refers to your IT charter, without replacing it.
Not a document for show
It is not written for your donors and then filed away: it is shared, checked and reviewed.
How does it fit with the rest?
With a diagnostic first, preparation is lighter and your real uses are already known.
The training makes the policy known: its rules open every session.
Twelve-month AI steering keeps it alive and reviews it over time.
Who leads this work?
Arnaud Dandoy, PhD in criminology (University of Kent) and law graduate (UCLouvain). More than ten years with public institutions, the United Nations and international NGOs, in Tunisia, Morocco and Haiti. Based in Tunis, working remotely and on site.
Read the full backgroundWhere do we start?
The free hour is enough to see where you stand and what a policy would change. You can also request a quote right away.