Your Organization Has an AI Policy. You Just May Not Have Written It Yet.

Suppose I asked your leadership team a few questions.

Which AI tools are approved for organizational work?

What information may people enter into them?

When does AI assisted work require human review?

Who decides whether a new AI tool is appropriate?

Who is accountable for the final output?

If I received different answers depending on whom I asked, something important would already be happening.

Your people are making governance decisions. They just may not be calling them governance.

That is why I do not think the first question is simply whether your organization has written an AI policy.

The deeper question is whether leadership has intentionally decided how AI is allowed to participate in the work.

Because where leadership leaves a vacuum, individual judgment usually fills it.

Policy and Governance Are Not the Same Thing

An AI policy matters.

But downloading a template, adding it to a handbook, and emailing it to employees does not mean an organization has governed AI.

A policy can tell people what the organization expects.

Governance determines how those expectations are established, maintained, reviewed, and enforced.

This idea also aligns with established AI governance thinking.

The National Institute of Standards and Technology's AI Risk Management Framework organizes AI risk management around four ongoing functions: Govern, Map, Measure, and Manage. NIST describes governance as a cross cutting function that should inform the other risk management activities rather than operate as a one time checklist. NIST also released a companion Generative AI Profile in 2024, and the agency notes that the broader AI Risk Management Framework is currently being revised.

The language may sound technical.

The organizational idea is not.

Governance is something you maintain.

Start With What You Are Responsible for Protecting

For churches, ministries, nonprofits, and other mission driven organizations, AI governance is not merely an information technology concern.

It is a stewardship concern.

Organizations may carry information about employees, donors, members, children, families, clients, beneficiaries, finances, pastoral care, legal matters, board deliberations, internal strategy, and intellectual property.

So before writing rules around AI, I would ask:

What are we responsible for protecting?

Then we can examine how AI intersects with that responsibility.

The answer should not be built on fear or reduced to a blanket statement that sensitive information can never intersect with any AI environment. Different tools and account types can have different contractual terms, configurations, controls, and data practices.

That complexity is precisely why organizations need governance.

And some categories of information may carry legal or contractual obligations that vary by organization, jurisdiction, and type of work. Those questions belong with the appropriate attorney, insurer, privacy professional, or other qualified advisor rather than being guessed at by the person configuring the tool.

Good governance knows where its own authority ends.

The AI You Do Not Know About Matters Too

People can begin using AI for organizational work without formal approval or leadership visibility.

That is often described as shadow AI.

An employee finds a free tool. A volunteer creates an account. Someone discovers a browser extension. A department begins experimenting because the tool solves an actual problem.

The instinctive response may be to shut everything down.

I would be careful with that.

The University of Melbourne and KPMG global study found that almost half of employees reported using AI in ways that violated organizational policies. Even more revealing, 57 percent said they hid their AI use and presented AI generated work as their own. Only 40 percent reported that their workplace had a policy or guidance on generative AI use.

Those numbers do not mean every workplace has the same problem.

But they do tell us that policy without culture, education, and clarity can produce concealment instead of responsible practice.

Unauthorized use may also be revealing something leadership should understand. Perhaps employees have a real workload problem. Perhaps approved tools do not meet the need. Perhaps nobody has provided guidance.

Governance should protect the organization without making curiosity the enemy.

Volunteers Need Governance Too

For churches and nonprofits, there is another practical issue.

Not everyone doing organizational work is an employee.

Volunteers may create communications, manage information, prepare presentations, work with children or families, handle ministry administration, support fundraising, or participate in other important processes.

They may also have less formal onboarding, higher turnover, and personal devices or accounts outside the organization's direct administrative control.

That makes clarity even more important.

If volunteers are performing organizational work, leadership needs to decide which AI expectations apply to them and how those expectations will actually be communicated.

A policy that only employees know about is not governing the whole work.

Human Oversight Cannot Be Assumed

Use AI responsibly is too vague if nobody knows what responsible use looks like inside an actual process.

A polished AI response can still be wrong.

A professional sounding paragraph can still misrepresent the organization.

A useful summary can still omit something important.

Finished looking is not the same as trustworthy.

Human oversight should therefore be designed into the work rather than assumed after something goes wrong.

Your Policy Has to Meet Your People

There is little value in creating an excellent AI policy that employees never read, volunteers do not know exists, and leaders cannot explain.

People need practical examples. Managers need enough understanding to reinforce expectations. New employees and volunteers may need AI guidance during onboarding.

And because the technology keeps changing, governance cannot become a document the organization finishes once and forgets.

A simple way to think about review is:

When the tools change.

When the work changes.

And on a rhythm leadership will actually keep.

That could mean a scheduled review appropriate to the organization, but the principle is more important than the calendar.

Governance has to remain alive enough to match the work it governs.

What Good Governance Gives You

The purpose of governance is not to create enough rules to make innovation impossible.

Good governance creates confidence.

Leadership understands the boundaries. People understand what is expected. Teams know when they can proceed and when they need to ask. Human accountability remains visible. New tools can be evaluated rather than adopted through improvisation.

That is why I see protection and enablement as partners rather than opposites.

Guardrails are not there simply to stop movement. Good guardrails make responsible movement possible.

Chayil Can Begin With the Governance Problem You Already Know About

Sometimes the first sentence we hear is:

"We need an AI policy."

That is a legitimate place to begin.

But the policy may uncover a larger need around training, workflow decisions, tool approval, information handling, accountability, or leadership ownership.

We do not have to solve everything at once.

We can begin with the governance question leadership already knows it needs answered.

Before We Leave This Conversation

Suppose the organization has now established clearer expectations. People understand more about responsible use. Leadership has defined approved tools, review responsibilities, accountability, and the information it is responsible for protecting.

That is significant progress.

But another question is waiting.

What happens when AI no longer simply produces something for a person to review?

What happens when the system can take the next step?

It may access information, interact with another application, route work, update a record, initiate communication, or continue through several steps with less direct human involvement.

At that point, governance has to answer a different question.

We are no longer deciding only what AI may generate.

We have to decide what AI is authorized to do.

That changes the conversation around access, permissions, approval, monitoring, escalation, human intervention, and accountability.

And that is where I want to take us next.