Dr. Stephanie Rose-Belcher, Chief Operating Officer at JMT Consulting, joined The Nonprofit Show to talk about what nonprofit finance leaders need to decide before their teams get any further ahead of them.
A nonprofit AI policy starts with three decisions, not a training plan: which AI tools your organization approves, which ones it blocks, and what data may never be entered into either. Free versions of these tools can use what you put into them, so your donor list, your grant files, and your board materials need a policy before they need a prompt.
Most conversations about AI in nonprofit finance are about what the tools can do. This one was about who is accountable when they do it badly, and what a finance leader is supposed to put in place before that happens.
The short version from Rose-Belcher: the technology is not the hard part. The governance is.
AI doesn’t absolve you of accountability and responsibility for protecting your organization.Dr. Stephanie Rose-Belcher, Chief Operating Officer, JMT Consulting
Your team is already using AI, with or without a policy
The starting position in most organizations is not a blank page. It is a set of habits that formed while nobody was deciding anything.
Unless they’ve put a lot of time and energy into this already, you’ve got the wild west.Dr. Stephanie Rose-Belcher
Staff sign up for free accounts because the tools genuinely help. A grant manager pastes in a spreadsheet to reformat it. A development director asks a chatbot to segment a list. Nobody is being reckless. They are being efficient with the only version available to them, which is the one that costs nothing and protects nothing.
That is why the first governance task is not writing a policy. It is finding out what is already happening. Audit what your team is using right now, then decide.
Decide first, train second
Training is where most organizations want to begin, because it feels productive and nobody has to say no to anything. Rose-Belcher argues it is the wrong first move.
If you haven’t said, here’s what we’re allowing, here’s what you can use, here’s what you cannot use, what are you training them on?Dr. Stephanie Rose-Belcher
The decisions come first: which tools are approved, which are blocked, who gets access, what data can be entered, and who reviews the output. Training follows, because only then is there something specific to train on.
“There are always three aspects to anything you’re doing. It’s the people, it’s the technology, and it’s the process or the policy,” Rose-Belcher said. AI is no different. Skip any one of the three legs and the other two will not hold it up.
Why the free version is the real risk
The distinction that matters most for a nonprofit is not which AI tool you pick. It is which tier of it your staff are using.
Free tiers are generally free because the data you enter helps train the model. For a finance or development team, that data is the organization’s most sensitive asset.
You just gave your donor list to ChatGPT.Dr. Stephanie Rose-Belcher
JMT’s own answer, put in place more than two years ago, was to block free versions outright at the network level, vet the tools that made sense for the work, and buy enterprise licenses for those. Paid enterprise tiers are what give an administrator the settings that matter: who has access, what is retained, and whether your data is walled off from model training.
That approach costs money, and Rose-Belcher is direct that many nonprofits will not have the budget for it this year. The fallback is not to shrug.
If you cannot fund enterprise licenses, write an acceptable use policy instead. Name what is public, what is private, and what is confidential, then state plainly which of those categories may never be entered into a free tool. That costs nothing but management attention, and it is the same data classification work your security posture already needs.
What your software contracts should say about your data
AI features are arriving inside software nonprofits already run, often without a separate decision to turn them on. That is not inherently a problem, but it does move the question into your contracts.
Rose-Belcher’s test is a simple one. A vendor learning from how their product is used, in order to make the product better, is reasonable and worth wanting. A vendor repurposing your data outside that, or sharing it, is not.
They shouldn’t use your data in a way that you wouldn’t approve of.Dr. Stephanie Rose-Belcher
You will not renegotiate terms with the largest software firms, and you do not need to. What you need is to read the data protection language you already agreed to, ask each vendor directly what they are doing with AI, and know the answer before an auditor or a board member asks you.
Make AI use repeatable, not personal
This is the part organizations reach only after the basics are handled, and it is where finance teams get bitten.
Once everyone has a license and permission, capable people start building their own methods. Five accountants solve the same task five different ways, get five slightly different outputs, and none of it is documented.
We can’t have the same fixed assets transaction built 10 different ways.Dr. Stephanie Rose-Belcher
The fix borrows from software development. A small group of experts builds the process once, the team runs it side by side against the manual method to validate the output, and only then is it shared as the standard way that task gets done. The result is repeatable, traceable, and defensible: when someone asks where a number came from, you can walk the steps and show them.
Where to start this week
None of this requires a committee meeting to begin.
- Audit what is actually in use. Find out which AI tools your staff are using today, on which accounts, and with what data. You cannot govern what you have not measured.
- Decide what is approved and what is blocked. Pick the small number of tools that fit your work and say no to the rest, in writing.
- Classify your data. Public, private, confidential. State which categories may never go into an AI tool, and which tools are cleared for which data.
- Put the technical controls behind the policy. A policy nobody can enforce is a suggestion. Your IT function or managed provider should be able to block what you have decided against.
- Train to the decisions you made. Cover the approved tools, the prohibited data, and who reviews output before it leaves the building.
- Revisit it on a schedule. This is not a one-time policy. The tools change faster than your handbook does.
The reason to do this is not fear of the technology. Rose-Belcher’s closing point was the opposite, and it is a fair challenge to anyone running a finance function right now.
We’re managers, and if we can’t manage ourselves and our organizations through this change, then we’re not doing our jobs.Dr. Stephanie Rose-Belcher
One caveat worth stating plainly: JMT Consulting advises on finance and technology, not law. Before you adopt an AI policy, have your counsel review it against your state’s requirements, your funder and grant obligations, and any sector rules that apply to your organization.
If you are working out what your own AI policy should say, or what your current tools are doing with your data, we are happy to talk it through. We have had this conversation with a lot of nonprofit finance teams this year.
Dr. Stephanie Rose-Belcher spoke with host Julia C. Patrick on The Nonprofit Show, produced by the American Nonprofit Academy.
Frequently asked questions
What is AI governance for a nonprofit?
AI governance is the set of decisions and controls that determine how your organization uses AI: which tools are approved, who may use them, what data may be entered, who reviews the output, and how that is enforced technically. It covers three things together, the people, the process or policy, and the technology. Missing any one of them leaves the other two unsupported.
Is it safe for staff to use free AI tools at work?
Not with confidential data. Free tiers commonly use what you enter to train their models, which means a donor list, a grant file, or personally identifiable information can leave your control the moment it is pasted in. Enterprise licenses give an administrator control over access, retention, and whether your data is used for training.
What should a nonprofit do first, write an AI policy or train staff?
Neither, quite. Audit what your team is already using, then make the decisions about approved tools, blocked tools, and prohibited data. Policy and training both follow from those decisions, because until they exist there is nothing specific to write down or teach.
What if we cannot afford enterprise AI licenses?
Write an acceptable use policy instead. Classify your data as public, private, or confidential, then state which categories may never be entered into a free tool. It costs nothing but management time, and it is the same data classification work your broader security policy already requires.
Who is accountable when AI produces a bad result?
You are. Accountability does not transfer to a tool. If unvalidated output reaches a board, a funder, or an auditor, the answer cannot be that the AI produced it. That is why review, validation, and traceability belong in the process rather than being left to individual judgment.
