Not hypothetically. Someone on your staff has pasted a grant narrative into a chatbot to tighten it, or run a donor letter through one to fix the tone. Usually for good reasons, and usually without telling anyone.
That’s what people mean by shadow AI: tools used every day that the organization hasn’t approved or doesn’t know about.
Why a ban backfires
The instinct is to ban it. But a ban doesn’t end usage. It moves it to personal accounts and personal phones, where you have no visibility and no way to set rules.
The people using AI to write faster are often your most productive staff. Telling them to stop rarely works. Telling them how to do it safely usually does.
The risk is what goes in
The danger was never the tool itself. It’s what people put into it.
Generally fine: drafting a newsletter, rewriting a job posting, summarizing a public report, brainstorming event names. There’s nothing there you wouldn’t eventually put on your own website.
Never: client case notes, intake records, donor giving histories, staff personnel matters, or anything about a person’s health, housing, or immigration situation. Especially not into a free consumer account.
A simple test: if you wouldn’t paste it into an email to a stranger, don’t paste it into an AI tool your organization hasn’t approved.
The setting matters more than the brand
This is the part most people don’t know. Many AI tools have different rules depending on which version you’re signed into. Paid and business tiers often let an administrator turn off retention and keep what you type out of model training. Free consumer versions often don’t and may keep your input to improve the product.
Same company, different rules, and most people have no idea which version they’re using. Check the data settings of whichever tool your team uses, and if you approve one, approve a specific tier.
A policy in three lines
A workable AI policy doesn’t need to be long. Three lines will do:
- Here is the tool we’ve approved.
- Here is what you may put into it.
- Here is what you may never put into it, and ask if you’re unsure.
Three lines beat a ban, because three lines are something people can actually follow. You can add detail later, such as reviewing AI-drafted content before it goes out, or noting when you used AI in a grant application if a funder asks. Start with the three.
This week’s action
Name one approved tool and write the three lines. Send them to the whole team, not just the people you think are using AI.
That closes Section 3. Next: staying resilient, starting with why a familiar voice is no longer proof.