AI Policy and Guidance Template for Nonprofit and Community Organizations

Start here: the law that already applies to nonprofit AI use

This section is a plain-language orientation to law that already existed before AI. It is not a determination of what applies to any particular organization. Read it as background and check anything that matters against the source. No Mississippi statute or executive order imposes AI-specific obligations on private nonprofit organizations as of August 2026.

That is the correct starting point, and it is frequently stated incorrectly. Everything currently in force in Mississippi is directed at state agencies or is voluntary:

• Executive Order No. 1584 (January 8, 2025) directs the Department of Information Technology Services to inventory state agency AI use and develop policy recommendations. It binds state agencies.
• The Mississippi Artificial Intelligence Regulation (AIR) Task Force, created by S.B. 2426, Laws of 2025, issued its first report on January 13, 2026. Its recommendations were directed at state agencies, boards, commissions, and local governing authorities. Mississippi enacted the recommended statutory AI definition in House Bill 1723 (2026), effective July 1, 2026. The recommended chatbot disclosure has not been enacted.
• The ITS Acceptable Use Policy for Artificial Intelligence (approved November 25, 2025) applies to ITS operations. ITS offers it as a standard other agencies can adopt.
• The Mississippi Statewide AI Framework (launched May 21, 2026) is explicitly “not a curriculum or mandate.”

A nonprofit’s actual AI exposure runs through law that already applied to it before AI existed.

What to check

One coverage point deserves emphasis because organizations routinely miss it. Title VI defines “program or activity” to include an entire private organization where federal assistance is extended to it as a whole, or where the organization is “principally engaged in the business of providing education, health care, housing, social services, or parks and recreation” (42 U.S.C. § 2000d-4a). Organizations principally engaged in those fields should confirm with counsel whether Title VI reaches the entire organization rather than only the federally funded program.

What this template covers

1. Start here: the law that already applies to nonprofit AI use
2. What this template covers
3. Purpose of this framework
4. What this template is, and what it is not
5. Foundational principles your board may adopt
6. Governance, roles, and accountability
7. Acceptable use and prohibited use
8. Donor data, client data, and confidentiality
9. Data security and breach obligations in Mississippi
10. Fundraising, solicitation, and donor communication
11. Nondiscrimination in program delivery and eligibility screening
12. Human resources and hiring
13. Accessibility obligations
14. Grant compliance and funder requirements
15. Procurement and vendor management
16. Board governance and fiduciary considerations
17. Tax-exempt status considerations
18. Transparency and disclosure
19. Workforce training and AI literacy
20. Risk management and incident response
21. Governance review and continuous improvement
22. Implementation checklist
23. Key authoritative resources to monitor
24. Sources and references

Purpose of this framework

Nonprofit and community organizations in Mississippi are adopting AI tools for grant writing, donor communication, program intake, case notes, translation, scheduling, and administrative work. Many are doing so without a written policy, without vendor review, and without a decision about what data may be entered into which tools.

The gap matters more for nonprofits than for most organizations, for three reasons. Nonprofits hold sensitive information about people who often have no practical alternative provider. They operate on funds given in trust, subject to donor expectations and grant conditions. And they frequently deliver services under civil rights statutes that attach to federal funding, which makes automated decisions in screening and eligibility a compliance question, not only a reputational one.

This template gives a Mississippi nonprofit board and executive team a structure for deciding those questions deliberately.

What this template is, and what it is not

This is a planning and governance framework. It is not a final policy, not legal advice, and not a mandatory model.

It is written to be adapted. Sections that do not apply to an organization should be deleted rather than kept as filler. An organization with four employees and no federal funding needs a substantially shorter policy than a federally funded human-services provider with a hundred staff.

Decide what applies to you. Several points in this template turn on organization-specific facts: employee count, funding sources, whether the organization handles protected health information, and whether it provides housing or educational services. Those facts determine which of the obligations in Section 1 apply.

Foundational principles your board may adopt

Organizations may adapt the following. These are principles, not legal requirements.

Human responsibility. A person remains accountable for every decision affecting a client, donor, employee, or applicant. AI output may inform a decision. It does not make one.

Mission alignment. AI is adopted where it advances the organization’s charitable purpose or frees capacity for it, not because the technology is available.

Data stewardship. Information about clients and donors was given in trust. It is not training data, and it is not entered into tools the organization has not reviewed.

Proportionality. The level of review scales with the consequence. Drafting a newsletter is not the same as screening applicants for assistance.

Transparency. The organization is willing to tell donors, clients, and its board how AI is used. If a use could not be comfortably disclosed, that is a signal to reconsider it.

Verification. Staff confirm factual claims, figures, citations, and names in AI-generated material before it leaves the organization.

Governance, roles, and accountability

Assign these roles by name in the adopted policy. An unassigned responsibility is an unmet one.

Board of directors. Approves the policy, reviews it at a defined interval, and receives reporting on AI use in high-consequence areas.

Executive director or CEO. Owns implementation, approves tools, and authorizes exceptions.

AI point of contact. A named staff member who maintains the approved-tool list, fields questions, and logs incidents. In a small organization this is a role, not a position.

Program leads. Determine whether AI is appropriate in their service area and document the reasoning.

All staff and volunteers. Follow the acceptable use rules and report problems.

Maintain a written inventory of AI tools in use, who approved each, what data may be entered, and the date of last review. Volunteers and contractors are covered by the same rules as employees, and volunteer agreements should say so.

Acceptable use and prohibited use

The following are drafting starting points. Adjust to the organization’s risk tolerance.

Generally lower risk, with human review: drafting internal documents, summarizing public materials, brainstorming program ideas, drafting routine correspondence for staff review, generating first drafts of grant narratives, creating training materials, and translating published content with qualified human verification.

Requires documented approval before use: anything touching client records, donor records, personnel files, or applications for assistance; anything generating public-facing content published without staff review; and anything used in eligibility screening or resource allocation.

Prohibited unless the board specifically authorizes it after review:

• Entering client names, addresses, Social Security numbers, financial details, health information, immigration status, or case details into any tool not approved and covered by an appropriate agreement
• Entering donor personal or giving information into unapproved tools
• Making final decisions on eligibility, benefits, service denial, or termination of services
• Making final hiring, discipline, or termination decisions
• Generating synthetic images or audio of real people, including clients, donors, staff, or board members, without written consent
• Presenting AI-generated testimonials, client stories, or quotations as authentic
• Submitting AI-generated content to a funder where the funder’s terms prohibit it

That last item is concrete and current. Read your grant agreements. Some funders now address AI use in applications and reporting, and terms vary.

Donor data, client data, and confidentiality

There is no federal law generally protecting nonprofit donor data. The United States has no comprehensive federal privacy statute. Mississippi has no analogue to state consumer privacy laws such as those in California or Virginia, and no statutory data-minimization, access, deletion, or automated-decision-making rights.

What protects donor and client data is the organization’s own contractual commitments, its privacy statement, and the sector-specific laws below where they apply. That places the obligation on your policy rather than on a regulator.

Sector triggers to check

• HIPAA. Status depends on function, never on tax status. A nonprofit is a covered entity only if it is a health plan, a clearinghouse, or a provider transmitting information electronically in a HIPAA standard transaction (45 CFR § 160.103). A nonprofit that is not a covered entity can still become a business associate by handling protected health information for one, and business associates are directly liable under the HIPAA Rules. The concrete failure mode is entering PHI into a general-purpose AI tool with no business associate agreement in place. Most consumer AI services will not sign one.
• FERPA. Applies to educational agencies and institutions receiving U.S. Department of Education funds. A nonprofit that is not a school is generally not directly subject, but can be bound contractually as a “school official” when a district or college shares student records with it. That contractual route is how most nonprofits acquire FERPA obligations.
• COPPA. The Federal Trade Commission states that COPPA “applies to commercial websites and online services and not to nonprofit entities that otherwise would be exempt from coverage under Section 5 of the FTC Act.” The exemption applies to the nonprofit itself. It does not extend to a commercial vendor operating a child-directed service for the organization. Ask counsel how COPPA obligations are allocated in the vendor contract. The COPPA Rule amendments were published April 22, 2025, took effect June 23, 2025, and carried a compliance date of April 22, 2026.
• Gramm-Leach-Bliley Safeguards Rule. No nonprofit exemption appears in 16 CFR § 314.2. Nonprofits making or servicing loans, providing credit counseling, or preparing taxes should ask counsel whether the rule reaches them. Do not assume either answer.

Practical rules for the policy

Classify data before choosing tools; keep a list of what may never be entered into a general-purpose AI tool; require a written agreement covering confidentiality and training use before any tool touches client or donor records; and prefer tools that contractually exclude inputs from model training.

Data security and breach obligations in Mississippi

Miss. Code Ann. § 75-24-29 applies to any person conducting business in Mississippi who owns, licenses, or maintains personal information about Mississippi residents. There is no nonprofit exemption.

Key points:

• “Personal information” means a name combined with a Social Security number, driver’s license or state ID number, or account or card number with a security code.
• A breach is unauthorized acquisition of electronic files or data containing personal information that is not secured by encryption or comparable technology.
• Notification is required “without unreasonable delay,” subject to investigation. There is no fixed day count.
• Notification is not required if the organization reasonably determines the breach will not likely result in harm.
• Encrypted data is outside the definition of a breach. This is the single most valuable control a small nonprofit can adopt.
• The statute covers electronic data only. Paper records are outside it.
• Under the statute, a violation is treated as an unfair trade practice enforceable by the Attorney General. There is no private right of action.

The AI-relevant consequence: a vendor incident exposing client or donor Social Security numbers can trigger this statute, and vendor agreements should require prompt notice so the organization can meet its own obligation.

Organizations receiving federal grant funds are separately required by 2 CFR § 200.303(e) to “take reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information.” This language was expanded in the 2024 Uniform Guidance revisions (89 FR 30046, effective October 1, 2024) and is the strongest federal grant hook for an AI data-handling policy.

Fundraising, solicitation, and donor communication

Mississippi’s Charitable Solicitations Act (Miss. Code Ann. §§ 79-11-501 to 79-11-529), administered by the Secretary of State’s Charities Division, requires registration before soliciting, with a $50 fee. Organizations receiving not more than $25,000 in contributions in a twelve-month period with no paid fundraising are exempt, and must register within 30 days of exceeding that threshold. The registration statement discloses “methods of solicitation.”

Nothing in the Act addresses automated or AI-assisted solicitation.

The nearest relevant authority is the online solicitation rule, 1 Miss. Admin. Code Pt. 15, R. 2.08, which triggers registration for internet solicitation where an organization maintains a Mississippi account or address, specifically directs paid internet advertising to Mississippi residents, or provides an online donation mechanism and either receives $25,000 from Mississippi residents annually or receives contributions from 25 or more Mississippi residents in its fiscal year.

The practical AI point: an AI system that generates or targets donor outreach does not create a new registration obligation, but it can cause an organization to cross those targeting or volume thresholds without anyone deciding to. Organizations using AI-assisted audience targeting should assign someone to watch the thresholds.

For donor communication generally: do not present AI-generated content as a personal message from a named individual who did not write or review it; do not fabricate impact figures, client stories, or testimonials; and verify every statistic in AI-drafted appeals against organizational records.

Nondiscrimination in program delivery and eligibility screening

This is the highest-consequence section for organizations that screen people for services.

Organizations receiving federal financial assistance are subject to Title VI, which prohibits discrimination on the basis of race, color, or national origin in their programs, and as noted in Section 1, it may reach the entire organization if it principally provides education, health care, housing, social services, or parks and recreation. Section 504 and the Age Discrimination Act of 1975 attach on the same funding trigger. ADA Title III applies to service establishments including day care centers, senior centers, homeless shelters, food banks, and adoption agencies, regardless of funding or tax status.

Federal agency guidance treats automated screening as covered by these statutes rather than exempt from them.

For housing-related work, HUD guidance issued April 29, 2024 states that discrimination can occur “even if the decision for how to screen applicants is made in whole or in part by an automated system, including a system using machine learning or another form of AI,” and warns that complex models “can lead to a less transparent process by obscuring the precise reasons for a denial.” This document is now available through HUD’s archive rather than its main site. The Fair Housing Act itself is unaffected.

Two ADA Title III exemptions exist under 42 U.S.C. § 12187, for certain private clubs and for religious organizations and entities controlled by them. Faith-based organizations should obtain counsel on the scope of that exemption before relying on it.

Drafting recommendation: require a documented human decision for any denial or reduction of services, retain the basis for the decision, and provide an appeal path that reaches a person.

Human resources and hiring

The practical landscape here has changed in a way many published templates have not caught up with.

The Equal Employment Opportunity Commission’s 2023 technical assistance documents on AI in employment are no longer published on eeoc.gov. The guidance addressing the Americans with Disabilities Act, the guidance on adverse impact under Title VII, and the agency’s AI landing page all return errors as of August 2026.

The underlying law is unchanged. Title VII (42 U.S.C. § 2000e-2, including disparate impact) and the ADA (42 U.S.C. § 12112, including reasonable accommodation and medical inquiry provisions) apply to AI-assisted hiring and screening exactly as they apply to any other selection procedure. The Uniform Guidelines on Employee Selection Procedures, 29 CFR Part 1607, remain in force and are the operative regulatory standard. Cite those rather than the withdrawn documents.

Note the coverage thresholds. Title VII and ADA Title I attach at 15 employees; the ADEA at 20. Many Mississippi nonprofits fall below both, in which case state law and the organization’s own commitments govern.

Bias audits are not required under federal law. New York City Local Law 144 imposes an audit requirement on employers in that city, which is the usual source of confusion on this point.

Accessibility obligations

Organizations receiving federal financial assistance from the U.S. Department of Health and Human Services are subject to the Section 504 rule published May 9, 2024, effective July 8, 2024. It codifies WCAG 2.1 Level A and AA at 45 CFR § 84.84(b), and removed the prior 15-employee floor for general coverage.

Compliance deadlines, which are frequently misstated:

• 15 or more employees: beginning May 11, 2027
• Fewer than 15 employees: beginning May 10, 2028

An exception applies where compliance would cause a fundamental alteration or undue financial and administrative burden.

Two clarifications worth including so organizations neither over- nor under-comply:

• The Department of Justice ADA Title II web rule does not apply to nonprofits. It covers state and local governments. It can reach a nonprofit indirectly through a contract to deliver public services.
• There is no adopted web accessibility regulation under ADA Title III. WCAG 2.1 AA is the standard courts and settlements commonly apply, which is a different matter from a regulatory requirement.

Organizations funded by an agency other than HHS should check that agency’s own Section 504 regulation.

The AI connection: AI-generated images need alt text, AI-generated video needs captions, and an AI chatbot placed on a website becomes part of the organization’s accessibility obligation. Verify accessibility rather than assuming a vendor handled it.

Grant compliance and funder requirements

There is no Office of Management and Budget AI directive applicable to nonprofit federal grant recipients. The 2024 Uniform Guidance rewrite does not mention artificial intelligence. OMB memoranda M-25-21 and M-25-22 are directed at executive branch agencies and state that they create no obligations for the public.

AI obligations reach a recipient only if a specific awarding agency writes them into award terms. Read the notice of funding opportunity and the award terms and conditions. That is where any AI requirement will appear.

What applies to federal grant recipients regardless:

• 2 CFR § 200.303 internal controls, including the cybersecurity and PII safeguarding language in subsection (e)
• 2 CFR § 200.334 record retention, generally three years from final financial report submission
• 2 CFR § 200.332 subrecipient monitoring, for organizations passing funds through

Record retention is the natural hook for an AI records decision. Determine whether prompts, outputs, and tool logs relating to a federal award are program records, and if so, retain them accordingly.

Procurement and vendor management

Before approving a tool, obtain written answers to the following. A vendor unwilling to answer has given an answer.

• Is our data used to train the vendor’s models, or any third party’s? Can we opt out contractually rather than by a settings toggle?
• Where is data stored, for how long, and how is deletion handled on termination?
• Will the vendor sign a business associate agreement if we handle protected health information? A data processing agreement?
• What is the vendor’s breach notification commitment to us, and on what timeline? Does it allow us to meet § 75-24-29?
• What subprocessors are used?
• What accessibility conformance does the product claim, and is there a current accessibility conformance report?
• What happens to our data and outputs if the vendor is acquired or shuts down?

For federally funded procurement, apply existing Uniform Guidance procurement standards. AI tools are not a special category. They are a purchase.

Board governance and fiduciary considerations

Miss. Code Ann. § 79-11-267 sets standards of conduct for directors of Mississippi nonprofit corporations. Among its provisions, it permits directors to rely on information, opinions, reports, and statements prepared by officers, legal counsel, accountants, and board committees where the director believes in good faith that the source is reliable and competent.

Boards should ask counsel how that reliance provision applies when the source of an analysis is a software tool rather than a person, and should document any evaluation of a tool they rely on.

Miss. Code Ann. § 79-11-269 governs conflict of interest transactions. If a director or officer has an interest in an AI vendor, that is an ordinary conflict transaction requiring disclosure and disinterested approval.

Boards should have counsel confirm the full text and current application of both sections before relying on any summary, including this one.

Form 990, Part VI asks whether the organization has a written conflict of interest policy with annual disclosure and consistent monitoring (lines 12a, 12b, 12c), a whistleblower policy (line 13), and a document retention and destruction policy (line 14). There is no AI question on Form 990. Note the framing: the form asks whether the organization has these policies. An AI records decision belongs inside the line 14 retention policy.

Tax-exempt status considerations

The Internal Revenue Service has published nothing addressing AI use by 501(c)(3) organizations. No guidance, revenue ruling, notice, or FAQ. Any claim to the contrary should be checked against irs.gov directly. The IRS does maintain an internal AI governance policy, which governs the agency and imposes nothing on exempt organizations.

The relevant doctrine is ordinary and pre-existing. A section 501(c)(3) organization “must not be organized or operated for the benefit of private interests,” and no part of net earnings “may inure to the benefit of any private shareholder or individual.”

Applied to AI, the risk is not the technology. It is an insider-affiliated AI vendor paid above fair market value, which is standard excess benefit analysis under IRC § 4958. If a board member, officer, or family member has an interest in an AI vendor under consideration, run the normal conflict process and document fair market value.

Transparency and disclosure

No law requires a Mississippi nonprofit to disclose AI use to donors or clients. The AIR Task Force has recommended chatbot disclosure, but that recommendation is directed at state agencies and local governing authorities and is not enacted law.

Organizations may nonetheless choose to disclose, for a straightforward reason: nonprofit relationships run on trust, and undisclosed AI use discovered later costs more than disclosed AI use.

Positions to consider adopting:

• Label AI chat assistants on the website as automated, and provide a path to a person
• State in the privacy notice whether client or donor information is processed using AI tools
• Do not present AI-generated text as the personal writing of a named individual who did not write it
• Disclose AI-generated or AI-modified imagery in fundraising materials
• Tell the board what tools are in use and where

Workforce training and AI literacy

A policy nobody has read is not a control. Before granting access to approved tools, staff and volunteers should be able to state what data may never be entered, who approves a new tool, what must be verified before publication, and how to report a problem.

MAIN provides no-cost AI courses for Mississippi organizations. See mainms.org/courses.

Document who completed training and when. For federally funded organizations, that documentation supports the § 200.303 internal controls position.

Risk management and incident response

Define what counts as an AI incident: personal information entered into an unapproved tool, AI-generated inaccuracy that reached a donor or client, a vendor breach, an accessibility failure, or an automated screen that produced a questionable outcome.

The response path should assign a named person to receive reports, require prompt notice to the executive director, contain the issue, assess whether § 75-24-29 notification is triggered, assess whether a funder or regulator notification is required, correct any public-facing error, and record the incident.

Log incidents even when no notification is required. The log is what makes an annual review meaningful.

Governance review and continuous improvement

Review the policy at least annually and whenever funding sources, employee count, service lines, or the tool inventory change materially. Each of those can change which obligations in Section 1 apply.

The NIST AI Risk Management Framework (AI 100-1, January 26, 2023) and its Generative AI Profile (AI 600-1, July 26, 2024) offer a structure for this through their GOVERN, MAP, MEASURE, and MANAGE functions. Both are explicitly voluntary and impose no legal obligation. NIST has signaled that a revision to the framework is planned, so some current content may change. As of August 2026 both documents remain the operative versions.

The Fundraising.AI Framework (revised November 2025) is the most substantive nonprofit-sector-specific artifact currently available, organized around nine pillars. It is an industry collaborative, not a standards body.

Implementation checklist

• Determine which obligations in Section 1 apply, based on employee count and funding sources
• Inventory AI tools currently in use, including tools staff adopted without approval
• Classify data and decide what may never enter a general-purpose AI tool
• Name an AI point of contact
• Draft the policy from this template, deleting inapplicable sections
• Have counsel review
• Board adoption, minuted
• Train staff and volunteers, and document completion
• Add AI terms to vendor agreements and volunteer agreements
• Review grant terms for AI provisions
• Confirm encryption of files containing personal information
• Set an annual review date

Key authoritative resources to monitor

• Internal Revenue Service, Charitable Organizations
• Mississippi Secretary of State, Charities Division
• Mississippi Attorney General, consumer protection and breach enforcement
• Mississippi Department of Information Technology Services, AI Acceptable Use Policy
• Mississippi PEER Committee, AIR Task Force reports
• NIST AI Risk Management Framework
• HHS Office for Civil Rights, Section 504 and HIPAA
• Your funders’ terms and conditions