Nonprofit AI policy template: three questions against shadow AI and eight points your board can adopt

Shadow AI is any AI tool or automation used inside an organisation without anyone keeping track of it. Norway's data protection authority, Datatilsynet, calls automations that keep running after the person who built them has left “digital ghosts”. In a nonprofit where volunteers come and go, the risk is real. A board can tackle it with Datatilsynet's three mapping questions and an eight-point AI policy adopted in a single meeting.

Back in May we suggested that nonprofits write a short policy for responsible AI use. This is that policy. It starts from an article on AI agents that Datatilsynet published on 28 October 2026. It was written for “businesses” and “employees”; applying it to volunteer-run organisations is our interpretation.

Key facts as of November 2026

• Datatilsynet recommends mapping three things: which AI tools exist, what the agents can do, and who is responsible (28 October 2026).
• According to Datatilsynet, an association is the data controller for its members' personal data – not the volunteer who set up the tool.
• The EU AI Act is not yet Norwegian law. The EU's AI omnibus is out for public consultation in Norway until 11 December 2026.
• 2 December 2026 is a deadline for providers of generative AI tools, not a new labelling duty for nonprofits.
• No law requires a board to adopt an AI policy. It is good practice, not an obligation.

What are shadow AI and “digital ghosts”?

Through AI agents, language models can now “retrieve information, update business systems and carry out routine tasks on their own”, Datatilsynet writes in its article “Good routines stop AI becoming an invisible threat” (in Norwegian; quotes here are our translation).

Shadow AI is about use that nobody has an overview of. Datatilsynet points out that because AI is increasingly built into ordinary software, shadow AI can also take hold inside applications that have already been approved and rolled out.

“Digital ghosts” is Datatilsynet's term for autonomous processes that outlive the person who created them. The regulator describes an employee who builds an automated workflow with AI agents connected to a business system and then leaves. The automation can keep running in the background, querying the system and processing personal data. The result, Datatilsynet says, is that it becomes unclear who owns the process, what data it handles and how it is managed.

Why are digital ghosts a particular risk for nonprofits?

A nonprofit often has a board that changes every year, volunteers on personal accounts and nobody who owns the big picture. Picture a treasurer who hooks an AI assistant up to the membership list to send payment reminders automatically – and then steps down.

The responsibility does not leave with the treasurer. Datatilsynet's guidance “What is a data controller?” (last updated 17 July 2019) uses exactly this example: an association is the controller for the personal data of its members.

Which three questions should the board ask first?

Datatilsynet recommends a systematic, three-step mapping. As a board agenda:

1. What is out there? Get an overview of which AI tools, assistants and automations are in use. Ask every volunteer with access: do you use AI for association work, and have you set up anything that runs by itself?
2. What can the agents do? Define which systems they may access and which actions they are allowed to take. Can the tool only read, or can it also send emails and edit the membership register?
3. Who is responsible? Clarify who monitors the agents, owns the processes and has the authority to switch them off. In a nonprofit, make it a board role, not a person.

Datatilsynet sums it up in one line: an AI actor needs a defined identity, clear limits on access and a clear line of accountability. The regulator also stresses that the aim is not to ban artificial intelligence, but to make sure it is used safely and thoughtfully.

What should a nonprofit AI use policy include in 2026?

An AI use policy is a short board resolution stating which AI tools the organisation uses, for what, and who is accountable. These eight points can be adopted as written or adapted in one meeting:

1. Approved tools. The organisation only uses tools on an approved list, with its own organisational accounts. The list also states which built-in AI features in existing software are switched on.
2. Off-limits data. Member data and other personal data only go into tools covered by a data processing agreement. Sensitive data such as health or religious beliefs is not entered without a specific board decision, and passwords never are.
3. Labelling and transparency. A chatbot clearly says it is AI. AI-generated images, audio and video are labelled.
4. Human oversight. A named person approves everything published or sent out in the organisation's name. AI never makes decisions about individuals on its own, such as admissions, grants or expulsions.
5. Register. One page in the board folder lists every tool and automation: what it can access, what it can do, who owns it and who can switch it off.
6. Training. Everyone who uses AI on the organisation's behalf gets a short introduction – for example through the free courses at OpenInfo's Founder School.
7. Supplier requirements. No personal data goes into a tool before the data processing agreement is in place. We covered the questions to put to suppliers in our nonprofit supplier check.
8. Annual review and offboarding. The list is reviewed when the new board convenes after the annual meeting. When a volunteer with access leaves, ownership is transferred or the automation is switched off the same week.

Point 8 is what actually prevents digital ghosts. The Norwegian Digitalisation Agency's guide “Getting your house in order”, which Datatilsynet links to and calls an important foundation, makes the same point: it is about knowing what data you have, what it means and how it can be used, and keeping that overview up to date. It was written for the public sector, but the principle fits a sports club too.

Do Norwegian nonprofits have to label AI content from 2 December 2026?

No – not under Norwegian law as of November 2026. The 2 December 2026 date comes from Article 111(4) of the AI Act, and it applies to providers: tools that generate synthetic text, images, audio or video and were placed on the market before 2 August 2026 must then mark their output in a machine-readable format. The duty sits with the companies behind the tools, not with the nonprofit using them.

Users' obligations are set out in Article 50(4) and have applied in the EU since 2 August 2026. Anyone publishing deepfakes must disclose it. AI-generated text published to inform the public on matters of public interest must be labelled – unless it has undergone human review and someone holds editorial responsibility. That exemption depends on point 4 of the policy.

In Norway, none of this applies until the new AI Act is passed. We still recommend labelling voluntarily now. We set out the full timeline in Norway's AI Act is delayed to 2027.

What does the AI omnibus consultation mean for nonprofits?

On 30 October 2026 Norway's Ministry of Digitalisation and Public Governance put the EU's AI omnibus out for consultation, with a deadline of 11 December 2026. According to the consultation page on regjeringen.no, anyone can submit a response, but responses are made public.

The AI literacy requirement is the part most relevant to nonprofits. According to the consultation paper, the omnibus softens it: organisations must have measures to support AI literacy among staff and other people who operate and use AI systems on their behalf, but they do not have to guarantee a particular level of competence for each person. Our reading is that volunteers using AI for an organisation fit naturally here once the rule reaches Norway.

If your board wants to learn more before adopting a policy, the AI day for nonprofits in Oslo on Friday 20 November has two relevant sessions: “Safe AI: the EU AI Act, privacy and security” at 10:35 and “The first 90 days with AI” at 14:40. The event is free and organised by InfoDesk AS and Skjld Labs – companies where OpenInfo's chair, Håkon Berntsen, holds leadership roles – with OpenInfo contributing technology.

Frequently asked questions

Who is responsible when a volunteer sets up an AI agent and then leaves?

The organisation. According to Datatilsynet, the legal entity is the data controller, not the individuals within it. That is why the policy should require ownership to be transferred, or the automation switched off, when someone leaves.

Do we need a data processing agreement to use ChatGPT or Copilot with member data?

Yes. When a tool processes member data on the organisation's behalf, Article 28 of the GDPR requires a written agreement. In practice that means an organisational or business subscription with the provider's standard agreement, not a free personal account.

Do all volunteers need AI training?

Not under Norwegian law as of November 2026, and the omnibus makes the EU requirement milder. A short introduction is still the simplest defence against shadow AI.

Does the EU AI Act apply to Norwegian nonprofits now?

No. It will be incorporated into Norwegian law through the new AI Act, which is still being drafted.

Is an AI policy legally required?

No. Datatilsynet's three questions are a recommendation, and the policy is good practice. It does make it easier to show that your organisation takes its members' data seriously.