Write your organisation's AI rules in one hour

What happens to your information

What it costs

Before you start

• Sixty uninterrupted minutes with the person who can actually decide, the director or the executive committee. A policy written by staff and never approved is not a policy.
• Two or three other people, no more than five in the room. Include whoever handles case files or testimony, and whoever handles money and funder reporting. These two people know where the real risk sits.
• A pen and paper, or any word processor. Nothing needs to be installed, and there is no website you need to reach. The full blank template is printed at step 3 of this recipe.
• An honest, blame-free list of what your staff are already doing with AI. Ask for it before the meeting and promise in writing that nobody is in trouble for answering. In our needs assessment, 14 MENA civil society organisations, August 2026, 43% had put, or may have put, sensitive material into an AI tool. Assume yours is one of them and that you simply do not know it yet. Read step 1 before you send that message: the replies are more sensitive than anything else this recipe produces.
• The names of the actual people who will hold each role. A policy that says 'management' decides is a policy where nobody decides.
• ACCOUNTS SETTLED BEFORE THE MEETING, NOT DURING IT. Step 6 asks you to open a tool's real settings and switch training off in the room. If you do not already have a working account on a tool you intend to place at Level 2, create and verify it the day before, see step 2. Claude.ai requires SMS verification on a mobile number from a supported location and rejects VoIP, Google Voice, app-generated numbers and landlines. If verification fails on your number, that tool is Level 3 and stays there; that is a finished decision, not a problem to solve mid-meeting.
• Accept before you start that Level 2 may be empty for you, and that Level 1 may be unavailable on 8 GB laptops. Both outcomes produce a valid policy. See platformNotes and the Iraq payment note.

The steps

1. Step 1 / 11

   At least a day before the meeting, send this one message to all staff. It buys you an honest starting picture, which is the only thing that makes the hour productive. Read the note underneath BEFORE you send it, how you collect the replies matters more than the wording.

   Copy this exactly

   On [date] we are writing our organisation's rules for using AI tools. To write rules that fit what we actually do, I need to know what we actually do.
   
   Please tell me, by [date]: which AI tools you have used for work (ChatGPT, Claude, Gemini, Copilot, a translation website, a transcription website, a photo tool, anything), and roughly what you used them for.
   
   Come and tell me in person, or hand me a note on paper. Please do NOT reply by email or on a messaging app, and please do not name any case, source or person in what you tell me. Say 'a set of interview recordings', not whose.
   
   Nobody will be disciplined, warned, or asked about this again as a result of what they tell me. I am asking so that our rules protect you.
   
   One thing I have to be straight with you about: this promise is mine, and it covers what I and this management will do. It cannot bind a funder's auditor, a court, or a future board. That is exactly why I am asking for this in person or on paper rather than in writing on a server.

   Check it worked

   Before the meeting, count the replies against your staff list. If fewer than half of your staff have answered, the amnesty is not believed yet and the meeting will be built on a false picture, postpone a day and have the director ask two or three people directly and in person. A second signal that it worked: at least one reply should surprise you. If every answer is 'only for translating public documents', you have collected the answer people think is safe, not the true one. Ask again, in person, with the specific question 'has anything with a name in it ever gone into one of these tools?'

   Note

   This is the single highest-value step and most organisations skip it. You cannot classify your risk if you do not know that someone has been running interview recordings through a free transcription website for eight months. The written amnesty is not a courtesy. It is what makes the answers true.

   WHAT CHANGED AND WHY IT MATTERS: an earlier version of this recipe asked staff to REPLY BY EMAIL. Do not do that. The replies are a dated, attributable inventory of which sensitive material has already left your organisation and whose it was, the single most dangerous document this whole exercise creates, more dangerous than the policy itself. Sitting in a Gmail or Outlook thread it is backed up, synced to phones, and discoverable by anyone who later gets into that account. Collect it in person or on paper. Take your own notes as tool names and rough purposes only, with no case names and no client names. Once Annex A is built in step 6, shred the paper notes and destroy your own. What you keep is the tools list, not the confessions.

2. Step 2 / 11

   The day before the meeting: if you intend to put any tool at Level 2, meaning an account the organisation controls with training switched off, make sure that account exists and you can log into it, today, before anyone is in the room. Do this alone. It takes ten to thirty minutes and it is the step most likely to stall the meeting if you leave it until then.

   Copy this exactly

   Checked against the vendors' own help pages in this session, 30 August 2026. Every one of these pages carries its own 'last updated' stamp, look at it when you read the page, and believe the page over this recipe.
   
   CLAUDE (Anthropic), phone verification IS required and cannot be skipped. Anthropic's help centre states you will be asked to enter a phone number from a supported location to receive a code by SMS, that they 'require phone verification for all new users, and there isn't a way to skip this step', and that "you cannot use VoIP numbers, Google Voice, phone numbers created using apps, landlines, or other numbers that can't receive texts." Iraq IS listed as a supported location for Claude.ai. So an ordinary Iraqi mobile is the right kind of number, but delivery through a given carrier can still fail. If no code arrives, the vendor's own advice is that it may take a few minutes, and if it has been more than five minutes to click 'Try again' and re-enter the number; if it still fails, you need a different mobile number.
   
   CHATGPT (OpenAI), as of this session, OpenAI's help centre states plainly: "Phone verification is no longer required for new OpenAI account creation or ChatGPT usage." An email address is enough. Phone verification IS still required once, on platform.openai.com, to generate your FIRST API key, and for that, OpenAI does not accept landlines, VoIP, Google Voice or premium numbers, only a mobile by SMS. OpenAI supports WhatsApp verification in some countries as an alternative; Iraq is NOT on that list, so for an API key you need an SMS-capable +964 mobile.
   
   GOOGLE GEMINI: a Google account you already have is enough.
   
   IF VERIFICATION FAILS: that tool is Level 3. Write it in the policy as Level 3 and move on. Do not use a colleague's personal number to get an organisational account past the gate. You will have created an organisational account that one individual can be locked out of, or held responsible for, and you will not remember whose number it was in a year.

   Check it worked

   Log out of the account completely and log back in from the machine you will use in the meeting. If you can reach the settings screen from a cold login, the account is real and the meeting can proceed. If you only ever tested it in a browser tab that was already logged in, you have not tested anything.

   Note

   This step did not exist in the earliest draft, and its absence was a real defect: step 6 told a room to 'open the settings and switch training off, in the room, now', which quietly assumed an account already existed. For an organisation creating its first one, that is where the meeting dies. Note also the honest asymmetry we found while checking: OpenAI has dropped the phone gate for ChatGPT signup, Anthropic has not. That was true when we checked, and both vendors change it without notice, if it has changed by the time you read this, believe the vendor's page and not us.

3. Step 3 / 11

   Spend the first five minutes of the meeting writing the blank template out. Copy the text below into your word processor, or write the eight headings on a large sheet of paper. Do not customise anything yet. Read it aloud once, top to bottom, so everyone knows what the hour is going to produce.

   Copy this exactly

   [ORGANISATION NAME], RULES FOR USING AI TOOLS
   
   Adopted: [date]        Next review: [date, six months later]
   Owner of this document: [APPROVER, name, role]
   Applies to: everyone who does work for us, staff, volunteers, interns, consultants, board members, and, through a spoken briefing rather than a signature, everyone we work alongside: fixers, translators, drivers, community contacts. See section 8.
   
   
   1. OUR THREE LEVELS OF INFORMATION
   
   GREEN: already public, or we would be content to see it on a website tomorrow.
     Our examples: [fill in]
   
   AMBER: internal. Embarrassing if it leaked. Not dangerous to anyone.
     Our examples: [fill in]
   
   RED: if this leaks, a person can be detained, deported, harmed, dismissed, or our registration can be attacked.
     Our examples: [fill in]
   
   If you are not sure whether something is AMBER or RED, it is RED.
   
   HOW THIS PAGE IS HANDLED. Once the RED examples above are filled in with our real projects, districts
   and files, THIS PAGE IS ITSELF RED. The master copy, with the examples in it, is kept where we keep
   case files. Our own staff hold a full copy because they need it to do their work. The copy we pin on
   the wall, and any copy we hand to someone who is not our own staff, carries sections 2, 3 and 4 and
   the three headings above in general terms only, never our specific examples.
   
   
   2. OUR THREE LEVELS OF TOOL
   
   Level 1, Offline. Runs on our own computer with the internet switched off. Nothing leaves the device.
   Level 2, an account controlled by this organisation, with model training switched off, on a tool approved in Annex A.
   Level 3. Everything else: free consumer chatbots, browser extensions, free translation and transcription websites, free PDF websites, anything on a personal phone, anything not in Annex A.
   
   READ THIS TWICE. Level 2 means the company has promised not to TRAIN its models on what we send. It does not mean the information stayed here. At Level 2 the information still left our building: it travelled over the internet, it sat on someone else's computer in another country, it may be kept for years, it may be read by a human reviewer, it can be handed over under a court order there, and it can be exposed if that company is breached. 'Training switched off' is a promise about one use of our information, not a wall around it. That is why RED information does not go to Level 2 even with every toggle switched off.
   
   If our Level 2 column is empty because we cannot pay for an organisational account, that is fine. The policy still stands. It means GREEN work only, on Level 3 tools.
   
   
   3. THE RULE
   
                     Level 1 offline   Level 2 approved   Level 3 everything else
     GREEN               yes                yes                  yes
     AMBER               yes                yes                  NO
     RED                 yes*               NO                   NO
   
     * Level 1 with RED information is allowed only on an organisation-owned device, and only
       after the offline check in Annex A has been done on that device. If we have no machine
       that passes that check, the rule for RED is simply: no AI tool, ever. That is a complete
       rule and we are content with it.
   
   And always:
     - Nothing produced with AI is published, sent to a funder, filed in court, or given to a journalist until a named person has checked every fact, name, number, date, quotation and citation against the original source. Write that person's name on the draft.
     - We say when AI helped produce something we publish.
     - We never let an AI tool decide anything about a person: who receives assistance, who is believed, who is hired.
     - We never put a partner's or another organisation's information into any AI tool without their written permission.
     - Deleting names does not turn RED into AMBER. A testimony with the name removed is still identifiable by its content.
     - We never press the thumbs-up or thumbs-down button on an AI answer that contained our own material. On some services, giving feedback sends that entire conversation for training even if we have switched training off.
   
   
   4. WHO DECIDES
   
   [APPROVER, name, role] approves a tool before anyone uses it for work. Ask before, not after.
   A decision takes no more than [3] working days. While [APPROVER] is away, [DEPUTY, name, role] decides.
   If a tool is not in Annex A, it is Level 3.
   
   
   5. WHEN SOMEONE MAKES A MISTAKE
   
   We want to hear about it. Nobody is disciplined for reporting their own mistake promptly and honestly. We can only protect the people we know are at risk.
   
     1. Stop using the tool. Do not delete anything yet. We may need to know exactly what was sent.
     2. Tell [APPROVER] the same day. Say what you entered, into which tool, and roughly when.
     3. [APPROVER] writes down: the date, the tool, what information, whose information, and what was done.
        This incident log is RED. It lives in [WHERE, the same place we keep case files, named here],
        and only [APPROVER] and [DEPUTY] may open it. It is never emailed and never kept on a phone.
        Point 1 above says preserve the material; that preservation is also RED and is held the same way.
        If we are at real risk of a raid or device seizure, physical security comes first: we record only
        what is needed to warn the people affected, and we do not build an archive of our own exposures.
     4. Within [3] working days we decide whether anyone named in that information must be told or moved.
        THE PERSON AT RISK IS WARNED FIRST, BEFORE ANY OTHER NOTIFICATION. Then, and separately, we
        consider who else must be informed, a funder, a partner, or an authority where the law requires it.
        WE DO NOT NOTIFY ANY AUTHORITY about material concerning a source, a witness, a person at risk or
        anyone under 18 without first taking legal advice from a lawyer we trust. For some of what we hold,
        telling an authority IS the disclosure we are trying to prevent. If we cannot reach a lawyer, we wait,
        and we warn the person.
     5. Within [14] days we change this document, the tool list, or our training so the same mistake is harder to make.
     6. Discipline applies to two things only: hiding an incident, and deliberately breaking the RED rule.
   
   
   6. REVIEW
   
   We read this document again on [date, six months from adoption], and immediately after any of:
   an incident; adopting a new tool; a tool changing its privacy terms; a change in the law; a new funder requirement.
   
   
   7. ANNEX A: APPROVED TOOLS
   
     Tool | Level | May be used for | Highest information level allowed | Who pays | Approved on
     ---- | ----- | --------------- | --------------------------------- | -------- | -----------
   
     Offline check, required before any tool is written in at Level 1: with the model already downloaded,
     turn the internet off completely, unplug the cable, switch off Wi-Fi, switch off the phone hotspot,
     then ask the model a question and confirm it still answers. If it fails or reports a network error,
     it is not running on this machine and it is not Level 1.
   
   
   8. SIGNATURES
   
   Our own people sign: staff, volunteers, interns, board members, and any consultant working under our
   name on our material. Sign and date below, in the language you work in.
   
   WE DO NOT COLLECT SIGNATURES FROM FIXERS, TRANSLATORS, DRIVERS OR COMMUNITY CONTACTS. Their identities
   are on our RED list, and a signed roster naming them would be exactly the document our own rules say
   must never exist. They are briefed out loud instead, by a named colleague, and we record only that the
   briefing happened and who gave it, never a list of who attended.
   
   This signature sheet is AMBER and is kept with our personnel records, at the same protection as those
   records. If any name on it would itself be dangerous, that person is briefed out loud instead and does
   not sign.

   Check it worked

   Read section 2 aloud, including the paragraph in capitals, and ask one person in the room to say back in their own words what Level 2 does and does not protect them from. If they answer 'it means it's safe' or 'it means it stays with us', read it again. That misunderstanding is the single most common way an organisation whose top fear is information leaving ends up sending material to a Level 2 tool believing it stayed home. Then read the HOW THIS PAGE IS HANDLED paragraph aloud too, and settle one thing before you go further: name, out loud, where the master copy will live and who will pin the short version on the wall. Finally check the page count: if what you have typed runs past two pages, you have added something. Take it out.

   Note

   Eight sections, one page. Resist adding a ninth. Every template we reviewed that ran past two pages, including the corporate ones, is a template nobody in a five-person office ever reads twice.

   FOUR THINGS CHANGED IN THIS TEMPLATE AND YOU SHOULD KNOW WHY. First, section 8 previously told you to collect a signature from every fixer, translator and driver, which would have manufactured a signed, dated, filed roster of precisely the people the RED list says must never be identifiable. That was a real-world harm sitting inside the deliverable. It is now a spoken briefing with no attendance list. Second, section 2 now spells out that 'not used for training' does not mean 'not transmitted, not stored, not retained, not disclosable'. Third, section 5 now says where the incident log lives, and puts an explicit brake on notifying an authority, because for this sector, notification is sometimes the leak. Fourth, and newest: the HOW THIS PAGE IS HANDLED paragraph in section 1. Until this pass the recipe told you to make the RED list specific and then, three steps later, to pin the policy on the wall and hand it to your community contacts. Those two instructions contradicted each other, and the wall would have won.

4. Step 4 / 11

   Spend ten minutes filling in the RED list, and do RED first. Do not write abstract categories like 'personal data'. Write the actual things sitting on your actual computers this month. Go around the room and make each person name two.

   Copy this exactly

   Starter RED list, delete what does not apply, and add your own real examples:
   
   - Witness and victim testimony, in any form: audio, video, notes, transcripts
   - Names, phone numbers, addresses, photographs, ID or passport numbers of anyone we work with or document
   - Case files and legal files
   - The location of a shelter, safe house, or safe meeting place
   - The identity of a source, a fixer, or a person who introduced us to a community
   - Medical records and psychological assessments
   - Minutes or reports naming individuals who are at risk
   - Anything at all concerning a person under 18
   - Anything given to us under a promise of confidentiality
   - Staff home addresses, travel plans, and family details
   - Our own security plans, our incident logs, and this document's RED list
   - Passwords, recovery codes, and API keys
   - Unpublished investigation material and the identity of a whistleblower

   Check it worked

   Count your own additions. If the RED list you leave the room with is the starter list above with nothing added and nothing deleted, the step did not happen. You copied a list instead of describing your organisation. You should have at least four entries that name something specific to you: a project, a district, a category of file, a particular set of recordings. Second check: read each line and ask 'could a new colleague on their first Tuesday tell whether the file in front of them is this?' If the answer is no, the line is still too abstract. Third check, and do it the moment the list is finished: the last line of the starter list classifies this list as RED, and you have just made it specific. Say out loud where this page is going to be kept, and confirm nobody is about to photograph it into a group chat.

   Note

   Doing RED first is deliberate. If you start with GREEN, the room drifts into a comfortable conversation about newsletters. Starting with RED puts the reason for the meeting on the table in the first two minutes, and everything after it goes faster.

   The uncomfortable consequence of doing this step properly: a good RED list is a shopping list for anyone who wants to hurt the people you document. That is not a reason to write a vague one. It is a reason to keep the specific version where you keep case files, and to circulate the generalised version. Section 1 of the template says so; make sure whoever types up the master has read it.

5. Step 5 / 11

   Spend ten minutes on GREEN and AMBER. GREEN is genuinely published material. AMBER is the large middle where most daily work sits. If a category causes an argument, put it in AMBER, arguing about it is itself evidence that it is not GREEN.

   Copy this exactly

   Starter GREEN list:
   - Our published reports and press releases
   - Our public website text and social media posts
   - Public laws, gazettes, court judgments already published, official statistics
   - Training material we hand out openly
   - Job advertisements and public calls
   
   Starter AMBER list:
   - Draft reports before publication, with names removed
   - Budgets, financial reports, and funder narrative drafts
   - Internal policies and workplans
   - Meeting notes that name no one at risk
   - Correspondence with a funder about programme delivery
   - Aggregate statistics that cannot identify an individual
   - This signed policy itself, and its signature sheet (but NOT its RED list, which is RED)

   Check it worked

   Take the three most common documents your office actually produces in a normal week and place each one out loud. If any of the three cannot be placed without a two-minute argument, that document type is not covered clearly enough, add it by name to whichever list wins the argument before you move on. If a category ended up in GREEN because someone said 'well, it's basically public', move it to AMBER; 'basically public' is not published.

   Note

   Two traps. First: a funder budget is AMBER, but a budget line that names a local partner in a hostile district is RED, the sensitivity is in the detail, not the document type. Second: 'draft report with names removed' is only AMBER if the removal was done properly and the surrounding detail does not identify the person anyway. In a small community, 'a 34-year-old teacher from the village' is a name.

6. Step 6 / 11

   Spend ten minutes building Annex A, the approved tools list. Start from what you learned in step 1. Those tools are already in use and pretending otherwise helps nobody. For each tool, decide the level and write it in. Then, for anything you want to place at Level 2, open its settings on the account you prepared in step 2 and switch model training off before you write it down.

   Copy this exactly

   Where to switch training off, and what it does and does not buy you. Every claim below was opened on the vendor's own page in this session, 30 August 2026. Every one of those pages shows its own 'last updated' stamp, read it when you open the page, and believe the page over this recipe.
   
   CHATGPT (OpenAI). OpenAI's help article states that for services for individuals such as ChatGPT and Codex, "we may use your content to train our models", and that you opt out through the privacy portal at privacy.openai.com by clicking "do not train on my content", or through the Data Controls FAQ in ChatGPT. Once you opt out, new conversations will not be used to train their models. TWO TRAPS ON THE SAME PAGE. First: "Even if you have opted out of training, you can still choose to provide feedback to us about your interactions with our products (for instance, by selecting thumbs up or thumbs down on a model response). If you choose to provide feedback, the entire conversation associated with that feedback may be used to train our models." That means one thumbs-up on a helpful answer hands over the whole conversation. Tell your staff not to press it. Second: Temporary Chat (the icon at the top right) keeps a chat out of your history, creates no memories and is not used for training, but it is not a privacy shield. The conversation still travelled to OpenAI.
   
   CLAUDE (Anthropic). The privacy page, which carried a last-updated date of 16 March 2026 when we opened it, confirms consumer Free, Pro and Max are NOT used for training by default, model improvement is opt-in, under a setting called Model Improvement in Privacy Settings. Verify the toggle is off anyway. "Your Incognito chats are not used to improve Claude, even if you have enabled Model Improvement in your Privacy Settings." RETENTION: "When you provide us feedback via our thumbs up/down button, we will store the entire related conversation, including any content, custom styles or conversation preferences, in our secured back-end for up to 5 years." Same instruction as for ChatGPT, do not press the feedback buttons on anything containing your own material.
   
   GOOGLE GEMINI (free). Google's own help page states that "Human reviewers (including trained reviewers from our service providers) review some of the data we collect for these purposes"; that chats reviewed by human reviewers "are not deleted when you delete your activity. Instead, they are retained for up to three years"; and it advises directly: "Please don't enter confidential information that you wouldn't want a reviewer to see or Google to use to improve our services, including machine-learning technologies." The setting is called Keep Activity. Turning Keep Activity off still leaves chats retained with your account for 72 hours. Because reviewed chats survive deletion for three years, we recommend you place free Gemini at Level 3 and permit GREEN only.
   
   LEVEL 1, OFFLINE, READ THIS BEFORE YOU WRITE ANYTHING IN. Ollama and LM Studio can run a model entirely on your own machine, and that is the only category honestly safe for RED. But 'I am using Ollama' no longer proves you are offline. Ollama now also serves CLOUD-HOSTED models through the exact same `ollama run` command, and its own documentation says cloud models "are automatically offloaded to Ollama's cloud service". Cloud model names carry a -cloud suffix; the example in Ollama's own docs is `ollama run gpt-oss:120b-cloud`. Somebody who types that is sending every prompt to a company's servers while believing they are offline. Two checks, and do both:
     1. Look at the model name. If it ends in -cloud, it is not local. On Windows open Command Prompt (press the Windows key, type cmd, press Enter); on macOS open Terminal (press Command and Space, type Terminal, press Enter); on Linux open your terminal. Then type this and press Enter:
          ollama ls
        That is the command Ollama's own CLI documentation gives for listing models. Every model you intend to use at Level 1 must appear in that list WITHOUT a -cloud suffix.
     2. Then prove it. Turn the internet off completely, unplug the cable, switch Wi-Fi off, switch off any phone hotspot, and ask the model a question. If it answers normally, it is local. If it errors or hangs, it was never local. This second check is the one that actually decides it; the name check only catches the obvious case.
   As a rule of thumb. Our judgement, not a benchmark, Level 1 wants roughly 16 GB of RAM to be worth using. If your office is on 8 GB laptops, do not write anything into Level 1. Write into the policy that RED information goes into no AI tool at all. That is the correct answer, not a compromise.
   
   After you change each setting, take a screenshot of the switched-off toggle and keep it with the policy, with the date. CROP IT FIRST. A settings screenshot routinely captures the account email, the organisation name, and a sidebar of recent chat titles, which in this sector are case names. Crop to the toggle and its label only, and look at what else is in the frame before you save it.

   Check it worked

   For each Level 2 tool: after switching the toggle, log out fully, log back in, and open the setting again. Vendors sometimes fail to save a setting change without showing an error. If it is still off after a fresh login, it is really off. That, not the click, is what you screenshot. For anything at Level 1: you have not verified it until the machine has answered a question with the network physically off. Do that in the room, in front of someone else. Finally, look at each screenshot at full size before filing it and confirm no email address, workspace name or chat title is visible. If one is, delete the image and take it again.

   Note

   The screenshot is not bureaucracy. Vendor defaults change without notice, and in six months you will not remember whether you actually switched it or only meant to. It is also the single thing a funder's due-diligence officer will ask you for, which is exactly why it must be cropped before it leaves your office.

   The Ollama warning is the highest-consequence correction this recipe has carried. An earlier draft said flatly that a model run through Ollama or LM Studio 'sends nothing anywhere once the model is downloaded' and called it the only category honestly safe for RED. The first half of that is no longer unconditionally true, and the two halves together would have pointed someone's most dangerous material at a cloud endpoint they believed was their own laptop. Note also what we removed from this step: a previous draft told you the local models would appear in the list 'with a size in gigabytes'. We could not find that in Ollama's documentation and could not test it here, so we cut it. The -cloud check and the network-off proof are what carry Level 1, and the network-off proof is the one that cannot be faked.

7. Step 7 / 11

   Spend five minutes on section 4. Write two real names, APPROVER, the person who approves tools, and DEPUTY, the person who approves while APPROVER is travelling. Write a real number of working days. Say it out loud so both people hear themselves accept it. Use the same two names everywhere they appear in sections 4, 5 and 7.

   Check it worked

   Search your draft for the words 'management', 'the team', 'the department', 'IT' and 'legal'. Every one of those is a role you probably do not have; replace each with a person's name or delete the sentence. Then ask APPROVER and DEPUTY, out loud, in front of the room: 'do you accept that you decide this, within three working days?' If either hesitates, you have found the real answer now rather than during an incident.

   Note

   In an organisation of five to twenty people this is almost always the director plus one operations or programme person. Do not create a committee. If approval takes longer than three days, staff will stop asking and go back to using whatever they like, and you will have converted a written policy into a false one.

8. Step 8 / 11

   Spend ten minutes on section 5, the incident procedure. Fill in APPROVER, DEPUTY, the real deadlines, and the blank saying WHERE the incident log is kept. Then say the following sentence aloud to the room, and make sure the director is the person who says it.

   Copy this exactly

   Nobody in this organisation will be disciplined for telling me that they put something into an AI tool that they should not have. I need to know within the same day, because within three days I have to decide whether someone out there needs to be warned or moved. If you hide it from me, I cannot protect them. That is the only thing I will treat as serious.
   
   And I want to be honest about the limit of that promise. It is mine and it is real: I will not discipline you. It does not stop a funder's auditor, a court, or a future board from reading whatever we write down. That is why we keep the incident log small, keep it where we keep case files, and warn the person at risk before we tell anyone else.

   Check it worked

   Look at section 5 and confirm three blanks are actually filled: a name, a number of days, and a physical or digital location for the incident log. If the location blank still says [WHERE], the log will end up in the approver's email, which is where an earlier draft of this recipe would have left it. Then ask the room one question out loud: 'if the exposed material was a witness statement, who do we tell first?' The right answer is the witness, and nobody outside until a lawyer has been asked. If anyone in the room answers 'the authorities', read point 4 again before you move on.

   Note

   This is the clause that makes the whole document work, and it is the clause missing or buried in almost every template we reviewed. NTEN's template has an INCIDENT MANAGEMENT heading carrying a single bullet; Community IT's routes violations upward to a blank department or title holder; none of them state that self-reporting carries no penalty. The reasoning is simple: an organisation that punishes disclosure stops receiving disclosures, and it does not thereby have fewer incidents, only fewer incidents it knows about. Where testimony has been exposed, the difference between hearing about it on day one and hearing about it on day forty is the difference between warning a witness and reading about them.

   The second paragraph of the spoken text matters. A director who does not understand that their amnesty binds only their own management is making a promise they may be unable to keep, to a staff member who took a real risk to answer.

9. Step 9 / 11

   Spend five minutes on section 6. Write the review date six months from today, then open your calendar and create the appointment before you leave the room, with the director and the same people invited.

   Check it worked

   The appointment exists in a calendar that will actually alert someone, with invitations accepted by at least two people, before anybody leaves the room. A date written only in the document is not a review; it is an intention. If your office does not use a shared calendar, write it on the wall planner in front of everyone.

   Note

   Six months, not twelve. NTEN's template recommends reviewing 'at least annually'. For this sector twelve months is too slow, and a policy that names ChatGPT's settings menu goes stale faster than that, while we were repairing this recipe, OpenAI's phone-verification requirement had changed outright since the previous pass. If nothing has changed at your six-month review, the review takes four minutes and costs you nothing.

10. Step 10 / 11

    Spend the last five minutes adopting it. The director signs and dates the master copy. Everyone in the room who is one of your own people signs. Save the master copy in your own storage, not in a public shared folder, not in an email attachment chain. Then send it to the rest of your staff, volunteers, interns and board and ask them to sign a copy within one week.

    Check it worked

    Look at the signature sheet before you file it and ask one question about every name on it: would this person be endangered by appearing on a list held in this office? Fixers, translators, drivers and community contacts should not be on the sheet at all. They get the spoken briefing in step 11 and no attendance list. If any staff name on the sheet would itself be dangerous, take it off and brief that person out loud instead. Then confirm three things about what you circulate: the circulated copy carries the policy WITHOUT the signature sheet; your own staff get the full version including the specific RED examples, because they need it; and anything that leaves your staff, the wall copy, the copy for community contacts, carries the RED headings in general terms only.

    Note

    An unsigned policy is a draft, and a draft is what people argue with when something goes wrong. The signature is not a legal instrument here; it is the moment a person cannot later say they had not seen it. Keep the signed copies with your other personnel records, at the same protection level.

    The restriction on who signs is deliberate and it corrects an earlier draft, which asked for signatures from fixers, translators and drivers. A signed, dated, filed list of every fixer you use is exactly the artefact your own RED list forbids, and it would sit in personnel records that are not protected as case files are. Brief them; do not enrol them.

11. Step 11 / 11

    Within the following week, deliver a ten-minute spoken briefing to all staff, in the language they actually speak, delivered by a person and not by email. Deliver the same briefing separately to fixers, translators, drivers and community contacts. They get the rules out loud instead of a signature. Do not read the policy aloud. Cover four things only.

    Copy this exactly

    The four-point briefing:
    
    1. Here are our three levels. To your own staff, hold up the master RED list and read some of it. To anyone who is not your own staff, describe the categories out loud, testimony, identities, case files, anything about a child, and do not display or hand over the page with your real examples on it. These things never go into any AI tool that connects to the internet. (Two minutes.)
    
    2. Here is the list of tools you may use, and here is what each one may be used for. If it is not on this list, ask first. And when a tool says it is not training on your words, that means it will not learn from them. It does not mean they stayed in this building. (Three minutes.)
    
    3. If you make a mistake, tell [APPROVER] the same day. You will not be in trouble. I need to know so I can protect the people in that information. (Two minutes.)
    
    4. Nothing produced by an AI tool leaves this organisation until a person has checked every name, number, date and quotation against the original. Put your name on the draft when you have checked it. Never press the thumbs-up or thumbs-down button on an answer that contained our material. (Three minutes.)
    
    WHAT YOU PRINT, AND WHAT GOES ON THE WALL. Your own staff each get a printed one-page copy in their working language, the full version, kept the way they keep their case notes. The copy that goes on the wall where people work, and any copy handed to a fixer, translator, driver or community contact, is the SHORT version: the three levels named but not itemised, the rule table, the approver's name, and the four points above. A wall is read by visitors, cleaners, delivery drivers and anyone who walks in. Your specific RED list does not belong on one.

    Check it worked

    Before you print more than one copy of the Kurdish Sorani version, print exactly ONE and look at the paper. Check that ڕ ڵ ۆ ێ ژ گ چ ک ە all appear as those letters, not as empty boxes, not silently missing, not replaced by an Arabic lookalike, and that the right-to-left line and paragraph order survived. Some fonts render correctly on screen and fail at the printer, so screen-checking is not enough. If anything is wrong, change the font and print one page again. Do the same one-page check for Arabic. Then, before you pin anything up, stand where a visitor stands and read the wall copy from there: if you can read a real project name, a district or a named set of recordings off it, take it down and print the short version. After the briefing itself, the check is a question, not a nod: ask two people, separately, to name one thing on the RED list from memory. If neither can, the briefing was a reading rather than a briefing, give it again, shorter, holding the page up.

    Note

    Our needs assessment found 43% of organisations have two hours a week or less to learn anything new, so ten spoken minutes plus one page on the wall is the entire realistic training budget. Design for that rather than for a workshop that will never happen. For a mixed Arabic and Kurdish team, deliver the briefing twice rather than once bilingually, a bilingual briefing is understood by nobody fully.

    The font check is not fussiness. For a recipe whose entire output is a printed page on a wall, a font that silently drops Kurdish-specific letters is the failure that will actually happen to you, and it is invisible until the paper is in your hand.

    The two-copy rule, a full staff version and a short wall version, is worth carrying beyond this document. A long internal policy plus a short public-facing paragraph your donors and the communities you document can actually read is a good shape for any policy you write. That is our own recommendation, not a claim about anyone else's template.