Sample Church AI Policy: One Page on Staff, Volunteers and Member Data

A church AI policy should fit on one page and settle five things: which admin jobs staff and volunteers may do with AI, which pastoral and safeguarding jobs are off limits, what member data never enters a tool, who approves new tools, and when the congregation is told AI helped. Add examples, because volunteers follow examples more reliably than principles.

Bare templates fail on the examples. A line such as "protect personal data" does not tell a volunteer whether Sunday's rota can go into a chatbot, or that a prayer request with a name and a diagnosis is a different thing from a notice about the coffee morning. Each clause needs a plain case beside it: the rota may go in with first names only; the prayer chain may not go in at all. None of this is legal advice, so ask your board and your data-protection adviser to read your policy before adoption.

Follow me on Instagram@sagnikteaches

One colour system for jobs: where admin ends and pastoral care starts

Three colours run through the whole policy. Green means any approved tool, with no personal detail in what you enter. Amber means an approved tool on a church-controlled account, with the minimum detail and a leader's agreement. Red means no AI tool at all. The line between admin and pastoral work decides which colour a job gets, and a table applies it better than a principle does.

Connect on LinkedInSagnik Bhattacharya

Grey cases will turn up that no table covers, so give people three questions. Does the job involve a named or identifiable person's situation? Would that person expect the church to keep it among a few people? Would a wrong, bland or tone-deaf result hurt them? One "yes" makes it pastoral, and pastoral work is red unless your leaders have decided otherwise in writing. Test with the details, not only the names: in a congregation of 200, "the only family with twins in the youth group" identifies someone without a name. For a fuller treatment of the pastoral side, admin versus pastoral care with ChatGPT goes through more cases.

Subscribe on YouTube@sagnikteaches

Member data in plain words, with a worked audit

A membership list is more than contact details. It records who belongs to a religious community, and data-protection law such as the GDPR places that kind of information in a special category: Article 9 lists religious beliefs among them. The same article gives religious not-for-profit bodies a narrow exemption for their own records of members, former members and people in regular contact, on condition that the data is not disclosed outside the body without consent. Pasting a list into a free chatbot is a step outside the body that the exemption does not obviously cover. Your adviser can tell you where the line falls for your church. The policy's job is to keep volunteers well inside it. The member data that never goes into ChatGPT expands on the same point.

The easiest way to write rules people will follow is to audit what you hold. The audit below is for an illustrative church with 210 people on its membership list, three paid staff and 38 regular volunteers. The leaders listed every place the church keeps personal data and gave each one a colour.

Three green, three amber and six red. Half of what the church holds is off limits, which sounds restrictive until you notice what remains: all the public-facing writing, which is most of the work an AI tool is good at. The audit took the administrator about 90 minutes with two leaders in the room. The system that already holds your membership data, usually a church-management package, is a separate decision. If it adds an AI feature, that feature goes through approval like any other tool.

The other half of the skill is turning a risky request into a safe one while keeping the task. Three pairs show how:

In each pair the AI still does the part it is good at, the wording or the pattern-finding, and the person keeps the part that is personal.

Staff, volunteers and their own accounts: who may do what

Staff and volunteers face different risks, so the policy should say what each group may do. Paid staff handle more data and usually have church accounts. Volunteers handle less but often use their own phones, their own accounts and their own judgement at ten o'clock on a Saturday night.

Accounts need their own clause. Consumer ChatGPT and Claude plans let a user switch off the use of their chats for model training in privacy settings, and the button labels change often, so the policy says "the model-training switch" rather than quoting a name. Business plans from OpenAI, Anthropic, Microsoft and Google do not train on business content by default. For the two or three people who do most of the AI work, a church-owned plan is the cleaner arrangement, because the account belongs to the church and not to a volunteer's personal email. ChatGPT Business and Claude Team both start at two seats. Some vendors offer nonprofit pricing, but each programme sets its own eligibility rules, so check that a church qualifies before you budget for it. AI policy for not-for-profits whose volunteers use their own accounts covers the trade-offs between personal and church accounts in more detail.

Watch for AI arriving inside tools you already use. Email platforms, church-management systems and video-meeting tools keep adding buttons, and the labels change. Zoom, for example, dropped the "AI Companion" name in June 2026 and now names its features by function, such as meeting summary. A meeting summary is still a transcript of what people said, so the policy should say no AI note-taker or summary joins a pastoral, safeguarding, discipline or staffing conversation. A new button is a new tool, and it goes through approval.

Approval: six questions and a register of approved tools

Approval works best when it is boring. A volunteer asks the policy owner; the owner and one leader check the tool against six questions; the answer comes back within a week; the register is updated. The six questions:

1. What job will it do, and which colour is the data involved?
2. Who owns the account, the church or an individual?
3. Does the company train its models on what we enter by default, and can that be switched off?
4. Where can chats and files be deleted, and who else can see them?
5. What does it cost, who pays, and what happens when a free tier ends?
6. How will a person check the output before it reaches anyone?

Question five matters more than it looks, because tools end as well as change price. OpenAI is retiring custom GPTs, so any GPT a volunteer built for church FAQs is scheduled to stop running on 11 December 2026. OpenAI's migration turns an existing GPT into a plugin, or you can move its instructions into ChatGPT Projects or Claude Projects; either way, the register needs a new row. What to check in an AI tool's privacy policy and terms shows how to answer questions three and four from the vendor's own pages.

The register is the policy's working memory. A filled-in example:

Notice that two rows say "off" or "not enabled". A register that records what you decided not to use is as valuable as one that records what you use, because it settles the argument the next time someone asks.

Disclosure: when the congregation should be told

People forgive a notice that an AI polished and a person checked. They do not forgive discovering that a message they took for a pastor's own words was generated. Disclosure rules protect the trust that the rest of the policy exists to protect.

Some of this is law as well as courtesy. If you have visitors or members in the EU, Article 50 of the EU AI Act sets transparency duties, including telling people when they are dealing with an AI system and labelling AI-generated or manipulated content that looks real. They have applied since 2 August 2026, and the duty to build the notice into a chatbot sits mainly with its provider, so ask the vendor how its greeting handles it. Platforms add their own rules. YouTube's AI use setting, in the Attributes section at upload, asks you to disclose realistic AI-generated or altered content, such as making a real person appear to say something they did not, and AI-generated music that is the main focus. Its help page says scripts, outlines and captions made with AI need no disclosure, and cloning your own voice for a dub does not either. Your policy can be stricter than a platform's, and a church often should be.

Sermons, prayers and teaching: a leadership decision, three wordings

This is the one clause a template cannot write for you, because it is a pastoral and theological decision, not a technical one. Your tradition may already have guidance. Whatever your leaders decide, the policy should say it in a sentence so a volunteer or a visiting speaker is not left guessing. Three wordings cover most positions:

• Option A, no use: "AI is not used to write or shape sermons, prayers or teaching."
• Option B, support only: "AI may help with research, outlines and checking. The speaker writes and owns the message and checks every quotation and reference against its source."
• Option C, support with openness: "As Option B, and the preaching team tells the leadership when and how AI was used."

Whichever you choose, add the factual warning that belongs in options B and C: AI tools can invent quotations, references and attributions with complete confidence, so every quotation and reference needs checking against the original. That is also a reason to keep the pastoral letter red. A letter to a grieving family needs a person's attention, not a plausible paragraph.

Draft the policy with AI, then edit it with five checks

AI can produce a first draft of the policy in minutes if you give it your own colour lists and not a blank brief. Do not include any real names or data. This prompt works with any chat assistant:

Draft a one-page AI policy for a church with about 200 members, 3 paid staff
and 40 volunteers. Plain language, short sentences, no legal jargon.

Structure: why we have it; who it covers; GREEN jobs; AMBER jobs (ask first,
church account only); RED jobs (never in any AI tool); accounts; telling
people; what to do if something goes wrong; approval and review.

GREEN: tidying public notices, event posters, social posts, general enquiry
replies with names removed.
AMBER: rotas (first names only), meeting minutes, new tools.
RED: prayer requests, pastoral and counselling notes, safeguarding,
anything about children, giving records, HR and recruitment, the membership
database.

Do not claim any tool is compliant, secure or encrypted. Use [square
brackets] for anything I need to fill in.

A typical first draft reads well and still contains mistakes. Here is the kind of passage to expect, which is illustrative and not from a real tool run:

Our church is committed to the responsible use of AI in line with all applicable data-protection laws. All AI tools used by the church are fully compliant and encrypted. Pastoral letters may be drafted with AI assistance provided a member of the clergy reviews them. Staff may share member lists with approved AI tools to improve efficiency.

Five checks turn that into something safe to adopt:

1. Delete invented assurances. "Fully compliant and encrypted" is a claim the AI cannot know, and you cannot stand behind.
2. Remove contradictions with your own lists. The pastoral letter sentence breaks your red list, and the member-list sentence breaks the whole point of the policy.
3. Replace vague values with rules. "Committed to responsible use" tells a volunteer nothing; "never paste a name, a prayer request or a photo of a child" does.
4. Read it aloud to someone who does not do admin. If a volunteer cannot tell what to do with a rota, rewrite it.
5. Get it read by your adviser and your leaders. The AI drafted it; people are accountable for it.

Budget about two hours for the draft and edits, 45 minutes for a leadership review, and a second sitting if the leaders want to change the sermon clause.

When someone pastes the wrong thing: the first hour

Sooner or later someone will paste the wrong thing. Suppose a volunteer pastes the prayer chain list, with 38 names and health notes, into a free chatbot to fix its formatting, and mentions it to the administrator on Monday. The policy should have told them what to do next, and the first hour should look like this.

1. Thank them and report to the policy owner the same day. A policy that punishes honesty teaches people to hide mistakes.
2. Do not paste the data again to "show" what happened, and avoid screenshots that copy the list into another place.
3. Note the facts: which tool, which type of account, what data, when, and who else can see the chat.
4. Delete the chat and check the training switch. Deleting limits further use, but retention periods differ between tools, so write down what you did and the time.
5. Ask your adviser whether anyone must be told. Some laws require certain personal-data breaches to be reported to a regulator within 72 hours of becoming aware, as the GDPR does where it applies, and require every breach to be documented, so decide fast and keep the record.
6. Update the briefing, and ask whether the policy or the tools made the mistake easy.

A log entry can be short. This one is an illustration:

Date/time: [date], 09:10 Monday
Reported by: [volunteer role] to [policy owner]
What: prayer chain list (38 names, health notes) pasted into a free consumer chatbot on Saturday evening
Who could see it: the volunteer's personal account only
Action: chat deleted 09:40; training switch confirmed off; adviser contacted 10:15
Decision on telling people: [outcome and who decided]
Follow-up: briefing updated; prayer chain moved to a locked sheet; review in 30 days

The one-page policy, ready to copy

Here is the whole policy in one place. Replace the square brackets, choose one sermon option, and cut anything that does not fit your church. It runs to a single page in a normal font.

[CHURCH NAME] AI POLICY
Approved by: [board / elders / council] on [date]
Policy owner: [role]    Review: [date, six months on]

WHY WE HAVE THIS
AI tools can save time on admin. They can also expose people's private
lives. This page says what staff and volunteers may do, what they must
never do, and who to ask.

WHO IT COVERS
Paid staff, volunteers, leaders and anyone helping on the church's behalf,
on church or personal devices and accounts.

1. GREEN: you may use an approved AI tool for
- tidying, shortening or translating notices, newsletters and posters that
  contain only public information
- drafting event descriptions, social posts and reminder wording
- planning, formatting and checklists
- reply drafts for general enquiries with names and contact details removed
You are responsible for checking everything before it goes out.

2. AMBER: ask first (policy owner plus one leader)
- anything containing names of members, volunteers or families
- minutes or recordings of meetings
- new tools, or AI features that appear in tools we already use
Amber work is done only in a church-controlled account, with the minimum
detail.

3. RED: never, in any AI tool
- prayer requests, pastoral or counselling notes, visit records
- safeguarding information of any kind
- anything about children: names, photos, registers, medical details
- giving records, bank details, staff or volunteer files, recruitment and
  background checks
- the health, family, legal or immigration situation of any person
- the membership database or any export from it
If in doubt, treat it as red and ask.

4. PASTORAL AND TEACHING WORK
AI does not write pastoral letters, prayers or messages to named people.
[Sermons and teaching: insert Option A, B or C.]

5. ACCOUNTS
Use the church's accounts where we provide them. If you use your own
account for green tasks, switch off the setting that lets the company train
on your chats. Never share logins.

6. TELLING PEOPLE
Anything that talks to the public says it is automated. We label
AI-generated images, AI voices and machine translations. We never present
AI text as someone's own pastoral voice.

7. IF SOMETHING GOES WRONG
Tell the policy owner the same day. Nobody is blamed for reporting. We note
what, when and where, delete what we can, and decide whether anyone must be
told.

8. APPROVAL AND REVIEW
New tools need approval from the policy owner and one leader. We keep a list
of approved tools, and of tools we decided not to use. We review this
policy every six months.

I have read and understood this policy: [name]   [date]

A 40-minute volunteer briefing with six scenario cards

A policy nobody has discussed is a document, not a rule. For 41 people, three staff and 38 volunteers, hold two sittings of about 20 and keep each to 40 minutes. That is 80 minutes of a leader's time and about 27 hours of everyone's time in total, which is modest against one pasted prayer list. The agenda:

• 0 to 5 minutes: why the church has a policy, in two sentences.
• 5 to 15 minutes: the three colours, with the notice sheet, the rota and the prayer list as examples.
• 15 to 30 minutes: scenario cards in pairs, then the answers.
• 30 to 35 minutes: how to ask for approval and how to report a mistake.
• 35 to 40 minutes: signatures and questions.

Hand out the six scenarios below with the answers hidden, and ask each pair to give a colour and a reason before you reveal them.

Keep the first scenario for last: it shows the pattern behind every red job. The task is fine, only the data is the problem, and splitting the two is the skill the whole policy teaches. For ideas on the green jobs your volunteers will actually want to do, AI for church rotas, notice sheets and room bookings is a good place to point them, and rolling out an AI policy so staff follow it covers the habits that keep a policy alive after the briefing.

Church AI policy: questions leaders ask before adopting one

Can volunteers use their own ChatGPT or Claude accounts for church work?

For green tasks, yes, such as polishing a notice that contains nothing personal. Ask them to switch off the model-training setting in privacy settings and to keep church data out of personal accounts entirely. Amber and red work needs a church-controlled account or no AI at all. Put that in one clause so nobody has to guess.

Is a membership list sensitive if it only holds names and addresses?

Treat it as sensitive. A list of who belongs to a church reveals religious belief, which data-protection law such as the GDPR places in a special category. Narrow exemptions exist for religious bodies' own records, but they do not obviously cover handing the list to outside tools. Ask your data-protection adviser about your exact position.

Do we have to tell the congregation when AI helped write a notice?

Not for routine drafting that a person checked, such as tidying a notice sheet. Disclose when the content could mislead: a chatbot, AI-generated images or audio of real people, machine translation, or anything presented as a person's own pastoral voice. If your leaders want to go further, write that into the policy.

Who should approve the church's AI policy?

Whoever approves your other policies, usually the board, elders or council, after a named person drafts it. Record the approval date, a review date and a policy owner who answers questions. A policy adopted by one enthusiastic volunteer carries little weight when a hard case arrives.

How often should the policy be reviewed?

Every six months at first, then yearly, and whenever you add a tool or an existing system adds AI features. Vendors change privacy defaults and rename features, so the approved-tools list matters more than the policy wording. Put the review date in the footer and put it in the diary.

Further reads

• How to Write an AI Policy for a Small Charity — The same policy method written for a general small charity.
• ChatGPT Prompts for Churches: 10 Admin Jobs, No Sermons — Ten green admin jobs with ready-made prompts.
• AI Chatbot for Churches: Weddings, Baptisms and Hall-Hire Questions — What to test before a chatbot answers hall-hire questions.
• Church Translation With AI: A Test to Run Before You Pay a Vendor — How to check machine translation before you rely on it.
• AI Tool Discounts for Charities and Non-Profits: What to Claim — Check whether a church can claim lower-priced AI plans.
• Volunteer Onboarding Checklist for Charities: Build One With AI — Fit the AI briefing into your volunteer induction.
• AI Church Website Builder: Wix, Squarespace or GoDaddy Airo Compared — Wix, Squarespace or GoDaddy Airo for a small church: list prices, who keeps the site current, events pages, giving links and the cost of changing later.
• AI Receptionist for Churches: Office Phone Cost and Pastoral Call Rules — A monthly price range for a church AI receptionist, a list of calls that always go to a person, and a script for the office phone.
• AI Policy for a Small Library: One Page, Patron-Data Rules — A one-page AI policy for a small library: approved uses, patron-data rules, borrowing records, disclosure wording and a review date.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: GDPR Articles 9 and 33 (published regulation text); EU AI Act Article 50; YouTube Help, 'Disclosing use of GenAI content'; OpenAI's help article on custom GPT retirement and migration; Zoom's June 2026 feature renaming; OpenAI and Anthropic plan and privacy pages.