Governance
My Responsible AI and Data Protection Policy
How I use artificial intelligence responsibly across all of my work, and what I require of the people I work with.
Version 1 · 2026-07-21 · John Zoltner, CEO
For any organization I have control over, such as AIChildSafety.org, its Childhood and AI Lab, or AI4SocialImpact, I adhere to strict responsible-AI and data-protection policies, and I require my staff, consultants, and collaborators to do the same. This policy sets out those commitments across all of my work. It is not a single joint policy of the organizations; each applies these commitments to its own obligations, and where a nonprofit mission or a child-protection duty makes a rule stricter, the stricter rule applies.
Status. A working statement of operational commitments, not legal advice. Where a specific law applies (GDPR, US state privacy laws, the EU AI Act, sectoral child-data rules), that law governs and this policy is read to meet or exceed it. Where “we” or “the organization” appears below, it refers to whichever of my organizations the work belongs to.
1 · Guiding principles
Every use of AI is measured against eight commitments, adapted from the NIST AI Risk Management Framework and the OECD and UNICEF principles.
1.1
Do no harm, safeguarding first. If a use of AI could foreseeably harm a child or a vulnerable person, we do not proceed until the risk is controlled. Safety outranks the task.
1.2
Human judgment stays in charge. AI assists; people decide. No consequential decision about a person, and no external deliverable, is finalized on AI output alone.
1.3
Accuracy and honesty. We verify AI output against primary sources before relying on it, confirm citations, and disclose AI-generated content where a reader could be misled.
1.4
Fairness and non-discrimination. We check AI outputs for bias against the communities the work serves, and do not use AI to disadvantage people by race, disability, indigeneity, income, gender, age, or immigration status.
1.5
Privacy and data minimization. We expose the least personal data necessary and keep sensitive data out of tools that do not protect it.
1.6
Security and resilience. Access control, encryption, vetted vendors, and an incident plan proportionate to a small organization.
1.7
Transparency and accountability. For any AI use we can say what tool was used, on what data, who reviewed it, and who is accountable.
1.8
Equity and community voice. When AI shapes how we describe, serve, or decide about affected communities, we seek and weigh their perspectives and do not let AI substitute for that voice.
2 · Governance and accountability
2.1
Accountable owner. As CEO I own this policy, the AI tool inventory, approvals, and the annual review, until delegated in writing.
2.2
Tool inventory and approval. A new AI tool is used for real work only after it passes a simple test: its account is set and verified so that our data is not used for model training, it is matched to the correct data tier, and, where personal data at scale or regulated data is involved, it runs under enterprise or API terms with a data processing agreement.
2.3
Risk triage. Before a new AI use, I assess intended use, who is affected, what data is involved, and what could go wrong; higher-risk uses get a written note and, where personal data is involved, a data protection impact assessment.
2.4
Training and review. Everyone bound by this policy reviews it on joining and annually; the policy is reviewed annually and on material change.
3 · Responsible use of AI
3.1
Human-in-the-loop. AI never makes or finalizes a decision that materially affects a person (hiring, eligibility, a fellowship outcome, a safeguarding judgment) without human review (usually mine, given our size).
3.2
Disclosure and provenance. Work that I direct, substantially shape, and edit in my own voice is my work product, whatever tools assisted it, and does not require a label. Disclosure applies where a reader could otherwise be misled about what they are seeing: fully AI-generated media, synthetic images, audio, or video, or text presented as authored independently by someone else. We preserve content-provenance signals (such as C2PA or SynthID).
3.3
No deceptive synthetic media. We do not create synthetic media of real children or other identifiable vulnerable people, or use AI to impersonate real people deceptively.
3.4
Verify before publishing. AI output in any external deliverable or published work is fact-checked, with a link-liveness check on anything carrying citations.
3.5
Prohibited uses. No child sexual abuse material in any form (see 5.4); no surveillance or profiling of private individuals; no disinformation or deceptive impersonation; no unreviewed decisions about people; no sensitive data in a tool not approved for that tier. Ordinary professional research drawing on public information, such as a person's published work, public role, and public statements, is not profiling under this policy.
3.6
Intellectual property and confidentiality. We do not enter another party's confidential, proprietary, or copyrighted material into an AI tool without the right to do so, and we check AI output for infringement. The human author, not the tool, is accountable.
3.7
Bias checks, accessibility, and responsible resource use. We check outputs for bias, make AI-assisted materials accessible, and use AI where it adds real value, mindful of its computational and environmental cost.
4 · Data protection and security
Data is handled at one of four tiers. The tier sets which tools and controls apply.
| Tier | Examples | AI-tool rule |
|---|---|---|
| Public | Published reports, public web content | Any approved tool |
| Internal | Draft strategy, internal notes, non-personal operations | Approved tools with a no-training account setting |
| Confidential | Contact data, donor data, unpublished partner or client material | Only accounts set and verified not to train on our data; enterprise terms with a data processing agreement where personal data at scale is involved |
| Restricted | Children's data; other special-category data; safeguarding case material; legal material | Not entered into any general cloud AI tool; segregated and access-restricted |
4.1
Sensitive data and cloud AI. “Does not train on your data” and “does not retain your data” are separate promises, and we treat them separately. Confidential data goes only to paid accounts set and verified so that our data is not used for model training. Where personal data at scale, regulated data, or a client's confidential corpus is involved, we require enterprise or API terms with a data processing agreement and retention controls, or we keep the work local (4.4). Restricted data does not go into general cloud AI tools at all.
4.2
Minimize, secure, delete. We collect the least personal data needed, encrypt Confidential and Restricted data in transit and at rest, limit access to those who need it, keep it only as long as needed, then delete it.
4.3
Vendors, incidents, and rights. We vet vendors and subprocessors, maintain an incident-response plan and log, honor data-subject rights (access, correction, deletion), and keep a light record of higher-risk AI uses.
4.4
Local and cloud AI: a split practice. For particularly sensitive material, such as organizational strategy, I use local AI models on my own hardware (for example, the latest open models such as Kimi, Gemma, Qwen, and Llama), so the data never leaves the device. Cloud AI tools, under the account terms above, carry the rest of the work. Local processing is preferred whenever a task can be done as well on-device.
4.5
Staff, fellow, and collaborator information. Where information about staff, fellows, or collaborators is used in cloud AI work, we use public information, such as published biographies and public roles, not confidential personal records.
4.6
Working records and archives. We retain our own working records, notes, and conversation archives as institutional memory; these are built overwhelmingly from public sources and our own work product. Archives are kept under access control, and we periodically review them and remove third-party personal data that no longer serves a purpose. If the organizations ever hold grant, personnel, or beneficiary records, the minimization, retention, and deletion rules above apply to those records in full.
4.7
Automated routines. Scheduled and automated AI routines, such as briefings that read email or calendars, run under the same protected accounts as everything else, extract the minimum needed for their purpose, and take no outward action. Nothing is sent, posted, or published automatically; a human approves every outward step.
5 · Children's data and heightened safeguards
5.1
Current state. As of the date this policy was written, none of my organizations holds, or has ever held, personal data about identifiable children or minors. This section states what we would do if that ever changes.
5.2
Best interests and necessity. Any handling of children's data serves the best interests of the child, and we do not collect identifiable child data unless it is genuinely necessary, cannot be replaced by anonymized or aggregate data, and has a lawful basis with appropriate child assent and parental or guardian consent.
5.3
Segregate and restrict. Any child data is stored segregated, restricted only to those staff members with a concrete need to use it, kept out of every general-purpose AI tool, covered by a data protection impact assessment and an ethics review, minimized, encrypted, and held for the shortest workable time. The default is that child personal data is not processed with AI at all.
5.4
CSAM and duty of care. In our work, we never seek, store, process, or evaluate child sexual abuse material in any form, including AI-generated material; it is reported to the appropriate authority or hotline through lawful channels. Where a child may be at risk of harm, the child's welfare takes priority over any research or project.
6 · Responsible AI in consulting engagements
Applies to consulting and service work (for example, through AI4SocialImpact).
6.1
This policy applies in full to consulting work. Where a client's contract, data agreement, or sector imposes stricter rules, those apply in addition.
6.2
Client and beneficiary data are treated as Confidential or Restricted and kept out of tools that do not protect them. We do not reuse one client's data or materials for another client, or to train any tool, and we disclose to clients when AI is materially used in their deliverables.
6.3
Partners and collaborators who handle our data must commit to standards at least equivalent to this policy, and to the relevant Child Safeguarding Policy where their work touches children.
7 · Research fellows and collaborators
7.1
All fellows and researchers whose work connects to AIChildSafety.org or the Childhood and AI Lab must adopt the organization's child digital safeguarding requirements. Fellows awarded research grants or collaborating on research are required to sign a legal contract saying that any undertaking will include: putting the best interests of children first; collecting no identifiable child data unless genuinely necessary and lawfully consented; keeping any child data under data segregation and out of general-purpose AI tools; obtaining ethics review for research with minors; never handling child sexual abuse material and reporting any child at risk; and disclosing AI-generated content and not producing synthetic media of real children.
8 · Relationship to child safeguarding
8.1
For AIChildSafety.org, this policy sits alongside the organization's Child Safeguarding Policy, which governs the protection of children across all of its work. Where the two overlap on children's data and digital safeguarding, the stricter provision applies, and nothing here reduces a safeguarding obligation.
An organization that helps others adopt AI well has to hold itself to those standards first. These commitments are how I do that, and they travel with me into every organization I lead.
This policy states operational commitments, not legal advice. Grounded in the NIST AI Risk Management Framework, the OECD AI Principles, UNICEF guidance on AI and children, NTEN and NetHope nonprofit-AI guidance, the ICO Age Appropriate Design Code, and the International Child Safeguarding Standards. This page was drafted with AI assistance, directed and edited by John Zoltner.