Transparency
People know when they're interacting with AI and when AI shaped a decision that affects them.
Governance & policy
Responsible AI, made practical.
Governance shouldn't be a binder nobody reads. We build lightweight, right-sized programs: clear principles, a simple way to approve new AI uses, and controls that match your real risks and the laws where you operate.
Six principles we build on
Every policy and solution we deliver is checked against these.
Human oversight
A named person is accountable for each AI use. Consequential decisions get human review.
Privacy & security
Collect less, share less, retain less. Access is scoped and logged; sensitive data is protected.
Fairness
We test for biased outcomes, especially in hiring, lending, housing, and service eligibility.
Reliability
AI outputs are verified before they're trusted. We measure accuracy and monitor drift over time.
Values alignment
AI use should reflect your mission and culture — especially for churches and mission-driven organizations.
Our framework
Aligned to the four functions of the NIST AI Risk Management Framework — scaled down so a 15-person team can run it.
GOVERN
Set the rules
Policy, roles, an AI use register, and leadership sign-off.
MAP
Know your uses
Inventory every AI tool and use case, the data involved, and who's affected.
MEASURE
Test the risks
Check accuracy, bias, security, and privacy before and after launch.
MANAGE
Act & improve
Mitigate, monitor, handle incidents, and review quarterly.
Risk tiers: not all AI use is equal
We classify each use so low-risk work moves fast and high-risk work gets the scrutiny it deserves.
| Tier | Examples | Required controls |
|---|---|---|
| Low | Brainstorming, drafting public posts, summarizing public articles | Approved tools only; author reviews before publishing |
| Moderate | Summarizing internal documents, drafting customer or member emails, meeting notes | Enterprise plan with no training on your data; no sensitive data; spot checks |
| High | Anything that affects a person's job, money, housing, care, or eligibility; customer-facing chatbots | Risk review and sign-off, human decision-maker, bias testing, disclosure, logging, state-law check |
| Prohibited | Entering passwords, SSNs, health or counseling records into unapproved tools; covert biometric collection; deceptive deepfakes | Not permitted; training and technical blocks where possible |
What an AI policy should cover
Use & tools
- Purpose, scope, and who it applies to (including volunteers and contractors)
- Approved tools and how to request new ones
- Allowed, restricted, and prohibited uses
Data & security
- Data classification and what may never be entered
- Account requirements: SSO, MFA, organization-owned accounts
- Retention, deletion, and vendor requirements
Quality & accountability
- Human review and fact-checking expectations
- Disclosure: when to tell people AI was used
- Intellectual property and attribution
Oversight
- Policy owner, AI use register, and review cadence
- Incident reporting for AI errors or data exposure
- Training requirements and acknowledgement
State guide · last reviewed October 18, 2026
AI & privacy rules in our states
A plain-language overview of the rules we most often see affect AI projects. Laws change quickly and details matter — use this to ask better questions, then confirm specifics with your attorney.
This is general information, not legal advice. Applicability depends on your organization's size, revenue, type (for example, many nonprofits and HIPAA-covered entities are treated differently), and what data you handle.
Illinois
| Law | What it means for AI projects |
|---|---|
| Biometric Information Privacy Act (BIPA) | Written notice and a signed release before collecting fingerprints, face geometry, or voiceprints; a public retention and destruction policy; no selling biometric data. Includes a private right of action; a 2024 amendment limits damages to one recovery per person and allows electronic consent. Relevant to face recognition, voice AI, and biometric time clocks. |
| Artificial Intelligence Video Interview Act | If AI analyzes recorded video interviews, employers must notify applicants, explain how the AI works, get consent, limit sharing, and delete videos within 30 days of a request. Employers that rely solely on AI to decide who advances must also report applicant demographic data to the state each year. |
| Human Rights Act amendments on AI in employment (effective Jan. 1, 2026) | Employers may not use AI in hiring, promotion, discipline, or other employment decisions in a way that discriminates against protected classes — including using ZIP codes as a proxy — and must notify employees when AI is used for these purposes. |
| Wellness and Oversight for Psychological Resources Act (2025) | Restricts AI from providing therapy or making therapeutic decisions; licensed professionals may use AI for administrative support. Relevant to counseling ministries and care providers. |
| Personal Information Protection Act (PIPA) | Requires reasonable security for personal information and notice to affected residents after a breach. |
Texas
| Law | What it means for AI projects |
|---|---|
| Texas Responsible Artificial Intelligence Governance Act (TRAIGA, effective Jan. 1, 2026) | Prohibits developing or deploying AI with the intent to manipulate people toward self-harm or crime, to unlawfully discriminate (a disparate impact alone isn't enough), or to produce sexually explicit deepfakes or child sexual abuse material. Requires government agencies and health care providers to disclose AI use to people they serve. Enforced by the Attorney General, with a cure period and a regulatory sandbox program. |
| Texas Data Privacy and Security Act (TDPSA) | Gives consumers rights to access, correct, delete, and opt out of targeted ads, data sales, and certain profiling. Requires privacy notices and data protection assessments for higher-risk processing such as profiling. Applies broadly, with exemptions for some entities; even small businesses need consent before selling sensitive data. |
| Capture or Use of Biometric Identifier Act (CUBI) | Notice and consent before capturing biometric identifiers for a commercial purpose, limits on sale and disclosure, and destruction within a set time. Enforced by the Attorney General. |
| Data breach notification (Bus. & Com. Code ch. 521) | Notify affected individuals without unreasonable delay and within 60 days, and notify the Attorney General within 30 days when 250 or more Texans are affected. |
| AI in health care (SB 1188, 2025) | Health care practitioners who use AI to support diagnosis or treatment must stay within their scope of practice, review AI-generated information, and disclose AI use to patients. Relevant to clinics and care ministries. |
Florida
| Law | What it means for AI projects |
|---|---|
| Florida Digital Bill of Rights | Comprehensive privacy obligations apply mainly to very large companies (over $1 billion in revenue meeting additional criteria), but rules on selling sensitive personal data apply more broadly. Includes rights to opt out of profiling and targeted advertising. |
| Florida Information Protection Act (FIPA) | Requires reasonable measures to protect personal information, and notice to affected individuals within 30 days of a breach — plus the Attorney General for breaches affecting 500 or more Floridians. Applies when AI vendors or tools hold your data. |
| AI in political advertising (2024) | Political ads that use AI-generated content depicting real people doing things they didn't do must carry a disclaimer. Relevant to advocacy organizations and campaigns. |
| "Brooke's Law" (2025) | Requires covered online platforms to remove nonconsensual sexually explicit deepfakes within 48 hours of a valid request. |
Federal rules & frameworks
NIST AI RMF & Generative AI Profile
Voluntary U.S. framework for managing AI risk. The backbone of our governance approach.
ISO/IEC 42001
International standard for AI management systems. Useful for organizations that may pursue certification.
FTC Act
Prohibits unfair or deceptive practices — including exaggerated AI claims and misuse of consumer data.
Anti-discrimination laws
Employers remain responsible for discriminatory outcomes from AI tools under Title VII, the ADA, and related laws.
Sector rules
HIPAA (health), GLBA (financial), FERPA (education records), and COPPA (children under 13) all apply to AI that touches that data.
Copyright & IP
Purely AI-generated content may have limited copyright protection. Policies should address ownership and attribution.
TAKE IT DOWN Act (2025)
Makes publishing nonconsensual intimate images, including AI deepfakes, a federal crime, and requires covered platforms to remove them within 48 hours of a valid request.
Federal vs. state AI rules
A December 2025 executive order seeks a national AI framework and directs challenges to some state AI laws. Until courts or Congress act, state laws like those above still apply, so plan for both.