How to Write an AI Use Policy for Your Church Staff (Sermons, Member Data, and Disclosure)

A church AI use policy should fit on two pages and settle five things: what staff may use AI for, where member data may and may not go, which pastoral moments stay human, who reads AI-drafted messages before they reach a member, and what the congregation is told. Write it against what your staff already do, name the approved tools, and give one person the job of keeping it current. A template you can adapt is at the end.

Most churches are writing this policy after the fact. Someone on staff is already drafting announcements with a chatbot, and someone may already have connected one to your church database. A policy written now is permission with clear edges, not a crackdown.

Start with what your staff already do

Before drafting a single rule, spend fifteen minutes of a staff meeting asking everyone to name each AI tool they have used for church work in the last 90 days, what they used it for, and which account it ran on. Offer amnesty up front: nobody is in trouble for what they say.

Expect familiar answers: sermon research and outlines, newsletter and social copy, volunteer emails, summaries of long board documents. Expect one answer that makes the room go quiet, such as counseling notes pasted in "to organize my thoughts," or a list of givers run through a free tool to draft thank-you notes.

Write the actual list down. A policy written against your real inventory covers your real risks. One copied from a template covers someone else's.

Decide where member data may go

This section deserves more words than the rest of the policy combined, because it is where a church can do harm it cannot undo. The rule is about where data goes, not whether AI is involved.

Sort your tools into three tiers and name them in the policy:

• Any account, no member data. Drafting, rewriting, brainstorming and research with no names, contact details or church records in the prompt.
• Church-owned workspace only. Anything that includes member data: exports, rosters, giving figures, and any connection between an AI tool and your ChMS. That means a business or nonprofit workspace the church administers, with a signed data agreement. On a personal ChatGPT account, conversations can be used to train OpenAI's models unless the user turns off "Improve the model for everyone" in Data Controls, and that setting belongs to each person's account, not the church's. Our comparison of ChatGPT and church-specific AI covers which plans fit and what they cost.
• Never, in any general AI tool. Counseling and pastoral care notes, prayer requests with names, anything about a minor, health information, immigration status, safeguarding reports, and anything said in confidence.

Connections to your church database need their own line. Planning Center, for example, now lets staff connect ChatGPT, Claude and similar tools straight to church data. Its August 2026 announcement says each person sees only what their own permissions allow, admins choose who may connect, and write access (adding notes to profiles or filling out forms) is optional and granted separately. Its help page adds two cautions: without a commercial plan with the AI company, conversations can be used for training by default, and AI tools can misread data, so key figures should be checked in Planning Center itself.

Your policy should say who may connect, on which accounts, and whether AI may write anything back into member records. A sensible default is read-only for everyone until you have a specific reason to change it.

Test the rule against a realistic scenario. A well-meaning administrator exports the top fifty givers, pastes the list into a free chatbot and asks for personal thank-you notes. Nothing malicious happened, but names and gift amounts now sit with a third party under terms nobody read, and there is no way to take them back. The policy should make clear which tier that task belongs in. It should also note that a thank-you never needs the amount, a point our thank-you message templates make in more detail.

Write the sermon section

Vague rules here get ignored, so be specific:

• Allowed: background research, cross-references, historical and cultural context, outlining, brainstorming illustrations, tightening a draft the preacher wrote, and writing discussion questions and recaps.
• Not allowed: preaching a manuscript the preacher did not write, using commentary or exegesis without checking it against the text and a real source, and presenting an AI-supplied quote, statistic or story as true without verifying it.
• The standard: every claim has been checked in a real source, and every story told as personal is personal.

The verification rule matters more than it looks. AI tools can produce confident citations to books that do not exist and polished quotes attributed to famous preachers who never said them. The member with a shelf of Spurgeon will notice before anyone else does.

One test does a lot of work: the preacher should be able to explain, without notes, why each point is in the sermon.

Name the moments AI never touches

Some work is pastoral, whatever a tool can do: grief and condolence, a new diagnosis, a marriage in crisis, conflict or church discipline, safeguarding concerns, and anyone who has asked not to receive automated messages. Write the list out. It protects staff from letting a draft do a hard thing badly late on a Tuesday night.

Put a named person behind every message

Every AI-assisted message to a member is read, edited where needed, and sent by a person whose name is on it. Not approved by a committee, and not sent from "the church office."

This matters most for follow-up. A check-in with a family who has missed a few Sundays should come from the group leader or pastor who knows them, with replies going back to that person. Our playbook for reaching out to an inactive member covers who should send it and what to say. A draft can save twenty minutes. The relationship stays with the person.

Decide what the congregation is told

Settle disclosure before the policy goes to the board, because it shapes everything else. A workable middle ground is disclosure by category rather than by message: tell the congregation once, plainly, that staff use AI tools to help draft routine communication and organize information, that a person approves everything before it goes out, and what the church never uses AI for.

Some things should carry a person's own words with no AI in the final product: the sermon as preached, pastoral care, condolence and crisis messages, and anything about discipline or conflict.

Say it yourselves, in a short note from the lead pastor or from the platform. Members who hear it from you tend to be curious. Members who find out on their own tend to be suspicious. Staff usually have questions of their own first, and what church staff want to know before they'll use AI tools is a good list to answer in writing.

Give it an owner, a review date and an incident step

One named staff member owns the policy. They keep the approved-tools list, remove access when staff or volunteers leave, and decide which connections are switched on. The board reviews the policy every six months, because tools and their terms change faster than bylaws.

Add a short incident step. If member data goes somewhere it should not, whoever noticed tells the owner that day, and the owner decides with the lead pastor whether affected members are told. Our breakdown of what church member data privacy actually requires covers access and retention in more depth.

Then collect signatures from every staff member and every volunteer with database access. That list is usually longer than expected once small group leaders and the nursery coordinator with directory logins are counted.

A template you can adapt

Copy this, replace the bracketed parts, and cut anything that does not fit your church.

[Church name] AI Use Policy. Approved [date]. Next review [date]. Owner: [name].

1. Scope. This policy covers all staff and any volunteer with access to church member data.

2. Allowed on any account. Drafting, rewriting, brainstorming and research that include no member names, contact details or church records.

3. Church workspace only. Any task that includes member data, any export from [ChMS], and any connection between an AI tool and [ChMS]. Approved tools: [tool and account], [tool and account]. AI connections to [ChMS] are read-only unless [owner] approves otherwise in writing.

4. Never in any general AI tool. Counseling or pastoral care notes, named prayer requests, information about minors, health or immigration information, safeguarding reports, and anything shared in confidence.

5. Sermons. AI may support research, outlining and editing. The preacher verifies every claim, quote and statistic in a real source, and preaches what they wrote.

6. Human sender. A named person reads and sends every AI-assisted message to a member, under their own name.

7. Human only. Grief, crisis, conflict, church discipline, safeguarding, and anyone who has asked not to receive automated messages.

8. Disclosure. [Church name] tells the congregation that staff use AI to help draft routine communication and that a person approves everything sent. This statement is published at [location].

9. Incidents. If member data goes somewhere this policy does not allow, tell [owner] the same day.

10. Acknowledgment. I have read this policy and will follow it. [Signature and date]

Where to start this week

Run the fifteen-minute inventory at your next staff meeting, fill in the template with the tools your team already uses, and take it to the board within the month.

If you are evaluating software that touches member records, hold it to the same tiers. ChurchAI's security page says it works from a copy of your ChMS records, does not share member data between churches, and lets your team decide who on staff sees what. Its follow-up drafts are reviewed and sent by your staff under their own names. Ask any vendor, including us, to put those answers in writing.