TL;DR: A church AI policy should do five things. Name the AI tools staff may use and require church-managed accounts. Classify the church's data and name what never goes into an AI tool, starting with pastoral care notes, children's records, and giving tied to names. Require a person to review anything AI-assisted before it is published, preached, or sent. Set the vendor terms the church will accept, including whether its data can be used to train a model. Assign an owner, a training plan, and a review date, with the board approving the whole. Most churches can adopt one in a month.
AI is already inside most churches. In Barna's survey of U.S. Protestant pastors, conducted with Gloo in December 2025, only 13 percent said they do not use AI at all. Half use it for brainstorming, and 24 percent now use it to write or edit sermons, double the share in early 2024 (Barna, June 2026).
Staff use follows the same curve. The communications director drafts with it, the business administrator summarizes vendor contracts with it, and the children's ministry lead builds lesson outlines with it. Very few of those uses are wrong. The exposure comes from the uses nobody has thought through: a counseling summary pasted into a free account, a giving report uploaded to a tool whose terms allow training, a member email sent without anyone reading it first.
Few churches have one yet. In a separate Barna study of 1,306 church leaders, commissioned by Pushpay and fielded in late 2025, only 5 percent of churches had AI guidelines (Barna). A policy closes that gap. It does not need to be long. It needs to be specific about the church's data, clear about who decides, and approved by the people who govern the church.
Why does a church need its own AI policy?
A church holds information most organizations never touch. Pastoral care and counseling notes, prayer requests, records of children and students, benevolence applications, and giving histories tied to names all carry a promise of confidentiality, stated or assumed. A breach of that promise is a pastoral and relational failure before it is a legal one.
Corporate AI policies do not name these categories, and consumer AI tools do not know they exist. The church's policy has to.
There is also a theological question the board will want to answer in its own words: where AI is welcome in ministry and where the church expects a human voice. Denominational bodies have begun to speak to this. The Southern Baptist Ethics and Religious Liberty Commission published an evangelical statement of principles on artificial intelligence in 2019, and many traditions have issued guidance since. A church's policy can point to its own tradition and then get practical.
What should a church AI policy include?
Ten sections cover what most churches need. Each can be a paragraph or a short list.
- Purpose and theology. Two or three sentences on why the church uses AI and the limits it places on it, in the church's own voice.
- Scope. Who the policy covers: staff, contractors, and the volunteers who handle church data or speak for the church.
- Approved tools and accounts. The specific AI tools staff may use, on church-managed business or enterprise accounts. Personal accounts are not used for church work.
- Data classification. Three tiers are enough for most churches: public, internal, and confidential. The policy states which tiers may enter an AI tool and under what conditions.
- The never-enter list. Pastoral care and counseling notes, children's and student records, giving records tied to names, benevolence files, payroll and HR files, medical information, and anything shared in confidence.
- Human review. A named person reviews AI-assisted content before it is published, sent, or spoken from the platform, and remains accountable for it.
- Sermons and ministry content. The church's expectations for AI in preaching, teaching, and pastoral writing, including whether and how its use is disclosed.
- Vendor review. What the church requires before adopting a tool: terms on model training, data retention, access controls, and where data is stored.
- Incidents. What a staff member does when confidential information enters an AI tool by mistake, and whom they tell.
- Ownership, training, and review. The staff owner of the policy, onboarding and annual training, and a review at least once a year, with board approval of material changes.
What data should never go into an AI tool?
This section does the most protective work, so make it concrete. Name the categories in the language staff use every day.
- Pastoral care and counseling. Session notes, prayer requests shared privately, and anything a member said in confidence.
- Children and students. Names, photos, medical and allergy information, custody notes, and incident reports.
- Giving. Contribution and pledge records tied to a person, and any bank or card details.
- Care and benevolence. Applications, financial need, and case notes.
- People files. Payroll, compensation, performance, and disciplinary records for staff.
Some of this information can be used safely in aggregated or de-identified form inside an approved enterprise tool. Total giving by month carries a different exposure from a named donor's history. The policy should say which is which, so staff are not left to guess.
How should a church choose AI tools?
The most important control is the account type. Business and enterprise tiers from the major providers generally carry contractual data commitments that consumer tiers do not. Microsoft, for example, states that for Microsoft 365 Copilot, prompts, responses, and data accessed through Microsoft Graph are not used to train foundation models (Microsoft Learn). Check the current terms of any tool before approving it, because providers revise them.
Most churches are better served by the AI built into the productivity suite they already pay for than by a collection of separate subscriptions. It inherits the church's existing sign-in, permissions, and retention settings, and it gives whoever supports the church's technology one place to manage access. Add specialized tools only when a clear workflow justifies them, and add each one to the approved list by name.
For a structured way to think about risk, the NIST AI Risk Management Framework is free, widely used, and scales down well. A church does not need to adopt it formally to borrow its four functions: govern, map, measure, and manage.
Who should own the policy?
The board approves the policy and receives a short report on it once a year. The executive pastor or business administrator usually owns it day to day, because the policy sits where operations, data, and staff conduct meet. Technology support, internal or outsourced, maintains the approved tool list and the account settings.
Ownership matters more than drafting quality. A policy with a named owner and a review date gets updated when tools change. A policy without one becomes a document staff signed once and forgot.
How do you roll out an AI policy without slowing ministry down?
Adopt the policy in a month, train in an hour, and review it in a year. A practical sequence:
- Week one: inventory. Ask staff which AI tools they use, on which accounts, and for what. Treat the answers as information, not confession.
- Week two: draft. Write the ten sections, starting with the never-enter list and the approved tools.
- Week three: approve. Take the draft to the elders or board with the inventory findings and a recommendation on accounts and budget.
- Week four: train and switch. Move staff onto church-managed accounts, train everyone in a single session, and publish the policy where staff and key volunteers can find it.
Then measure what AI returns. Hours saved on communications, administration, and finance are real and worth reporting to the board. They are part of how a church stewards its staff's time.
An invitation
Novum's Technology & AI practice drafts church AI policies with leadership teams, sets up the accounts and data protections behind them, and trains staff. If your church is ready to put a boundary around how AI is used, book a Strategy Read or see how we advise, partner, and lead with churches on technology.