A grant draft goes faster when you give a tool real material: case notes, outcome data, a partner's budget, a client's story. That is also how confidential information ends up somewhere you never meant it to go. Once a file is uploaded, you may not be able to say who can see it or how long it stays.
This article helps you decide what never goes into an AI tool, which rules and agreements may already answer the question, what community data governance asks of you and what to ask a vendor before you upload anything.
Start with what stays out
Grant narratives need evidence, but they rarely need identities. As a default, keep these out of any AI tool unless you have confirmed in writing that you are allowed to share them:
- Names and details that identify a person. The federal grants rules define personally identifiable information (PII) as information that can be used to distinguish or trace an individual's identity, alone or combined with other information that is linked or linkable to that person. That includes more than names: a rare diagnosis plus a small town can identify someone.
- Health records from your clients or patients.
- Student records.
- Anything under a confidentiality agreement, such as a partner's financials, a funder's non-public guidance or a contract with a restriction on sharing.
- Passwords, bank details and login credentials for portals.
The fix is usually to describe, not copy. A draft needs "a 34-year-old parent of two who lost housing after a medical emergency", not the case file. Better still, use aggregate counts and anonymized, composite stories that the people involved have agreed to.
Check which rules already apply
You may be bound by laws and agreements you don't think about daily.
Health information. HIPAA's rules apply to covered entities, which the regulation defines as health plans, health care clearinghouses and certain health care providers. They protect "individually identifiable health information," meaning information relating to a person's health, care or payment for care that identifies them or could reasonably identify them. A person who creates, receives, maintains or transmits protected health information on behalf of a covered entity can be a "business associate," and a covered entity may disclose protected health information to one only after getting satisfactory assurance that it will be safeguarded. If your organization is a covered entity, uploading client health information to a tool that has no such arrangement is a question for your privacy officer or counsel before it is a question for you.
Education records. FERPA gives parents the right to access their children's education records and some control over the disclosure of personally identifiable information from them, and the rights transfer to the student at age 18 or on entering a postsecondary institution. If you partner with a school, ask the school what it allows.
Your award terms. Under 2 CFR 200.303(e), recipients of federal awards must take reasonable cybersecurity and other measures to safeguard information, including protected PII and information the agency or pass-through entity designates as sensitive. If you hold a federal award, that covers the data you manage for it.
Your own policies. Employer, board, client and partner policies often say more than the law does. Read the ones that exist before you decide.
None of this is legal advice. Where the answer matters, ask your counsel or privacy officer.
Respect community data governance
Some communities hold their own authority over data about their people, lands and knowledge. The CARE Principles for Indigenous Data Governance, released by the Global Indigenous Data Alliance, were written to complement the open-data FAIR principles, which focus on sharing data and, in the alliance's words, ignore power differentials and historical contexts. They name four ideas: collective benefit, authority to control, responsibility and ethics.
For a grant writer, that means you don't treat a community's stories, language, maps or health information as your organization's files to upload. Ask who has authority to decide, whether the community or tribal nation has a data governance policy or review process, and whether consent covers use in an AI tool as well as in the proposal. Community voice in the proposal covers how to involve the people you serve before you write about them.
Funders watch this too
Funders worry about the same thing from their side. NIH's notice NOT-OD-23-149 prohibits NIH peer reviewers from using generative AI tools to analyze applications or write critiques, and from uploading application content to them, because it can't be known where data entered into AI tools are sent, saved, viewed or used in the future. NSF likewise prohibits its reviewers from uploading proposal content to AI tools it has not approved. If funders won't paste your application into an unapproved tool, treat your clients' information with at least the same care. Funder AI policies covers how to find what each funder says about AI.
Questions to ask any vendor
Ask in writing, and keep the answers with your records.
- Where is our data stored, and who can access it? Ask about the company's staff and any other companies that handle your files.
- Is our content used to train or improve models? Ask whether this is on by default and whether you can turn it off.
- How long is it kept, and can we delete it? Ask what happens to uploaded files when you close an account.
- Is our workspace separate from other customers'?
- What agreements will you sign? If you are a HIPAA covered entity, ask whether the vendor will sign a business associate agreement. If you hold sensitive client data, ask for the contract terms in writing.
- What happens if there is a breach? Ask how and when you would be told.
If a vendor can't or won't answer, that is your answer. This applies to any tool, SoliContraX included.
A sample policy you can adapt
Say a small community health nonprofit writes this one-paragraph rule and shares it with staff:
We may use approved AI tools to draft grant text from our published materials: annual reports, program descriptions and de-identified aggregate data. We do not upload client names, case notes, health records or student records; documents under a confidentiality agreement; or any community data without that community's consent. Staff must check a vendor's data terms with the executive director before using a new tool. Each draft is reviewed by a person before it is submitted.
It fits on a page, and it settles most questions before they start. What to hand off to AI and what to keep can help you choose which tasks the policy should cover.
Your next step
Write a one-paragraph policy like the one above for your own organization. List what you will upload, what you won't and who decides in unclear cases. Then send the six vendor questions to any tool you already use, and file the replies.
If you do use a drafting tool, SoliContraX is built for starting and finishing applications from the funding notice and your own organization's materials, so decide what belongs in your knowledge base before you add anything to it. See how to get started.
Sources
- 2 CFR 200.1, Definitions: personally identifiable information (eCFR)
- 2 CFR 200.303, Internal controls (eCFR)
- 45 CFR 160.103, Definitions: covered entity, business associate, individually identifiable health information (eCFR)
- 45 CFR 164.502(e), Disclosures to business associates (eCFR)
- What is FERPA? (U.S. Department of Education, Student Privacy Policy Office)
- CARE Principles for Indigenous Data Governance (Global Indigenous Data Alliance)
- NOT-OD-23-149, The Use of Generative Artificial Intelligence Technologies is Prohibited for the NIH Peer Review Process (NIH)
- Notice to Research Community: Use of Generative Artificial Intelligence Technology in the NSF Merit Review Process (NSF)