Artificial Intelligence and Civil Society

At Xquenda Artes we work at the intersection of human rights, community security, and economic development of indigenous and Afro-descendant peoples in Mexico and Colombia. We safeguard sensitive information: testimonies from producers, participant data, community agreements that are not meant to circulate freely.

When AI tools began to be accessible for our work, we had no clear answers: what happens to the data we input? Can we process the notes from an interview with a Triqui artisan using AI? Is there an AI tool that is truly respectful of privacy? These and other questions have no obvious answers. We found no protocols or guidelines for AI use designed for organizations like ours: civil society organizations with a particular ethical responsibility toward the communities and vulnerable groups we work with. So we built our own framework.

This framework started from recognizing that the potential of artificial intelligence is undeniable: it is already used across almost every industry and sector. Yet its use has not been incorporated, at least not explicitly, into the work of the vast majority of foundations and NGOs. It is being adopted gradually, without clear protocols or guidelines. In our own case, we have incorporated AI tools into our work and recognize the advantages: a funding proposal that used to take days now takes hours; we can manage projects by streamlining logistics, complement complex political analyses with AI-based comparative analysis, and improve internal work processes, among other applications.

But that same set of tools poses risks we cannot ignore. AI systems are not neutral: they reflect the biases of their training data, predominantly in English and built from a Global North perspective, and there is a real risk of replicating those models. Widely used models may by default use conversations for training purposes —in Claude this can be disabled under Settings > Privacy, though this option is not obvious: you have to look for it—; there is a risk that sensitive information may be used for training or even for targeted advertising, among many other possible scenarios.

As civil society organizations, this raises questions we cannot sidestep. For all these reasons, and drawing on available soft law, specialized literature, and existing ethical principles, we created our own protocol, grounded in the following principles we consider essential.

Ten principles for the responsible use of AI in civil society organizations

Adopt principles first, not tools. Define what values you want to protect before choosing a tool. The ethical framework must precede the operational protocol, not be derived from it after the fact.

Assess risk before acting. Drafting a public call for proposals does not carry the same risk as systematizing participant testimonies. Distinguish between levels and act accordingly.

Establish categories of data that will never be entered into AI systems. Participant identities, traditional knowledge without prior informed consent, contracts, data on minors, health data, confidential internal communications.

Read the privacy policy of every tool you use. Personal accounts typically offer less protection than team accounts or the API. You don’t need to be a technology expert: you need someone on the team to read the terms before using the tool with institutional information.

Obtain informed consent before involving third-party data. When we wanted to systematize artist proposals, we stopped: the call for applications had not disclosed that possibility. In the next one, we will add a specific consent clause.

Prioritize local tools for high-risk cases. There are open-source alternatives that process data directly on your own computer, without sending anything to external servers. We used Whisper to transcribe community meeting minutes: the audio never left the device.

Always maintain human oversight and decision-making. AI supports; it does not decide. No output is used to make decisions about people without review by someone identifiable and accountable.

Document every relevant use in an institutional log. Tool used, purpose, type of data involved, risk level, responsible person, and date. A shared spreadsheet with the right fields is sufficient. What is not optional is that it exists.

Define what your organization will do when something goes wrong. Stop the use, notify within 24 hours, document, assess the harm with the affected people, correct and update the protocol. Having this sequence in place before an incident occurs is not pessimism: it is institutional maturity.

Review, update, and share what you learn. Given the scarcity of resources for the nonprofit sector, sharing what we develop internally is an act of solidarity. We built our protocol because we could not find what we needed. We make it public so that other organizations do not have to start from scratch.

These ten principles are not abstract: each one responds to a concrete situation we face in our daily work with communities whose knowledge has historically been extracted without recognition or compensation. Civil society organizations working in these contexts are in a privileged position to demonstrate that it is possible to harness the potential of these tools without reproducing the extractive dynamics that have historically harmed the communities we work alongside.

The full protocol —including a risk classification matrix, protected data categories, decision flows, and concrete examples of application— is available upon request at xquenda.artes@gmail.com.