A new AI tool crosses your desk every week now. A volunteer found one that transcribes counseling sessions. A staff member wants to use an app that writes kids' curriculum. Someone forwarded a tool that promises to manage your entire member database with AI. Each one sounds helpful, and each one is asking, implicitly, for access to your church's information and your congregation's trust.

Most churches vet these tools by feel, checking whether the app looks legitimate and whether someone they know recommended it. Those signals help a little. They still miss most of the real danger, because the risks with AI tools are the ones you cannot see at a glance. The polished app with the friendly logo might be training on everything you feed it, storing your data somewhere you would never approve, or one funding round away from disappearing with your information.

You can vet a tool well without becoming a security expert. What it takes is a simple, repeatable way to check a tool before you trust it with real church data. Here is a practical vetting process, and a prompt that does most of the work.

The Four Questions That Matter Most

Vetting an AI tool for a church comes down to four questions. Answer these and you have caught the great majority of the risk.

1. What does it do with your data? This is the big one. When you put information into this tool, where does it go, who can see it, and is it used to train the company's models? A tool that trains on your inputs means your counseling notes or member data could surface in ways you cannot control. You want tools that clearly state they do not train on your data and that let you control what is stored.

2. Is the company trustworthy and stable? Who makes this tool? Are they established or a two-month-old startup? Do they have a real privacy policy and real support, or a slick landing page and nothing behind it? You are adopting software and trusting a company with your church's information, possibly for years.

3. Does it actually fit the job, safely? Is this the right tool for what you need, and is the task itself appropriate for AI at all? Some jobs, like transcribing confidential pastoral conversations, may be ones no AI tool should touch, no matter how good it is. Fit covers more than "does it work." It also asks "should we do this with a tool at all."

4. What does it cost, really? Beyond the sticker price: what is the true cost in time to set up, in training your team, in the risk if it fails or shuts down? A free tool that mishandles your data is the most expensive option on the table.

Why "It Looks Fine" Is Not Enough

The reason casual vetting fails is that the biggest risks are invisible on the surface. A data policy that trains on your inputs looks identical, in the app, to one that does not. A company about to go under has the same friendly interface as one that will be around in five years. The dangerous stuff is in the fine print, the privacy policy, and the business model, exactly the places nobody reads.

That is the good news. The risks live in documents, and reading dense documents quickly is something AI does well. You can have AI do the tedious first pass on a tool's own fine print, then make the human judgment call with the facts in front of you.

The Tool-Vetting Prompt

This prompt turns AI into a careful, skeptical reviewer that reads a tool's public information and reports back what a church actually needs to know. You give it the tool and, ideally, paste in the tool's privacy policy or data-handling page. Fill in the brackets.

You are a careful, skeptical technology advisor helping a church decide
whether it is safe to use a specific AI tool. You care about protecting the
congregation's privacy and trust above convenience or hype. Be honest about
what you can and cannot determine, and never reassure me without evidence.

THE TOOL WE'RE CONSIDERING:
- Name and website: [ ]
- What we want to use it for: [ ]
- The kind of information we'd put into it: [be specific, e.g. "general
announcements" vs "prayer requests and member names" vs "counseling
notes"]

If I paste the tool's privacy policy or data page below, base your answer on
it. If I don't, tell me exactly what to go find and paste in.
[PASTE PRIVACY POLICY / DATA-HANDLING PAGE HERE IF AVAILABLE]

Give me a vetting report with these sections:

1. DATA HANDLING (most important)
Based on the evidence: Does this tool train on or reuse the data we put
in? Where is data stored, and can we delete it? What can we NOT determine
from what's available? Flag anything concerning in plain language.

2. COMPANY TRUST & STABILITY
What can we tell about who makes this, how established they are, and
whether they offer real support and a real privacy policy? Note red flags
like no clear company info or a missing privacy policy.

3. FIT & APPROPRIATENESS
Given the kind of information we'd put in, is this an appropriate use of
an AI tool at all? Specifically flag if we're about to feed it sensitive
pastoral, personal, or financial data that should not go into a tool like
this.

4. TRUE COST
Beyond the price: setup effort, training, and the risk if it fails or
shuts down.

5. BOTTOM LINE
A clear recommendation: SAFE TO USE AS DESCRIBED, USE ONLY WITH LIMITS
(state them), or DO NOT USE FOR THIS. Give one honest sentence of
reasoning.

RULES:
- Do not reassure me about anything the evidence doesn't support. Say "I
can't determine this from what's available" when that's true.
- Treat sensitive data (care, counseling, giving, kids, personal info) with
the highest caution.
- Plain language, no hype. Do NOT use em dashes.

Run this and you get a structured, skeptical first read in minutes, saving the afternoon you would spend squinting at legal pages. Notice what the prompt refuses to do: it will not reassure you about things the evidence does not support. That honesty is the point. A vetting process that always says "looks fine" is worthless.

Turning This Into a Simple Church Habit

Make vetting a normal, routine step in how you adopt tools. A few practices keep it lightweight.

Set a simple rule that any new AI tool touching real church data gets a quick vetting before adoption, no exceptions, especially for volunteers who might otherwise sign up for something on their own. Keep a short running list of tools you have vetted and approved, so people have a safe menu to choose from and no reason to go hunting. Match the scrutiny to the stakes: a tool for drafting public announcements needs a light check, while anything near care, giving, or kids' data needs the full report and probably a "no" more often than a "yes." And re-check your approved tools once a year, because their data policies and their companies can change.

The goal is to make it possible to say yes to good tools with confidence, because you know how to catch the bad ones. A church that can spot the bad ones moves faster and worries less.

Vetting Fits Inside a Bigger Framework

Vetting individual tools is one piece of governing AI well. It works best inside a broader church AI policy that also defines who can approve tools, what data is off-limits, and how your church makes these decisions consistently, sparing you the anxious case-by-case guessing. Building that policy, tailored to your church's theology and culture, is exactly what AI Policies Made Simple walks you through, with templates and Canva designs so you end up with clear, usable guidance your team will actually read. A tool-vetting habit and a written policy reinforce each other: the policy sets the standard, and vetting applies it.

For the wider set of questions every church should be asking as it adopts these tools, Church Tech Today's overview of AI governance questions for church leaders is a useful companion.

Every week brings a new tool promising to help. Some of them will. A simple, repeatable vetting habit is how you welcome the good ones without handing your congregation's trust to the wrong one.

Frequently Asked Questions About Vetting AI Tools for Church

How do I know if an AI tool is safe for my church to use? Check four things: what the tool does with your data (especially whether it trains on your inputs), whether the company behind it is trustworthy and stable, whether the tool is an appropriate fit for the task and data involved, and the true cost including risk. Most of the real risk lives in the privacy policy and business model, well beneath the interface, so read those before you trust it.

What is the biggest risk with church AI tools? Data handling. A tool that trains on or improperly stores what you feed it can expose sensitive information like counseling notes, member data, or giving records in ways you cannot control. Because a risky data policy looks identical to a safe one inside the app, you have to check the fine print and judge by what it says.

Should churches put counseling notes or member data into AI tools? Be extremely cautious. Highly sensitive pastoral, personal, and financial information often should not go into AI tools at all, regardless of how capable they are. Before using any tool for such data, confirm exactly how it is stored and whether it is used for training, and default to not doing it unless the tool clearly meets a high standard and your policy allows it.

Can AI help me evaluate an AI tool? Yes. Since the key risks live in dense documents like privacy policies, you can have AI do a skeptical first-pass read of a tool's own fine print and report what a church needs to know, as long as you instruct it not to reassure you beyond the evidence. You still make the final judgment, but AI removes most of the tedious work of vetting.