Is Your Board Ready for the Risks of Nonprofit AI?

Artificial intelligence is already entering nonprofit operations through fundraising, communications, research, administration and employee experimentation.

The board may never approve a formal AI project, yet staff can still paste donor information into public tools, generate client-facing material, summarize confidential meetings or rely on automated recommendations.

That makes AI governance a board issue before it becomes a technology project.

Nonprofit board members are responsible for overseeing ethical policies, organizational risk, financial stewardship and long-term sustainability. They do not need to understand every technical detail, but they must ensure leadership has established appropriate controls.

The Board Cannot Delegate the Entire Question

Technology decisions are often left to staff or outside consultants. That may be reasonable for software configuration, but not for decisions involving:

• Confidential client information
• Donor and financial data
• Employment decisions
• Public communications
• Program eligibility
• Legal or compliance obligations
• Reputational risk
• Automated decision-making

These are governance questions because they affect the mission, the people served and the organization’s exposure.

The board should not select individual AI tools. It should establish expectations for how tools are evaluated, approved and monitored.

Start by Finding the AI Already in Use

The first board question should not be, “Should we adopt AI?”

It should be, “Where are we already using it?”

Employees may be using free or personal accounts without informing leadership. Contractors may be generating content through AI-enabled platforms. Existing software may have quietly introduced automated features.

Leadership should provide the board with an inventory covering:

• Tools currently used
• Departments using them
• Information entered into them
• Decisions they support
• Human-review requirements
• Vendors storing organizational data
• Known incidents or concerns

Without this inventory, the board is governing assumptions rather than reality.

Require a Practical AI Policy

An AI policy does not need to be a lengthy legal document. It needs to answer operational questions employees actually face.

At minimum, it should define:

• Which tools are approved
• What information may never enter public AI systems
• Which outputs require human verification
• Which decisions cannot be delegated to AI
• Who approves new use cases
• How errors or disclosures are reported
• When clients, donors or the public should be informed

The NIST AI Risk Management Framework recommends treating governance as a continuous part of AI risk management rather than a one-time review.

Demand Evidence, Not Demonstrations

AI tools often perform well during carefully selected demonstrations. Boards should ask how systems behave when information is incomplete, outdated, contradictory or restricted.

Before approving a significant use case, require leadership to identify:

• The business problem being addressed
• The authoritative information sources
• The accountable owner
• The people affected by errors
• The escalation process
• The test results
• The measurable expected benefit
• The conditions that would stop the project

High-impact systems deserve more oversight than tools used for brainstorming or routine drafting.

Protect Organizational Knowledge

Board oversight should also address where the organization’s knowledge resides.

Policies, grant requirements, leadership decisions and operating procedures are often scattered across email, personal folders and employee memory. That creates continuity risk regardless of whether AI is involved.

A governed assistant such as Maisy can help authorized staff retrieve approved information while respecting existing permissions. The larger value is creating a controlled system that helps the nonprofit retain institutional knowledge when employees or board members leave.

The board should ask whether information has an owner, an authoritative version, appropriate security and a review date. An AI assistant connected to unreliable material will produce unreliable answers faster.

Oversight Does Not Mean Blocking Innovation

The board’s job is not to prevent every mistake or approve every experiment. It is to establish the boundaries within which responsible experimentation can happen.

A useful reporting cadence may include approved tools, active pilots, incidents, adoption levels, measurable benefits and unresolved risks. The board can then focus on mission impact and accountability rather than technical details.

Nonprofits that govern AI well will not necessarily use less of it. They will use it more deliberately.

The goal is to protect trust, improve operations and retain institutional knowledge without allowing convenience to outrun responsibility.