AI is already inside your organization, whether the board discussed it or not. In 2026, responsible governance means catching up fast and setting clear expectations.
Picture a board meeting where the ED proudly shares that staff “found efficiencies” using AI. A trustee nods like they understand. Another trustee asks, “Are we allowed to do that?” Someone jokes, “Don’t put us in the newspaper.”
That’s the board’s real fear, and it’s not irrational. AI introduces new risks around privacy, misinformation, bias, and reputation. The board’s job is not to pick the tools. It’s to make sure the organization is using technology in a way that protects mission, people, and trust.
If your board is waiting until “we have time,” here’s the tough love: you don’t have time. Trustees have legal and fiduciary duties, and AI is now part of the risk landscape those duties apply to.
1) The board’s AI role is oversight, not tinkering
I want trustees to hear this clearly: you do not need to become an AI expert. You do need to become AI literate.
BDO frames it well: management handles day-to-day implementation, while boards provide strategy, governance, and long-term oversight for responsible adoption.
That means boards should be asking:
- Where are we using AI today?
- What data touches those tools?
- What risks have we assessed and mitigated?
- What policies govern staff behavior?
- What’s our incident plan if something goes wrong?
2) Your fiduciary duties apply to AI, even if AI feels “new”
BoardSource is explicit about the legal duties of care, loyalty, and obedience. These aren’t abstract concepts. They show up in how you govern new risks and opportunities.
Duty of care: Are we informed? Are we paying attention?
Duty of loyalty: Are we protecting the organization and its stakeholders?
Duty of obedience: Are we staying aligned to mission and values?
If the organization is using AI without a nonprofit board AI policy, you may be relying on individual staff judgment in ways that create unnecessary exposure.
3) Why boards need an AI policy now (even a simple one)
The sector is adopting AI quickly. Salesforce’s 2025 Nonprofit Trends report notes that AI adoption is surging, with many nonprofits piloting or already using AI in day-to-day work, while data security and privacy remain top concerns.
CEP found similar patterns across foundations and nonprofits: widespread use, widespread concern, especially around security, accuracy, expertise, and bias.
A nonprofit board AI policy does three things:
- Sets boundaries so staff can move without guessing
- Protects client and donor trust
- Creates accountability and auditability
4) What should be in a nonprofit board AI policy
You do not need a 30-page document. You need clarity.
At the board level, I recommend policies that cover:
- Purpose and values: why we use AI and what we will not compromise
- Risk categories: privacy, bias, security, reputation, legal/compliance
- Data governance: what data may never be used; approvals for exceptions
- Human accountability: who signs off on external content and high-impact uses
- Vendor and tool oversight: criteria for adopting tools, including security review
- Transparency: what you will disclose to stakeholders and when
- Incident response: what happens if an AI-related issue occurs
If you want a deeper risk structure to borrow from, NIST’s AI RMF provides a solid vocabulary for mapping risks and controls.
5) The board agenda you should add this quarter
If you want a practical move that improves governance immediately, put this on the agenda:
“AI Use + Risk Review” (30 minutes)
- What AI tools are staff using today?
- What tasks are they used for (communications, reporting, operations)?
- What data touches them?
- What are the top 3 risks and current mitigations?
- What policy changes are needed?
BDO also highlights AI risk areas nonprofits should take seriously, including data security and the need for board-level oversight and policy updates.
6) What “good” looks like in 2026
A well-governed nonprofit doesn’t ban AI out of fear. It doesn’t adopt it out of hype. It builds capacity and protects trust at the same time.
“Good” looks like:
- A clear policy and training expectations
- A known owner for AI governance
- Regular board visibility into AI use cases
- Incident readiness
- A culture that rewards transparency over pretending everything is fine
TAKE ACTION
- Ask for an “AI inventory” report from management within 30 days.
- Add “AI risk and policy” as a standing quarterly board agenda item.
- Approve a simple nonprofit board AI policy (1–3 pages) this quarter.
- Require that sensitive data categories are explicitly off-limits.
- Define which communications require executive review before sending.
- Establish a vendor review checklist for new tools (privacy, security, retention).
- Decide what stakeholder transparency will look like in your context.
- Train trustees on AI basics and governance responsibilities.
Support your board’s resolve
Boards don’t need more meetings. They need better questions and clearer agreements. If you want support training your board on AI governance and building a nonprofit board AI policy that matches your mission and risk profile, that’s exactly the kind of governance work we do through ResolvED at C&A: Social Impact Consulting. The AI & Data Guardrails Playbook is a practical tool built for nonprofit leaders who want momentum without fear. It gives you a clear, lightweight way to decide what AI is appropriate for, what must stay human, and what data should never touch a generative tool unless vetted. It also includes a mini-assessment of a nonprofit digital transformation roadmap so small teams can prioritize the right workflow fixes before buying more tools.
And if you want an easy on-ramp, C&A’s free “10 Things Every Board Member Should Know” is a good refresher on what responsible governance actually looks like, before you layer in AI oversight.
Recommended Resources
Books
- The Age of AI: And Our Human Future by Henry Kissinger, Eric Schmidt, Daniel Huttenlocher
- Weapons of Math Destruction: How Big Data Increases Inequality and Threatens Democracy by Cathy O’Neil
- The Advantage: Why Organizational Health Trumps Everything Else in Business by Patrick Lencioni
- Team of Teams: New Rules of Engagement for a Complex World by Stanley McChrystal)
Listen/Watch (include TED/TEDx)
- TED Talk: “Why AI Is Our Ultimate Test and Greatest Invitation” (Tristan Harris)
- Microsoft Work Trend Index 2025 (useful for understanding org adoption patterns)
Articles/Reports
- BoardSource: Legal duties of nonprofit board members
- BDO: The board’s role in nonprofit AI implementation
- CEP: AI With Purpose
- NIST: AI Risk Management Framework
Frequently Asked Questions
1) What should a nonprofit board AI policy include?
A nonprofit board AI policy should define acceptable use, banned data categories, human review requirements, vendor approval standards, and how AI risks will be monitored. It should also clarify accountability and incident response so staff are not guessing.
2) Do trustees need to understand AI tools to govern well?
Trustees do not need deep technical expertise, but they do need AI literacy. Boards should understand where AI is used, what data is involved, and what risks and controls are in place.
3) What is the board’s role in AI implementation?
The board’s role is oversight: aligning AI adoption with mission and values, ensuring risk management, and approving policies that protect stakeholders and trust. Management selects tools and runs day-to-day execution.
4) Should nonprofits disclose when they use AI?
When AI materially shapes public-facing communications or stakeholder decisions, transparency helps protect trust. Disclosure expectations should be defined in policy, so teams act consistently.
If your board needs practical governance training on AI, plus a clean nonprofit board AI policy your trustees will actually understand, connect with C&A: Social Impact Consulting, and we’ll build it with you.
