Artificial intelligence is no longer a future consideration for nonprofit organizations. It is already here. Employees are using AI to draft donor communications, summarize board packets, analyze financial data, assist with grant proposals, and streamline administrative work. In many organizations, AI adoption is happening organically, long before formal governance has been established.

That creates a significant challenge: if employees are already using AI, but the organization has not established policies, training requirements, and oversight mechanisms, who is managing the risks?

Many nonprofit employees have already begun experimenting with AI tools, often without formal guidance or training. Nonprofit-focused AI governance resources consistently warn that unmanaged AI usage can expose organizations to risks involving privacy, security, bias, accuracy, and regulatory compliance. Nonprofits are increasingly being encouraged to establish governance frameworks, policies, and staff training programs before AI adoption becomes widespread.

The reality is simple: a nonprofit would never allow employees to implement a new financial system, donor database, or cybersecurity platform without policies and training. AI should be treated no differently.

Unlike many businesses, nonprofits manage highly sensitive information while serving vulnerable populations and maintaining public trust. A nonprofit’s reputation is also one of its most valuable assets that has been built over the organization’s existence. A single inappropriate use of AI can damage donor confidence and stakeholder trust built over decades.

Internal nonprofit AI governance materials identify key risk areas including privacy, hallucinations, cybersecurity, misinformation, bias, legal compliance, and inappropriate use of sensitive information.

AI risks may include:

• Donor confidentiality concerns due to exposure of donor information
• Exposure of beneficiary or client information
• Inaccurate or fabricated AI-generated content
• Misinformation in grant applications or public communications
• Loss of public trust due inappropriate AI use
• Regulatory and legal concerns

An AI policy is not designed to discourage innovation but rather encourage usage and adoption while ensuring the nonprofit organization is reducing their risks.

A well-designed policy gives employees confidence to use AI appropriately while establishing clear boundaries and expectations.

At minimum, every nonprofit AI policy should address:

• Approved AI Tools – Employees should know which AI platforms are approved for organizational use and which are prohibited. Not all AI platforms offer the same security protections, privacy controls, or contractual safeguards and management should make sure tools are vetted to ensure protection.
• Data Protection Requirements – The policy should define what information can and cannot be entered into AI systems. Examples often include:

– Donor information (names, addresses, donation amounts)

– Personally identifiable information (PII) including social security number, full name, email address, or phone number

– Protected health information

– Human resource records

– Financial account information

– Confidential board materials

• Human Review Requirements – AI should assist decision-making, not replace it. Policies should clearly establish that employees remain accountable for reviewing and validating AI-generated work before it is distributed or relied upon.
• Transparency Expectations – Organizations should determine when AI-assisted content should be disclosed, documented, or reviewed by management.
• Incident Reporting Procedures – Employees need a clear process for reporting suspected misuse, data exposure, or AI-related errors.

Many organizations focus first on drafting a policy. While policies are essential, training is what ultimately changes behavior.

Without training, staff members often:

• Overestimate AI’s capabilities
• Underestimate its risks
• Trust outputs without verification
• Upload sensitive information without understanding privacy implications
• Use AI inefficiently

One of the most common governance failures is what some nonprofit AI leaders refer to as “Copilot creep” or similar technology adoption patterns: licenses are purchased and distributed broadly, but little practical training is provided. As a result, a few power users thrive while most employees either misuse the technology or fail to generate meaningful value from it.

Effective AI training should cover:

• Responsible AI principles
• Security and privacy requirements
• Prompt-writing best practices
• Verification and fact-checking
• Appropriate use cases
• Ethical considerations
• Organizational policies and procedures
• Escalation and reporting requirements

Many nonprofit leaders still view AI as a standalone tool however most nonprofit leaders may not realize they are already relying on these tools in the daily activities. Increasingly, AI is becoming embedded directly into the software systems organizations already use.

Microsoft Copilot, CRM platforms, grant management solutions, accounting software, fundraising systems, email platforms, and document management tools are rapidly incorporating AI capabilities. In many cases, employees may interact with AI without opening a separate AI application. Internal nonprofit AI governance materials note that organizations must increasingly focus on governing AI capabilities that are integrated into existing systems rather than treating AI as a separate technology initiative.

This creates several important considerations. Integrated AI frequently operates using existing system permissions.

If an employee can access a document, database, or SharePoint site, the AI may also be able to use that information to generate responses.

Organizations should review:

• Access controls
• Data classifications
• User permissions
• Information governance practices

Board oversight remains an important component of AI governance.

Key questions include:

• Do we have an AI policy?
• Are staff trained on responsible AI use?
• What AI tools are currently being used?
• How do we protect donor and beneficiary data?
• Who is responsible for AI oversight?
• How are AI incidents reported and investigated?
• How do we evaluate new AI vendors?
• How are we monitoring compliance with our policy?

These questions increasingly appear in nonprofit AI governance frameworks and board-level discussions as organizations move from experimentation to formal adoption.

The most successful nonprofits are not necessarily the organizations adopting the most AI.

They are the organizations adopting AI intentionally. A practical roadmap may look like this for a nonprofit looking to get started:

1. Inventory current AI usage.
2. Develop a written AI policy. Samples exist to facilitate for nonprofit leaders https://www.nten.org/learn/resource-hubs/artificial-intelligence
3. Establish approved AI tools.
4. Train employees and volunteers.
5. Review information security and data governance.
6. Create an AI oversight team or responsible leader.
7. Pilot low-risk use cases first.
8. Continuously evaluate and update governance practices.

AI is not fundamentally a technology project. It is a governance, risk management, and organizational change initiative that happens to involve technology. As nonprofit organizations increasingly leverage integrated AI capabilities within the platforms they already use, strong policies and ongoing training will become as important as cybersecurity policies, financial controls, and employee handbooks.

Organizations that establish those foundations now will be positioned to capture AI’s efficiency and mission impact while protecting the trust that makes their work possible.