What Nonprofit Leaders Need to Know About AI Governance

This summer I spent the better part of a month trying to give an AI agent read access to SharePoint. The technical work was not the hard part. We had the account provisioned, and the access permissions scoped quickly enough. What took a month was answering a question that had nothing to do with AI: which client folders should this agent be allowed to see? 

That required a conversation among key stakeholders. Some document libraries were off-limits given the sensitivity of the contents. Others were less clear. Operational considerations surfaced about when and if the AI agent would get access to new libraries, and about who decides. 

We are a technology consulting firm. We do this for a living. It took what felt like a lot of time, but the delay was intentional. This experience reinforced something I often tell nonprofit executives about AI governance. The organizations doing the best with AI are the ones that have been intentional about how decisions are made, who owns those decisions, and how technology fits into the broader mission.  

Most AI Risks Are Organizational Risks in Disguise 

When leaders think about what could go wrong with AI, they often have the technology in mind. Hallucinations. Bias. Data going somewhere it shouldn’t, and being used to train a vendor’s next release. 

Those are real concerns. But the failures I actually see are rarely about the technology. They are old organizational problems that AI exposes faster and at greater scale. 

Permissions are the clearest example. Most nonprofits have accumulated years of SharePoint, Google Drive, Box, or Dropbox sprawl (or all of the above!) where “everyone at the org” quietly has read access to more than anyone intended. Nobody noticed, because nobody was going to browse forty thousand files. Point an AI assistant at that same environment, and it will cheerfully surface a compensation spreadsheet in response to an innocent question. The AI didn’t create the exposure. It found it. 

We worked with one advocacy organization that wanted to deploy AI agents broadly. The blocker wasn’t technology or budget. Their permission structures couldn’t support it safely. The AI governance work turned out to be data hygiene work. 

I’ve also experienced well-meaning individuals using AI tools for analysis without thinking carefully about the privacy considerations. They may think it’s low risk, but how thoroughly have they considered it? Do they have a paid subscription? Does their subscription have consumer-grade or business-grade data privacy protections? That wasn’t really an AI risk. It was a judgment risk that AI simply created an opportunity to expose. 

If your organization has unclear data ownership or poor user account management practices, AI will find those gaps. Governance is mostly about closing them. 

A Policy Nobody Reads Isn’t a Policy

Some AI policies I encounter run many pages, use inaccessible language, and are functionally invisible. Staff may be introduced to them once and never think about them again. 

The most effective one I’ve seen at a nonprofit came down to about one sentence: only use the AI tool subscription that the organization provides. That organization’s IT team was small and couldn’t possibly vet the flood of new tools appearing every month. So they drew a bright line and moved on. 

That’s a policy someone can remember on a Tuesday afternoon. That’s an important test of a good policy, as well as good training on and communication about that policy. 

Tiering helps too. Much AI use is genuinely low-stakes: transcribing a meeting, tightening a draft, getting unstuck on a first paragraph, summarizing contents of a document or file library. If your policy requires review for all uses of AI, staff will route around you, and you’ll lose visibility into what’s actually happening. Reserve real scrutiny for the smaller set of uses that touch sensitive data about constituents, inform program decisions, or are shared publicly under your organization’s name. Then give people a fast, obvious way to identify a new use case and get an answer. If your intake process takes months, you’ve just built a process that will grow shadow AI. 

Humans in the Loop, But Not Everywhere

Not every use of AI carries the same level of risk. Using AI to organize personal notes is very different from using it to draft a major donor proposal, prepare a board report, or create content that represents the organization publicly. 

Rather than creating a blanket approval process for everything, leaders should align review requirements with organizational risk. The greater the potential impact of being wrong, the greater the expectation for review. 

This is particularly important for fundraising, marketing, grant writing, and executive communications, where accuracy and trust matter as much as efficiency. AI can accelerate work, but responsibility for the final output still belongs to people. 

Additionally, an AI inventory can be helpful in tracking the ways in which AI is used at your organization while clarifying where a human in the loop is truly needed, and who is responsible.  

Train the Staff, Not Just the Systems

Many AI initiatives focus heavily on technology deployment and not enough on staff development. That approach rarely delivers sustainable results.  

Effective AI adoption depends on employees understanding how to evaluate outputs, recognize limitations, verify information, protect sensitive data, and exercise sound judgment. Organizations that invest in those skills are often better positioned than those that simply provide access to more tools.  

Training should also be ongoing. AI platforms, capabilities, and organizational use cases are evolving quickly. Governance frameworks need enough flexibility to adapt without forcing the organization back to the drawing board every few months.  

The most successful organizations typically create a culture of shared learning where examples, lessons learned, prompts, and best practices can be discussed openly across departments. 

Someone Has to Own It

Governance without a name attached is a document. It needs an owner. Another reason governance efforts fail is that leaders try to design a perfect framework before taking action. In reality, AI governance is not about perfection. It is about ownership.  

Someone needs to own decisions. Someone needs to own policy reviews. Someone needs to own training. Someone needs to own the evaluation of new tools and the organization’s approach to managing risk.   

The specific structure will vary by organization, but successful nonprofits rarely leave these responsibilities undefined. They establish accountability early and refine the process over time.  

Without ownership, governance becomes everyone’s responsibility and no one’s responsibility at the same time. 

The Opportunity Ahead

AI will become a larger part of nonprofit operations over the coming years. It has the potential to help organizations work more efficiently, improve decision-making, reduce administrative burden, and create more capacity for mission-focused work. 

Realizing that potential will require more than selecting the right tools. It will require leadership teams to make thoughtful decisions about governance, accountability, training, privacy, and risk. 

The organizations that navigate this transition most successfully will not be those that move the fastest. They will be the organizations that create enough structure for AI to be used responsibly while remaining flexible enough to learn and adapt as the technology evolves. 

Governance is not what slows innovation. In many cases, it is what makes sustainable innovation possible.