What Should Nonprofits Know About AI, Sensitive Data, and Cyber Liability?

The First Question Is Not “Should We Use AI?”

For many organizations, that question may already be outdated.
A better question is:
“How are people using AI today, and do we understand the risk?”
That changes the conversation.
Instead of starting with:
“AI is banned.”
or:
“AI is the future, so everyone should use it.”
leadership can start with:

• What tools are employees using?
• What are they using them for?
• What information is being entered?
• Are organizational accounts being used?
• Are employees using personal accounts?
• Does the organization have any guidance?
• Who should employees ask when they are unsure?

That creates a much more useful starting point.

A Simple Rule Employees Can Remember

Long AI policies can be difficult to apply in the middle of a busy workday.
Employees need a simple decision point.
One useful rule is:
If you would hesitate to send the information to an unknown outside company, stop before putting it into an AI tool.
That is not a complete governance program.
But it can help employees recognize when they should ask before acting.
Another useful question is:
“Does the AI need the real information to help me?”
Often, it does not.
Instead of using:
“Write a thank-you letter to Mary Smith, who donated $10,000 and lives at…”
the employee may be able to ask:
“Draft a warm thank-you letter for a major donor who supported our education program.”
The employee can insert the appropriate details afterward.
The AI still provides value.
The sensitive information never had to leave the organization.

Question 1: What AI Tools Are People Already Using?

Before creating policy, understand reality.
Leadership may be surprised by how many tools employees have already tried.
AI features may appear inside:

• search tools
• writing platforms
• meeting applications
• office productivity suites
• donor systems
• design tools
• customer relationship platforms
• browsers
• mobile applications

The organization does not necessarily need to identify every AI feature immediately.
Start with the tools employees actively use for organizational work.
A simple staff survey can ask:

• Which AI tools do you use for work?
• What do you use them for?
• Do you use a work account or personal account?
• Have you ever entered organizational information?
• What tasks would you like AI to help with?

This turns governance into an informed discussion rather than a guessing exercise.

Question 3: Which AI Tools Are Approved?

Once the organization understands how AI is being used, leadership can decide which tools are appropriate for organizational work.
An approved tool does not necessarily mean:
“Everything can be uploaded.”
Approval should still depend on:

• the type of information involved
• the intended use
• account configuration
• organizational policies
• vendor terms
• security and privacy expectations

Employees should know the difference between:
an AI tool the organization allows
and
information the organization allows employees to enter into that tool.
Those are two separate decisions.

Question 4: Who Owns AI Governance?

AI should not become a responsibility that belongs to everyone and therefore belongs to no one.
Someone needs to coordinate the conversation.
Depending on the nonprofit, responsibility may involve:

• executive leadership
• IT
• cybersecurity
• legal counsel
• compliance
• HR
• finance
• program leadership
• the board

The owner does not need to be the organization’s “AI expert.”
The role is to make sure important questions are answered.
For example:

• What tools are approved?
• What information is restricted?
• Who reviews new AI tools?
• How are employees educated?
• What happens when someone has a question?
• When should the policy be updated?
• Which AI uses require leadership approval?

Clear ownership reduces confusion.

AI Can Affect All Four Areas of Cyber Liability

AI governance is not just a privacy issue.
It can affect the four Cyber Liability areas discussed throughout this Knowledge Center.

Operational Risk

Could employees become dependent on an AI tool that becomes unavailable or produces unreliable results?
Could an AI-generated error affect an important process?

Reputational Risk

Could inappropriate AI use damage donor, employee, constituent, funder, or community trust?
Could inaccurate AI-generated public content affect the organization’s reputation?

Regulatory Risk

Could sensitive or regulated information be handled in a way that conflicts with organizational responsibilities?

Legal Risk

Could AI use affect privacy, contracts, intellectual property, employment, confidentiality, or other legal responsibilities?
One AI use case may touch several categories at once.

AI Should Assist Judgment, Not Replace Accountability

AI can help employees:

• generate ideas
• draft language
• organize information
• summarize content
• identify patterns
• create first drafts

But someone still owns the decision.
If AI drafts:

• a donor communication
• a grant application
• an HR notice
• a policy
• financial commentary
• a board presentation

a responsible person should review the result.
Leadership should be careful with the assumption:
“The AI said it, so it must be correct.”
AI output should be treated as work that may require review, verification, and judgment.
The more important the decision, the more important human review becomes.

What Should a Nonprofit AI Policy Actually Cover?

An AI policy does not need to be 30 pages long to be useful.
At minimum, leadership should consider defining:

• approved tools
• prohibited tools, if applicable
• acceptable use
• restricted information
• sensitive data rules
• account requirements
• human review expectations
• employee responsibilities
• how to request approval
• how to report a concern
• who owns the policy
• when the policy will be reviewed

The policy should be written for employees, not just lawyers or technologists.
If staff cannot understand it, it will be difficult to follow.

A Realistic Nonprofit AI Governance Conversation

Imagine a nonprofit learns that several employees are using different AI tools.
Marketing uses one tool for social media.
Development uses another for fundraising copy.
Programs uses AI for document summaries.
An Executive Director uses a meeting assistant.
The organization could react by banning everything.
Or leadership could step back and ask:

• Which uses are helping us?
• Which involve sensitive information?
• Which tools should be approved?
• Which practices need boundaries?
• What education do employees need?

That conversation is much more productive.
It creates visibility without assuming that every AI use is dangerous.

AI Governance Should Become Part of Normal Governance

Eventually, AI should not feel like a completely separate category.
It belongs within the same disciplines already used for:

• data protection
• vendor risk
• employee education
• policy
• governance
• access
• Cyber Liability
• leadership accountability

That is a sign of maturity.
The question becomes less:
“What is our AI strategy?”
and more:
“How do we use AI responsibly as part of the way our organization already manages technology and risk?”