What is the board's role in AI governance at a nonprofit?

The board sets policy and oversees risk, while staff make and own operating decisions about AI tools. Kaykas-Wolff recommends a standing agenda item with a one-page tool inventory, a note of what changed since the last meeting, and a yes or no on whether any tool touched data about the people the organization serves.

Should the tech expert on a nonprofit board manage the organization's AI tools?

No. Kaykas-Wolff argues the tech trustee should advise in writing through the executive director, who keeps the decision. When a volunteer starts approving tools and configuring vendors by email, one person ends up doing both management's job and the board's oversight job with no minutes or delegation.

Does a nonprofit board need a separate AI committee?

Usually not. Kaykas-Wolff suggests placing AI oversight with whichever committee already owns risk, often audit or finance, because a volunteer board has little capacity to staff another committee.

What should a nonprofit AI policy say about approvals?

It should name the person allowed to approve a new AI tool, and that person should be a paid staff member rather than a volunteer trustee, so the decision and its record stay with the organization when board terms end.

Why is AI governance harder for nonprofits than for companies?

Small nonprofits often lack a CTO or IT lead who can push back, volunteer trustees rotate off and take their knowledge with them, and social services organizations hold sensitive data about people who never agreed to share it with an AI vendor.

AI Governance for Nonprofit Boards: The Tech Trustee Trap

AI governance for nonprofit boards has its own shelf of guidance now, mostly from accounting firms and board-portal vendors. The advice lands in roughly the same place. Put AI on the agenda, and judge every tool against the mission before you judge it against the budget.

I agree with nearly all of it. It skips the way I most expect a nonprofit board to get this wrong.

I have been a trustee of American Conservatory Theater in San Francisco since 2017, and I sit on the Board of Advisors for The Salvation Army San Francisco’s Way Out Initiative. My day job is CEO of Visiting Media, where I also run a fleet of AI agents across content and operations work. That combination makes me the person in a nonprofit boardroom who gets handed the AI question. It also makes me the person this article is warning about.

What the standard advice gets right

Mission before efficiency is the right first filter. A nonprofit that adopts AI to save hours in the development office, and in the process starts sending longtime donors letters that read as if nobody in particular wrote them, has saved some money and spent some trust, and trust is the asset a nonprofit can least afford to refinance.

Literacy matters. I would push it further than the usual “get familiar, not expert,” though. In AI literacy for board directors I argued that each director should supervise one real agent for a quarter, and that works for a nonprofit board with one adjustment: pick a task from the trustee’s own life, because the organization probably has no agents to lend out.

The guides are also right that AI belongs inside risk oversight with everything else the board already watches, especially anything that touches the privacy of donors and the people the organization serves.

All sensible. All written as if nobody on the board understands the technology.

How the tech trustee becomes the unpaid CTO

It starts politely. Staff at a small nonprofit are stretched thin, and the IT department is often one person who also handles the copier lease. The executive director hears that the board has someone from tech, and questions start arriving by email between meetings: first which chatbot is safe for grant drafts, then whether to switch on the new AI feature the CRM vendor just announced, then whether the trustee would mind reading a vendor contract before Friday.

Each ask is reasonable. The trustee says yes, because saying yes is why they joined.

Six months later a volunteer is making operating decisions outside any meeting, with no minutes and no delegation from the board, while the executive director remains the one held responsible for the result. The board believes it has AI oversight because a trustee is “on it.” In practice one person’s judgment is standing in for management and for governance at the same time.

Boards spend years keeping the person who approves the spending away from the person who audits it. AI can merge those two roles in a quarter, and nobody votes on it.

Why it hurts more at a nonprofit

Companies have the same failure available, and I described the advisory version in what a technology board advisor owes a CEO. A company usually has a CTO, or at least a head of IT, who will push back when a board member starts configuring things. The executive director of a small arts or social services organization often has nobody to play that part.

Terms end, too.

Volunteer trustees rotate off. Some move to Portland. When the tech trustee leaves, the reasons behind every decision they made over email leave with them, and the next executive director inherits a stack of AI subscriptions with no record of who approved them or what data they were allowed to see.

The data is heavier as well. A social services nonprofit holds information about people in some of the hardest weeks of their lives, and those people never agreed to share it with an AI vendor. That consent question deserves a board vote. It should not be settled in a reply-all.

Use the expertise without making them management

Keep the trustee. Change the channel their knowledge travels through.

Route every between-meetings AI question through the executive director, in writing. The trustee answers as an advisor the executive director is free to overrule, and the decision stays with staff, where someone is paid to own it.
Give the trustee a committee home instead of a personal portfolio. Usually that is whichever committee already owns risk, often audit or finance. I argued against a separate AI committee for companies, and a volunteer board has even less time to staff one.
Keep a one-page tool inventory that lives with staff and outlasts any trustee’s term. List each tool, who approved it and what data it touches. The amnesty approach from shadow AI agents scales down well here, and at a small nonprofit the likeliest surprise is a personal chatbot account holding notes about major donors.
Watch the hours. When a trustee’s AI help starts to look like a part-time job, the board should either pull them back to governance or budget for paid help.
Hold a ten-minute handover at the tech trustee’s last meeting covering what staff asked them and what they recommended.

The sentence your AI policy needs

Name the person allowed to say yes to a new AI tool, and make sure that person draws a paycheck from the organization.

What the full board should see

Very little. A nonprofit board meets a handful of times a year, and its agenda is already crowded with the audit and the gala. One standing item covers AI: the tool inventory with anything that changed since the last meeting marked, plus a plain yes or no on whether any tool touched data about the people the organization serves. Think of it as the AI page in the board pack scaled down to fit a volunteer’s evening.

Thresholds help if you keep them blunt. The method in an AI risk appetite statement a board can measure works at nonprofit scale with almost no changes: sort each use by whether a mistake can be undone, and require the executive director’s signature on anything that can’t. For the broader set of things a director should ask, start with what boards should ask about AI.

Before your next board meeting

Ask your tech trustee, kindly, to list every AI question staff sent them since the last meeting.

If the list is long, nobody did anything wrong. The board has simply found its governance gap, and the gap has a name and an email address.

This article is part of the Executive Leadership cluster, focused on board governance and the operating discipline required to run AI systems responsibly at the executive level.

AI Governance for Nonprofit Boards: Don’t Turn Your Tech Trustee Into the CTO