12 questions your nonprofit or charity board should ask about AI
By Ben Serunyigo, co-founder of Nimara · Updated October 2026
Sooner or later, someone at your board table will ask, "Are we using AI?" If you're the executive director or chief executive, you may not know the full answer yet, and if you're on the board, you may not know what to ask next. This guide gives you both: the questions, and what a good answer sounds like.
Your board doesn't need to understand how AI works, but it does need to ask good questions and approve a few clear rules. Start by asking whether you're using AI now and where, who is in charge, what information never goes into it, who checks the work, and what has gone wrong so far. Then approve a short AI policy, name an AI lead, and ask three questions at every quarterly meeting.
We built the kit on Canadian privacy law, so ask someone to check its legal notes against the rules where you are.
- 1Why AI is a board question
- 2The 12 questions
- 3What the board should approve
- 4Three questions every quarter
- 5What's changing in the US and UK
- 6Reading for your board
Why AI is a board question
It's tempting to treat AI as a staff tool, like a new printer. But AI touches the things your board is responsible for: the trust of the people you serve, their private information, your reputation and your money.
Around the world
A 2026 survey of nonprofit staff and leaders in the US and around the world shows why boards need to pay attention:
Source: NTEN and The Bridgespan Group, State of Nonprofit AI Adoption and Governance, September 2026, 917 nonprofit staff and executives in the US and around the world.
Board members and trustees already have a duty to act with care, and the rules behind that duty depend on where you are.
If you're in the US
Under most state nonprofit laws, board members have three duties: care, loyalty and obedience. BoardSource describes the duty of care as "the care that an ordinarily prudent person would exercise in a similar position". When staff start using AI, keeping an eye on it becomes part of that duty.
Here's what a 2025 survey of US nonprofit leaders found:
Source: Center for Effective Philanthropy, AI With Purpose, September 2025, 451 nonprofit leaders.
If you're in the UK
The Charity Commission's guide The essential trustee (CC3) lists six duties, including to "act with reasonable care and skill" and "manage your charity's resources responsibly". CC3 covers England and Wales and doesn't mention AI, but in 2024 the Commission said that "trustees remain responsible for decision making" when a charity uses AI (Charity Commission blog). Charities in Scotland and Northern Ireland have their own regulators, OSCR and CCNI, so check their guidance too.
Here's where UK charities are today:
Source: Zoe Amar Digital, Charity Digital Skills Report 2026, July 2026, 807 respondents, as reported by Civil Society.
Taken together, the numbers show that most organizations already use AI, while many have no written rules and plenty of boards don't feel ready to oversee it. AI may also be helping prepare your board papers or summarize your minutes, so these questions are for the board itself, too.
The 12 questions
You don't need to ask all twelve at once, so pick the three that worry you most for your next meeting. For each one, here's what a good answer sounds like and what should make you ask more.
Where we are today1Are we using AI now, and where?
Include the AI built into tools you already pay for, like your email, donor database or design software because staff often don't think of those as "using AI".
2Who is in charge of it?
One named person should own AI day to day. They don't need to be technical, but they do need time and the authority to say no.
3Do we have written rules, and who approved them?
You're looking for a short AI policy, approved by the executive director or the board, with a date for the next review.
4What information goes into AI tools, and what never does?
This is the most important rule in any policy. Anything about a person, whether it's the people you serve, donors or staff, should stay out of AI chat tools.
5Could AI ever decide who gets help, money or a job?
AI can sort, summarize and flag, but a person should make every decision about a person.
6Do we tell people when AI helped?
Donors, funders and the people you serve trust you more when you're open about how you use AI.
7Where does our data go?
Ask where each tool stores your data, whether the company uses it to train its AI, and who can see it. Our vendor questions guide lists what to ask.
8What does it cost, and what are we getting?
The cost is more than the subscription because staff time, training and checking the work all count.
9Can we switch it off, or leave?
Every tool and automation should have an owner and an off switch, and you should be able to take your data with you when you leave.
10What's gone wrong so far, and what did we change?
Something will go wrong at some point, and a healthy answer is honest and specific about it.
11If private information leaked, who would we tell, and how fast?
Privacy laws may require you to report some breaches, so your plan should already say who decides and who gets told.
12Are staff trained, and how do they feel about it?
Some staff love AI and some worry about their jobs, and both groups need to be heard.
What the board should approve
After the questions, your board needs to make a few decisions, and you can make all of them in one meeting.
- The AI policy. Short and in plain language. Our guide to writing one walks you through it.
- The AI lead. A name and a role.
- Your red lines. Things you will never do. For example: put personal information into AI chat tools, let AI decide alone who gets help, or send anything AI made without a person approving it.
- How much risk you're comfortable with. Pick one level, so staff know how far they can go without asking.
- A review date. Six months from now is a good start.
Here's wording you can use in your minutes:
Three questions every quarter
Once the policy is in place, keep the check-in short because your AI lead can answer these three in about five minutes at each board meeting:
- What's new? Which AI tools or automations did we add, and who approved them?
- What went wrong? Any mistakes, complaints or near misses? What did we change?
- Are people OK? Are staff comfortable, and have the people we serve raised any concerns?
Once a year, ask for a one-page AI report that covers the tools you use, any incidents, the training done, concerns raised and changes to the policy.
If your board uses AI itself
Board work is often the most confidential work you do, so agree on a few rules for the board, too:
- AI note-takers. Ask everyone first, and don't use them for closed sessions or when you discuss people, money problems or legal matters.
- Board papers. Don't paste confidential board papers into free AI tools to summarize them.
- Minutes. If AI drafts them, a person checks them, and the board approves them as usual.
What's changing in the US and UK
Neither country has an AI law written for nonprofits or charities, but privacy, equality and other existing laws already apply to how you use AI. Here are the changes worth a line in your board's risk register.
If you're in the US
- No federal AI law yet. Congress hasn't passed one, and a December 2025 executive order set out to challenge state AI laws, so expect the rules to keep shifting (Wilson Center).
- State privacy laws. Privacy laws in Colorado, Oregon, Delaware, Minnesota and Maryland cover many nonprofits. Some only apply once you hold data on a set number of people, and in Oregon the main threshold is 100,000, so check which laws reach you (Oregon Department of Justice, Wagenmaker & Oberly).
- Automated decisions in Colorado. Colorado has passed a law on automated decisions about things like jobs, housing, health care and education, due to start in 2027. It has already been delayed and is in court, so watch it rather than plan around a date (Holland & Knight).
- Hiring. New York City requires a bias audit and a notice to candidates when employers use automated hiring tools (New York State Comptroller). California's civil rights rules have covered automated decision systems in employment since October 1, 2025 (Paul Hastings), and federal anti-discrimination laws still apply anywhere AI helps make a hiring decision (Cooley).
- A yardstick. The NIST AI Risk Management Framework and its Generative AI Profile are free and voluntary, and the profile lists 12 risks your AI lead can check against (NIST). ISO/IEC 42001 is the international standard for managing AI, and organizations can be certified against it.
If you're in the UK
- No AI law yet. The UK still has no comprehensive AI law, so UK GDPR, the Data Protection Act 2018 and the Equality Act 2010 are the rules that apply (Lewis Silkin).
- Automated decisions. Since February 5, 2026, the law allows more decisions with a significant effect on someone to be made only by computer, as long as people are told, can challenge the decision and can ask for a person to step in (GOV.UK).
- A policy for AI. The voluntary Charity Governance Code, updated in 2025, now suggests charities have a policy for using technology and AI tools (Trowers & Hamlins). The Fundraising Regulator's December 2025 guidance says charities should publish an AI policy for fundraising and make it clear to donors when content or chatbots use AI (Civil Society).
- Hiring. The Equality Act 2010 applies to AI hiring tools, and the government has published a Responsible AI in Recruitment guide with the ICO and the Equality and Human Rights Commission.
- Free training. Every adult in the UK can take free AI courses through the government's AI Skills Hub, which makes a simple shared starting point for trustees (GOV.UK).
- A yardstick. The National Cyber Security Centre's AI and cyber security guide is written for boards and senior managers, and ISO/IEC 42001, published in the UK as BS ISO/IEC 42001, is the international standard for managing AI.
Reading for your board
If your board wants to go deeper, start here:
- Global · NTEN and Bridgespan · September 2026State of Nonprofit AI Adoption and Governance →
How nonprofits in the US and around the world use and govern AI, including how many have written rules, which makes it a good benchmark for your own organization.
- UK · Zoe Amar Digital · July 2026Charity Digital Skills Report 2026 →
How UK charities use AI, with figures on board skills and AI policies.
- UK · Charity Commission · April 2024Charities and artificial intelligence →
The regulator's view for charities in England and Wales, including why trustees stay responsible for decisions.
- US · BoardSourceLegal duties of nonprofit board members →
A plain explanation of the duties of care, loyalty and obedience.
- US · NIST · January 2023AI Risk Management Framework →
A free, voluntary framework for managing AI risk, with a separate profile for generative AI tools.
- UK · National Cyber Security Centre · February 2024AI and cyber security: what you need to know →
Short guidance for boards and senior managers on the security questions AI raises.
- Nimara · free guideHow to write an AI policy for your nonprofit or charity →
The six questions your policy must answer, and how to write it in one meeting.
Questions people ask
Should AI be on our board agenda?
Yes, as a short standing item once you have a policy. Each quarter your AI lead answers three questions about what's new, what went wrong and whether people are OK, and it takes about five minutes.
Does our board need an AI expert?
No, your board needs curiosity and good questions more than technical skills, and if no one on the board feels confident, a shared free course or a short briefing is enough to start.
How often should the board review our AI policy?
Every six months while you're actively using AI, and at least once a year. AI tools change quickly, so the tool list and rules need regular updates.
Who should be our AI lead?
Someone with time, good judgment and the authority to say no, and it doesn't have to be a technical person. In a small organization, it's often the executive director, the chief executive or an operations lead.
Can our board use AI to take minutes?
It can, as long as you ask everyone first, don't use it for closed or sensitive discussions, have a person check the draft and approve the minutes as usual.
Is the board responsible if AI makes a mistake?
Board members and trustees have a duty to act with care, and AI is now part of the risks they oversee. In the UK, the Charity Commission has said trustees remain responsible for decisions when AI is used. A written policy, a named AI lead and regular reports show the board took reasonable steps. This is general information, not legal advice.
Bring this to your next board meeting.
Our free AI Policy Kit includes a two-page Board Brief with the red lines, the three risk levels, the quarterly questions and a ready motion, plus the policy itself. We built the kit on Canadian privacy law, so check its legal notes against the rules where you are.
Get the free kit →See AI Strategy & Readiness
Want someone to walk your board through it? We help nonprofits and charities set their AI rules and plan what to try first, now or when they're ready. Book a Call →
The board doesn't need to know how AI works. It needs to know who's in charge.
Updated October 2026. This guide is general information, not legal advice. Written with AI assistance and reviewed by a person.
