Key takeaways
- No law requires a nonprofit AI policy or board approval of one.
- California Corporations Code section 5231 requires nonprofit directors to act with the care, including reasonable inquiry, of an ordinarily prudent person.
- California's reasonable security statute reaches organizations whether or not they operate at a profit.
- A board-ready policy has eight short sections, ending with an annual review and report to the board.
- Each policy rule should map to a control, such as multifactor authentication, data loss prevention or new-app alerts.
Your staff and volunteers are probably already using AI to draft grant narratives, donor letters and program reports. A one-page nonprofit AI policy gives the board something it can approve and oversee, and gives staff a clear rule for donor, client and funder information.
Does a nonprofit board have to approve an AI policy?
No law requires a nonprofit to adopt an AI policy or to have its board approve one. The reason to take it to the board is the board's own duty of care. In California, Corporations Code section 5231 requires a public benefit corporation director to act in good faith, in the best interests of the corporation, and with the care, including reasonable inquiry, that an ordinarily prudent person in a like position would use.
Grant narratives, case summaries and donor letters drafted with AI can each move donor, client or funder information into a vendor's system. An approved policy is the board's record that it asked how that information is handled and set a standard for it. Section 5231 also lets directors rely in good faith on information and reports from officers and employees, which is why the policy should come with a short report from the executive director on how it is being followed.
There is a security angle as well. Most nonprofits fall outside the CCPA, because the CCPA's definition of a business covers entities operated for the profit or financial benefit of their owners. California's separate reasonable security statute is broader. Civil Code section 1798.81.5 requires a business that owns, licenses or maintains personal information about California residents to maintain reasonable security, and section 1798.80(a) defines a business to include organizations whether or not they operate at a profit. An AI tool that holds client or donor records is part of that security picture.
What should a nonprofit AI policy include?
A nonprofit AI policy should include eight short sections, each stating a decision the board can approve. The procedures (how a tool gets approved, how alerts are handled) live in staff documents the policy points to:
- Purpose and scope: the policy applies to staff, volunteers, interns and contractors who use AI for the organization's work, on any device.
- Approved tools: name the AI tools the organization has approved and the account type for each. Anything not on the list needs approval first.
- Organization accounts only: AI used for the organization's work runs on organization accounts with multifactor authentication, never personal sign-ups.
- Data that never goes into AI: Social Security numbers, bank and card numbers, health information, client case notes, and anything a funder, court or contract says is confidential.
- Human review: a named person reviews AI output before it reaches a donor, client, funder or the public.
- Approval path: one named staff role approves new tools, using a short approval checklist, and keeps a register of decisions.
- Incidents: anyone who puts restricted data into an AI tool reports it the same day to a named contact, with no penalty for prompt reporting.
- Review: the board reviews the policy every year and receives a short report on how it is working.
That last section turns the policy from a document into an oversight routine. The board approves the standard once, then sees evidence each year that it is being met.
Which data rules matter most for a nonprofit?
The data list matters more than any other line, because it is the rule staff will face every day. Write it in categories people recognize. "Client case notes" is clearer to a program coordinator than "sensitive personal information."
Start with what your organization actually holds. A social service agency may hold case notes, intake forms and benefits information. A foundation may hold grantee financials. A membership organization may hold dues and payment records. Then add anything restricted by an outside promise: grant agreements, data sharing agreements, donor privacy statements and court orders. If your donor privacy statement says you never share donor information with third parties, the policy should keep donor records out of any AI tool that has not been reviewed against that promise.
How does the board know the policy is being followed?
The board knows because the policy names controls, and the controls produce reports. A policy that relies only on staff memory gives the board nothing to review. Each rule on the page should map to something the organization can check (the same approach behind an AI acceptable use policy your tools can enforce):
- Approved tools and organization accounts map to single sign-on and multifactor authentication for each approved tool, and to alerts when someone signs up for a new AI service with an organization email address.
- The data list maps to data loss prevention rules that warn or block when restricted data is pasted or uploaded into an unapproved AI site.
- Unapproved tools map to web filtering for unreviewed AI sites on organization devices.
Two free frameworks help here. The CIS Controls v8.1 AI and LLM Companion Guide states that many CIS Safeguards map directly to AI systems, including asset management, identity, logging and supplier governance. The NIST Generative AI Profile lists data privacy and information security among the risks generative AI creates or makes worse. Neither is required of a nonprofit, but both give the board a reference point that is more credible than a policy invented from scratch.
What should go to the board for approval?
The board packet should be short enough to read before the meeting. Three items cover it:
- The one-page policy itself.
- A one-paragraph summary from the executive director: which AI tools staff use today, which are approved, and what changes the policy makes.
- A list of the controls that will support each rule, with a date by which each will be in place.
The board approves the policy, records the approval in the minutes, and sets the date for the first annual report. Many boards hand the detailed review to a finance, audit or risk committee, which then reports to the full board. Either approach gives the board a documented record of its inquiry.
How can a nonprofit get an AI policy approved this quarter?
A nonprofit can go from no policy to a board-approved one in a single board cycle by following five steps.
- List the AI tools in use now. Ask staff and volunteers directly, and check sign-in records for AI services connected to organization accounts.
- Pick one approved tool for general use, on organization accounts, and turn on multifactor authentication.
- Draft the data list from the records your programs actually hold and the promises in your grant agreements and donor privacy statement.
- Draft the one-page policy using the eight sections above and send it to the committee or board with the summary and control list.
- After approval, tell staff and volunteers what changed and where to ask questions. Put the annual review on the board calendar.
How can s90 help?
s90 works with Southern California nonprofits to put the controls behind an AI policy in place: approved AI accounts with multifactor authentication, alerts when someone signs up for a new AI tool, and data loss prevention rules that keep client and donor records out of unapproved sites. We can also produce the evidence your board reviews each year. If you would like a second look at a draft policy, we are happy to talk.
