AI Governance Is Now a Fiduciary Responsibility. Is Your Board Ready?

AI Governance   By Lisa Roberts   September 24, 2026

Most nonprofit leaders who adopt AI tools do so for the right reasons. They want to work smarter, stretch limited staff capacity, and serve their mission more effectively. The problem is not the intention. The problem is the absence of any structure around it, and in 2026, that absence carries real consequences.

Fiduciary responsibility has always required boards to oversee the decisions that carry the greatest risk to the organization, its assets, and the people it serves. AI now belongs in that category. When a board approves a budget, hires an executive director, or reviews a major contract, it is exercising oversight over decisions with material consequences. The decision to adopt AI tools, or to allow staff to use them without a policy, carries the same weight.

Data exposure, regulatory liability, donor trust, and reputational harm are all on the table. A board that has never discussed AI governance has not fulfilled its oversight responsibility, regardless of how strong its financial controls or its mission focus may be.

The regulatory environment has shifted in ways most nonprofit boards have not yet absorbed. The FTC issued a final Decision and Order in August 2025 against an AI developer for making false accuracy claims, part of a broader enforcement pattern reflecting the agency’s growing scrutiny of AI-related deception. The FTC has also warned that quietly and retroactively changing privacy policies to cover AI tools already in use could be considered a deceptive act or practice. The concern is not the update itself. It is the silent retroactive application.

A donor who agreed to your privacy policy in 2022 reasonably understood their data would be handled according to what it said at the time. If your organization later edits that policy to permit AI processing of donor data and treats the change as though it always applied, those donors were misled. The fix is not complicated, but it requires transparency rather than a quiet edit to an existing document.

Staff members are often already using AI tools without any organizational guidance, drafting appeal letters, summarizing donor notes, generating communications. When donor personally identifiable information or financial records get entered into a consumer-grade AI tool without a policy governing that use, your organization loses control of that data.

No policy means no boundary. No boundary means no protection, for donors or for the board.

Public concern about AI is accelerating at every level of government, and new regulations and compliance requirements are not a matter of if but when. Activity is happening simultaneously at the federal level and across state legislatures, and the organizations that will navigate that landscape most successfully are the ones building governance structures now, not scrambling to retrofit them after a rule takes effect or an enforcement action lands close to home.

Monitoring what comes next, in real time, at both the state and federal level, is exactly what Complivia does. The Complivia Compliance Monitor tracks enforcement actions and regulatory developments as they happen, read through the lens of what nonprofit boards and executive leaders actually need to understand and act on. You can see what is already happening to organizations that waited at complivia.com/compliance-monitor.

Complivia works with nonprofit leaders as a trusted advisor on AI policy development, implementation, and monitoring, from the first board conversation through the governance structures that keep your organization protected as the technology and the regulatory landscape continue to evolve. As new requirements emerge, we track them, interpret them, and help you respond before they become a crisis. Start the conversation at complivia.com/contact.

This article is provided for educational and informational purposes and does not constitute legal advice.