Your board's role in AI governance is to provide strategic oversight without getting lost in technical details. Board members don't need to understand how machine learning algorithms work, but they should understand the strategic implications of AI deployment and the risks being managed. This guide helps board members ask the right questions and provide effective governance over AI investments.
Many boards either ignore AI entirely (assuming it's a technical detail for management to handle) or obsess about it (treating it as a silver bullet solution). Neither extreme serves your nonprofit well. Good board oversight of AI means staying informed, asking strategic questions, and ensuring that management is deploying AI responsibly and aligned with mission.
Understanding the Board's Oversight Role
Your board's primary responsibilities regarding AI are: ensuring that AI strategy aligns with mission and values, overseeing risks associated with AI deployment, ensuring that adequate resources and governance are in place, and monitoring whether AI investments are actually delivering promised benefits.
This is similar to how you oversee other significant technology investments or operational changes. You don't micromanage the details, but you ensure that leadership is thinking strategically about decisions, managing risks responsibly, and maintaining accountability. The same principle applies to AI.
Your board should not get involved in tool selection, implementation details, or technical decisions. Those are management decisions. What your board should provide oversight on is the strategic direction, risk management, and accountability. You should know whether AI is being used for something important. You should know what risks are being managed. You should ensure that governance structures exist. You should see evidence that investments are working.
Assign AI governance responsibility explicitly. Some boards create an AI committee. Others assign AI oversight to their existing technology committee or their executive/governance committee. Regardless of structure, make sure someone is responsible for bringing AI governance issues to the board and ensuring follow-up on board questions and concerns.
Strategic Questions the Board Should Ask
When management presents an AI initiative to your board, you should understand: What problem is this AI solving? Why is AI the right approach versus traditional solutions? What benefits are expected and how will you measure them? What risks exist and how are they being managed? What data is being used and have ethical questions been thought through? How does this align with our mission and values?
Ask for clarity on the business case. Not all AI investments make financial sense. Some will save money. Some will improve program quality without significant cost savings. Some will increase revenue. Some will primarily improve operational efficiency. Understand which value proposition you're pursuing and whether it's realistic.
Ask whether a pilot phase has been considered. Organizations that are skeptical of ambitious AI deployments often run pilots first. Pilots are smart risk management. They let you test whether AI actually works in your environment before committing significant resources. If management is proposing to skip a pilot and go straight to full deployment, ask why.
Ask about governance and oversight. Does the organization have an AI policy? Has the proposed AI application been reviewed for bias and fairness? How will you know if the AI is working as intended? What's the plan if the AI produces disappointing results or harmful outcomes? Who is responsible for monitoring and maintaining the system?
Ask about technology spending and opportunity cost. AI investments compete with other technology priorities. Is this the right place to invest given your other needs? What other technology priorities are you forgoing to pursue this AI investment? Are you confident this is the best use of technology budget?
Risk Governance and Oversight
Your board should ensure that management has thought through and is managing AI risks. Key risks include: technical risk (the AI doesn't work as intended), organizational risk (staff don't adopt the tool or it disrupts operations), financial risk (the investment doesn't deliver promised benefits), ethical risk (the AI produces biased or harmful outcomes), and legal/reputational risk (the AI use damages your reputation or creates legal liability).
Ask what risks have been identified and what's being done to mitigate them. Management should be able to articulate: What could go wrong? How likely is it? What damage would it cause? What are we doing to prevent it or reduce its impact? Honest risk assessment is more credible than overly optimistic assessments.
For high-stakes AI applications—those affecting program beneficiaries or major decisions—your board might want to require additional governance. Maybe certain uses require explicit board approval. Maybe there's a requirement for human-in-the-loop decision-making (AI recommends, humans decide). Maybe there's a requirement for regular monitoring and reporting on outcomes disaggregated by demographic groups. Depending on your organization's values and risk tolerance, these requirements might be appropriate.
Ensure that data governance is taken seriously. This is where many AI risks originate. Is the organization thinking about what data is appropriate for AI? Have ethical questions about data use been considered? Is there a data retention policy? Does the organization understand what rights people have regarding their data? If your organization is careless about data governance, AI risk management will be inadequate.
Assessing Resource and Capacity Requirements
AI implementation often requires more organizational capacity than leadership anticipates. Your board should understand whether the organization has sufficient capacity to implement and maintain AI systems responsibly.
Implementation capacity includes technical skills, project management skills, change management capacity, and training resources. Does the organization have someone who can oversee AI implementation? Does it have people who understand technology well enough to integrate AI with existing systems? Can you train staff adequately? If the organization is trying to implement AI with no additional resources while staff are already at capacity, the implementation will likely struggle.
Ongoing maintenance capacity is equally important. Once an AI system is deployed, someone needs to monitor whether it's working correctly. Someone needs to respond if problems emerge. Someone needs to retrain the system if real-world data changes and the model's performance declines. This isn't huge effort—maybe 5-10 hours per month for a mature system—but it needs to be budgeted and staffed.
Consider whether your organization needs to hire specialized skills or whether you can develop capacity internally. Neither is obviously right or wrong. Hiring brings expertise and reduces reliance on existing staff. Developing internal capacity builds long-term capability. This is a strategic choice worth discussing at the board level.
Measuring Value and Reporting to the Board
Your board should see regular reporting on AI investment performance. This helps you understand whether investments are delivering value and whether course corrections are needed.
Ask for simple metrics that capture what matters. If you're using AI for donor segmentation, measure whether AI-identified segments produce better response rates than manual segmentation. If you're using AI for volunteer matching, measure whether satisfaction increases. If you're using AI for content generation, measure time savings and quality. Different applications have different success metrics. The point is that you should see concrete evidence of whether the investment is working.
Include both quantitative and qualitative metrics. Quantitative metrics (time saved, accuracy achieved, revenue generated) tell you whether the tool is technically working. Qualitative metrics (staff feedback on usability, user satisfaction, perceived fairness) tell you whether people think the tool is valuable and are willing to use it.
Ask to see disaggregated data that addresses equity questions. How well does the AI system work for different populations? Is it equally fair and accurate for all groups served? If there are disparities, what's being done to address them? This is important for mission alignment.
Set clear expectations early about what success looks like and what evidence you want to see. Then hold management accountable to those expectations. If the AI initiative is underperforming, have honest conversations about why and what needs to change.
Avoiding Common Board Mistakes
Some boards make mistakes in AI governance. One common mistake is treating AI as magic that will solve all problems. This leads to unrealistic expectations and disappointment when the AI produces modest improvements rather than transformative change. Reality is that most AI provides 10-30% improvement in whatever you're measuring, which is meaningful but not revolutionary.
Another mistake is assuming AI is risk-free technology. In reality, AI can produce biased outcomes, harms vulnerable populations, use data inappropriately, or fail to deliver promised results. Good governance involves surfacing and managing these risks, not pretending they don't exist.
Some boards ignore AI entirely, assuming it's too technical to understand. In reality, you need to understand enough to ask strategic questions and ensure oversight. You don't need to understand the mathematics of machine learning. You do need to understand the implications for mission, strategy, risk, and resource allocation.
Some boards rubber-stamp management proposals without meaningful questioning. This fails your governance duty. Ask good questions. Insist on honest assessment of risks and benefits. Require evidence that capacity is sufficient. Demand reporting on results. This isn't obstructing progress—it's doing your job as a governance body.
Frequently Asked Questions
Should our board establish an AI committee? For most nonprofit boards, it's not necessary to create a separate AI committee. Assigning AI oversight to your existing technology committee or governance committee is often sufficient. Create an AI committee only if your organization has significant AI investments that require deep ongoing oversight. More important than committee structure is that someone is explicitly responsible for bringing AI governance issues to the board.
What should we do if management wants to deploy AI but we're skeptical? Require a pilot. Pilots are low-risk ways to test whether AI actually works in your environment. They give you evidence to inform scaling decisions. If management is unwilling to pilot, ask why. If the answer is "we're confident it will work," that's not a sufficient reason to skip pilots. Confidence without evidence is not governance.
How often should the board review AI governance? At least annually, and quarterly during active implementation. When you're actively implementing new AI systems, quarterly check-ins help you catch problems early and course-correct. Once systems are mature and running smoothly, annual review is often sufficient. Adjust based on how much AI your organization is using and how much it's changing.