AI Governance from Below
For most nonprofits it's about trust, not compliance.
When nonprofits hear “AI governance,” it’s easy to tune out. Headlines are full of the EU AI Act, U.S. executive orders, and state-level bills—but here’s the truth: if you’re running a grassroots nonprofit in Minneapolis or Nairobi, no regulator is about to come knocking on your door.
That doesn’t mean governance doesn’t matter. It just means the stakes are different. For nonprofits, AI governance isn’t about avoiding fines—it’s about protecting trust. Trust with the communities you serve. Trust with the funders who back your work. Trust with the staff and volunteers who rely on your leadership to set guardrails for new tools.
Forget the Regulators
In the U.S., AI regulations are sparse. The EU AI Act is sweeping, but unless your organization is working directly with European partners or handling EU residents’ data, it won’t touch you. Even where regulations do exist, enforcement is focused on Big Tech, not small nonprofits.
So if you’re waiting for a law to tell you what to do—you’ll be waiting a long time.
The real risks are closer to home:
A funder asks how you’re ensuring community consent when using AI for analysis—and you don’t have an answer.
A participant finds out their interview transcript was run through ChatGPT without their knowledge—and loses confidence in your program.
A staff member uses AI in ways that expose sensitive data—and suddenly you’re cleaning up a breach of trust, not just a technical mistake.
This is why governance matters, even without regulation. Because while governments may not be watching, your funders, communities, and partners already are.
Who Really Governs Nonprofits’ AI Use
If regulators aren’t setting the rules for you, who is? In practice, three groups already act as your real AI watchdogs—whether you call it governance or not.
1. Communities
People want to know how their stories, surveys, and data are being used. If you put those inputs through an AI system—whether to summarize focus groups or analyze open-ended survey responses—they deserve to be informed. They may not care about the technical details, but they do care about whether you’re treating their contributions with respect.
2. Funders
Even if governments are slow to legislate, philanthropy and aid donors are moving faster. Many are adopting “responsible AI” language and will increasingly expect nonprofits to align with those principles. If you can’t explain your guardrails, it’s not just a compliance gap—it’s a credibility gap.
3. Vendors
Nonprofits don’t build their own LLMs. They rely on tools from Google, Microsoft, Salesforce, or smaller vendors. Those companies are already changing their products to comply with laws in Europe and elsewhere. In turn, you inherit those guardrails and restrictions whether you realize it or not.
Together, these groups—communities, funders, vendors—already govern how nonprofits can and should use AI. The question isn’t whether you’re regulated. It’s whether you’re ready to be accountable to the people who matter most.
What Governance Looks Like From Below
When people hear “AI governance,” they picture legal codes and compliance manuals. But for nonprofits, governance doesn’t start with regulators—it starts with everyday practices that protect relationships.
Here are five simple principles that nonprofits can adopt right now:
1. Consent
Be upfront if you’re using AI to process someone’s story, transcript, or data. Consent isn’t just a checkbox—it’s about making sure people know how their words are being handled.
2. Transparency
Don’t bury your AI use in the fine print. Let staff, funders, and participants know where AI tools are part of your work—whether in analysis, reporting, or service delivery.
3. Bias Awareness
AI reflects the data it was trained on, which means it can reproduce blind spots or prejudices. If you’re using it for analysis, double-check the results. Don’t assume “neutral technology” exists.
4. Data Sovereignty
Treat community data as belonging to the people who shared it—not as something your nonprofit owns outright. AI doesn’t erase this principle; it makes it even more important.
5. Accountability
Keep a record of how you’re using AI in your work. If a funder, board member, or community partner asks, you should be able to show your reasoning—not just point to a black-box output.
These practices aren’t about compliance. They’re about showing that your nonprofit takes responsibility for how AI shapes your work, and how it affects the people who trust you with their stories and data.
Why This Matters More Than Compliance
If you’re a small nonprofit, no one is going to fine you for using ChatGPT. But the costs of getting governance wrong are real—and they show up in ways that directly affect your ability to do your work.
Funders trust organizations that demonstrate responsibility. If you can show how you use AI carefully and transparently, it strengthens your credibility in proposals and reports.
Communities trust organizations that give back, not just take. If you close the loop and share how their data is being used—rather than quietly uploading it to an AI platform—you reinforce respect and reciprocity.
Staff and volunteers trust leadership that sets clear guardrails. Without guidance, people improvise. With even a light policy, they have confidence about what’s safe and what’s off-limits.
None of this comes from a legal requirement. It comes from the relationships that make your organization possible.
Governance, at its core, isn’t a burden—it’s a way to build trust. And for nonprofits, trust is the real currency that keeps programs running, partnerships growing, and communities engaged.
How to Start: A Practical Checklist
You don’t need a 40-page AI policy to get governance right. Start small and keep it practical:
Map where AI shows up – Is staff using it to analyze surveys, draft reports, or manage donor communications? Write it down.
Draft a one-page AI use policy – Spell out what’s allowed, what’s off-limits, and how sensitive data should be handled.
Train staff on red flags – Hallucinations, bias, and data leakage are the big three. Make sure everyone knows how to spot them.
Choose vendors wisely – Ask simple questions: Where is data stored? Who has access? What protections are in place?
Share back with communities – If you use AI on their data, close the loop. Show them what came out of it and how it benefits them.
These steps aren’t about ticking a compliance box. They’re about building habits that make your nonprofit trustworthy in a new AI landscape.
Closing
AI governance for nonprofits isn’t about Brussels or Washington. It’s about whether the people you serve, fund, and work alongside believe you’re using AI responsibly.
So here’s the simplest starting point:
Ask your team this week:
Would our community be comfortable knowing how we use AI?
If the answer is no—or even “I’m not sure”—that’s where your governance work begins.
About Anthralytic
We’re a strategy and evaluation firm helping mission-driven organizations navigate complexity with clarity. Our work blends human-centered MEL, participatory design, and AI-enabled tools—so nonprofits and social enterprises can build trust, measure impact, and make better decisions.
