AI in the Charity Boardroom: The Trustee’s Checklist
AI is rapidly becoming part of everyday work. Teams are using it to draft content, summarise information, analyse data and automate routine tasks. For many charities, the question is no longer whether AI will be used. It is whether it is being used responsibly.
For trustees and board members, this creates a familiar challenge. The risks of moving too quickly are real. Yet the risks of standing still are equally significant. Charities that fail to explore AI may miss opportunities to improve efficiency, reduce administrative burden and free up resources for mission delivery.
The greater danger sits somewhere in the middle: organisations experimenting with AI without clear governance, oversight or guard rails.
This is why AI has become a board-level issue. Trustees do not need to become AI experts. They do need to become informed stewards of how AI is being adopted across their organisation.
The role of the board is not to decide which AI model to use. It is to ensure the charity captures the benefits while protecting beneficiaries, donors, staff, partners and the organisation’s reputation.
Why AI Governance Belongs in the Boardroom
Most major organisational risks eventually end up on the board agenda. AI is no different.
The technology has implications for:
- Data protection and privacy
- Safeguarding
- Regulatory compliance
- Cyber security
- Operational resilience
- Reputation and public trust
- Workforce capability and skills
- Decision-making and accountability
For charities, these considerations are amplified because the sector often handles particularly sensitive information. Beneficiary records, safeguarding concerns, donor data and commercially confidential funding information all require careful stewardship.
Trustees already oversee financial controls, risk management and governance. AI increasingly sits within the same category of responsibility.
Importantly, AI should not be viewed purely as a technology decision. Successful adoption depends on governance, people, processes, technology and organisational change working together. The challenge is as much about behaviour, culture and adoption as it is about software.
The Real Risk: Uncontrolled Adoption
Many charities are discovering that AI use has arrived before governance.
A member of staff creates an account on a public AI platform to help write a funding bid. A team uses AI to analyse stakeholder feedback. A volunteer experiments with AI-generated content for a campaign.
Individually, these actions may seem low risk. Collectively, they can expose organisations to significant issues if there are no clear policies or controls.
Common risks include:
- Sensitive information being entered into public AI tools.
- Inaccurate AI-generated content being published without review.
- Decisions being influenced by biased or incomplete outputs.
- Staff assuming AI responses are always correct.
- Inconsistent use of AI across teams.
- Lack of transparency about where AI has been used.
- Reputational damage if beneficiaries or donors lose trust.
Understanding Open and Enterprise AI Environments
One of the most important concepts trustees should understand is the difference between open AI tools and enterprise-controlled AI environments.
Open AI Tools
These are publicly accessible platforms where users create individual accounts and interact directly with AI systems. Depending on the configuration and terms of service, information entered into these systems may be stored, retained or used in ways outside the charity’s direct control. This creates obvious concerns when sensitive data is involved.
Information that should never be entered into open AI tools…
A useful principle for trustees is simple: If the information would not be appropriate to publish publicly, it should not automatically be assumed safe to enter into an open AI platform.
Examples include:
- Beneficiary records or case information
- Safeguarding-related information
- Personal data
- Donor information
- Financial records
- Fundraising strategies
- Grant applications before submission
- Commercial contracts
- Legal advice
- Board papers
- Security-related information
- Confidential staff matters
- Information covered by non-disclosure agreements
Boards should seek assurance that clear policies exist, staff understand them and compliance is actively reinforced through training and communication.
Enterprise-Controlled AI Environments
These solutions sit within an organisation’s managed technology environment and are subject to organisational security, governance and compliance controls.
They typically offer:
- Defined access controls
- Data protection safeguards
- Audit trails
- Integration with existing security policies
- Greater visibility of usage
- Centralised governance
Trustees do not need to understand every technical detail. They do need confidence that executive teams understand which environments are being used and what controls exist around them.
A Trustee Checklist for Responsible AI Adoption
Rather than focusing on technical implementation details, trustees should focus on governance questions like these:
1. Do we have a clear AI policy?
Ask:
- Is there a documented organisational policy?
- Does it explain acceptable and unacceptable use?
- Is it relevant to different employee and volunteer groups?
- Has it been communicated effectively?
2. Do we know where AI is already being used?
Many organisations underestimate existing usage.
Ask:
- Which teams are using AI today?
- For what purposes?
- Which tools are being used?
- Is there visibility of experimentation taking place?
- Can we keep track of the use cases?
You cannot govern what you cannot see.
3. Have we defined high-risk activities?
Not all use cases carry equal risk.
Drafting an internal meeting summary is very different from using AI in beneficiary-facing decision-making.
Ask:
- Which AI use cases are prohibited?
- Which require additional oversight?
- Which can be encouraged safely?
4. Are data protection controls in place?
Ask:
- What information can and cannot be entered into AI systems?
- How is compliance monitored?
- What guidance exists for handling personal or sensitive information?
5. Have teams received appropriate training?
Policies alone rarely change behaviour.
Ask:
- Have teams been trained?
- Do they understand AI limitations?
- Can they recognise inaccurate outputs?
- Are managers equipped to supervise responsible use?
6. Is accountability clear?
Ask:
- Who owns AI governance?
- Which executive leads AI oversight?
- How are risks escalated?
- How is the board kept informed?
7. Are we reviewing AI as part of existing governance processes?
AI should not become a standalone governance silo.
Ask:
- Is AI included within risk registers?
- Is it incorporated into internal audit activity?
- Are cyber, privacy and compliance teams appropriately involved?
Where AI Can Create Genuine Value for Charities
Trustees should be equally interested in opportunity as risk. When deployed responsibly, AI can help charities:
- Reduce administration and reporting burdens.
- Draft first versions of funding applications.
- Summarise consultation responses and stakeholder feedback.
- Create communications content more efficiently.
- Improve knowledge management.
- Support meeting preparation and documentation.
- Analyse large volumes of operational information.
- Help staff spend more time on mission delivery and less on routine administration.
The most effective use cases are often the least dramatic. They remove friction from everyday work and allow people to focus their expertise where it matters most.
Avoiding a Culture of Fear
An overly restrictive approach can be as damaging as a lack of governance. If teams feel unable to discuss AI use openly, experimentation simply moves underground.
Boards should encourage a culture where:
- Responsible experimentation is welcomed.
- Learning is shared.
- Risks are discussed openly.
- Good practice is recognised.
- Governance enables innovation rather than blocking it.
The goal is not to eliminate risk entirely. Few boards would apply that standard to any significant organisational change initiative. The goal is to manage risk appropriately while enabling progress.
The Trustee’s Role in the Age of AI
The organisations that benefit most from AI are unlikely to be those that adopt it fastest. They are more likely to be the ones that adopt it most thoughtfully. For charity trustees, this means moving beyond passive observation. Boards should be asking questions, seeking assurance and creating the conditions for responsible innovation. They should ensure governance keeps pace with adoption while avoiding unnecessary barriers to progress.
Above all, trustees should remember that AI is not simply a technology programme. It is an organisational change challenge involving people, processes, governance, culture and technology. The charities that navigate it successfully will be those that bring all of these elements together.
AI may change how work gets done. Trustee responsibility remains the same: safeguarding the organisation’s mission while helping it adapt confidently to a changing world. If your board is beginning to explore AI, start with governance rather than technology. The most valuable conversations are often about accountability, risk, adoption and organisational readiness.
Speak to Nine Feet Tall about building a practical, proportionate approach to AI adoption that balances innovation with oversight and helps your organisation navigate change with confidence.
