Who Is Responsible for AI Oversight at Your Nonprofit? A Starting Checklist

If you can't name the person or group at your organization responsible for AI oversight, you're not alone. New research from The Bridgespan Group found that 57 percent of nonprofits haven't yet named a group responsible for AI oversight, and just 38 percent have any written guidance on safe and responsible AI use in place at all — even as 62 percent say clearer internal guidelines would help them use AI more confidently and responsibly.

Four colleagues gathered around a laptop, smiling as they review information together in a bright office.

That gap is not a failure. It's a starting point.

Why This Is the Real Question

Most conversations about AI at nonprofits start with tools: which chatbot to use, which policy template to download, which staff training to run. But none of that holds up without someone accountable for it. A tool without an owner isn't a system — it's a liability waiting for the first mistake to surface.


This is the same gap we mean when we say access to AI is not the same as AI readiness. Staff already have access. Almost every nonprofit does. Readiness is a different question: does anyone know what's being used, for what, and who's accountable if something goes wrong?

A Starting Checklist

You don't need a finished policy to start. You need five honest answers.


  1. Name one person or small group as the AI oversight owner. It doesn't need to be a formal title or a new hire — it needs to be a name someone can point to.
  2. Write down where staff can and cannot use AI right now. Even a short, plain-language list beats no guidance at all.
  3. Set clear rules for confidential, personal, or sensitive information. This is usually the highest-risk gap and the easiest one to close first.
  4. Decide how AI-generated work gets reviewed before it goes out the door. Accuracy, bias, accessibility, and copyright all belong in that review, not left to chance.
  5. Know what happens if something goes wrong. An AI error or a data incident is a "when," not an "if" — decide now who gets notified and what the response looks like.


None of this requires new software. It requires clarity and a name attached to it.

Where This Fits

At MissionCapacity.AI, oversight and governance aren't an afterthought — they're one of the five areas we examine directly in every Mission Capacity Assessment, alongside strategy, people, processes, and knowledge. If your organization already knows it needs to move past ad hoc AI use, that's exactly where the Assessment starts.

Let’s build the marketing system your mission deserves.

We’ll begin by looking at your team, content, knowledge, processes, and goals—then identify what your AI-powered marketing system should include.