Most nonprofits are already using AI. Staff are drafting grant reports with it, running donor analytics through it, summarizing program data with it. Almost none of them have updated their privacy policies or terms of service to say so.
That gap is worth sitting with for a second, because nonprofits and membership organizations run on a kind of trust that most businesses don't have to earn in the same way. People hand over personal information, financial support, and often their own creative or personal work based on a relationship, not a transaction. When AI enters that relationship quietly, through the back office rather than the front door, it changes the terms of that relationship without telling anyone the terms changed.
The silence isn't neutral
It's tempting to think that if AI use is "just internal" or "just assistive," it doesn't need to be disclosed. But policies that go quiet on AI don't read as neutral anymore. They read as behind, or worse, as evasive. Members and donors increasingly assume AI is involved somewhere; the absence of any mention doesn't reassure them, it just leaves them guessing. And once someone feels they've been guessing about something that involves their own data, the damage isn't really about the AI. It's about having been kept in the dark.
What's actually at stake
For mission-driven organizations, this isn't a legal box to check, it's core to the relationship. A few things matter more than others:
Informed consent has to mean something real. Not a buried checkbox or vague "we may use technology to improve our services," but plain language that says what's happening, why, and gives people an actual choice.
Transparency means naming it. Which processes involve AI, what kind of data touches those tools, and what stays fully human-reviewed. Vague reassurance doesn't build trust; specificity does.
Data minimization matters more with AI in the loop, not less. Feeding AI systems only what's necessary, and de-identifying data wherever possible, limits the downside if something goes wrong and signals that the organization has actually thought this through.
The right to ask should be standing, not theoretical. People should be able to find out what's been done with their data and get a real answer.
Why now, specifically
AI capabilities are moving faster than most organizations' governance processes. That's not a criticism, it's just the timeline. But it means policies written even a year ago are probably already out of date, and policies written today will likely be out of date again before long. The organizations that treat this as a one-time fix will keep falling behind. The ones that build in a regular review, revisiting language as tools and practices change, will be the ones whose members never have reason to wonder what's being kept from them.
There's also a quieter audience watching all of this: funders. Data practices, including how an organization handles AI, are increasingly part of the credibility story funders evaluate before writing a check. An organization that can clearly articulate its AI use and its guardrails is signaling something bigger than compliance. It's signaling that it takes its stewardship of other people's information, and other people's trust, seriously.
The simple version
Say what you're doing before someone has to ask. That's really the whole idea. It costs very little to name AI use plainly, get real consent, and commit to revisiting the language as things evolve. It costs a lot more, in trust that's hard to rebuild, to let people find out on their own.