Practical AI Readiness
Your AI Approval Is Already Out of Date
You reviewed the tool. You set some rules. You moved on. Here is what happened while you were not looking.
Most nonprofits treat AI adoption as a moment. You evaluate a tool, decide it is acceptable, maybe set a few guidelines, and move on to the next thing.
That moment is not wrong. It is just not enough.
AI does not stay the same between decisions. Vendors push feature updates without announcements. Data practices that seemed acceptable at adoption look different after a terms of service update nobody read. The staff member who understood what the tool could and could not access has left. The feature that was optional when you approved it is now on by default. The platform you reviewed last spring has added an AI assistant that can read everything stored inside it.
The approval you gave is already drifting. And in most nonprofits, nobody is watching.
Why AI is Different From Other Technology Governance Questions
Your organization probably has some version of a technology governance rhythm already, or at least the intention of one: renewal reviews, decision checkpoints, someone who is supposed to flag when something changes.
That rhythm was built for software that changes slowly. A CRM is largely the same product it was eighteen months ago. A project management tool does not quietly add new data practices between your annual reviews.
AI tools do.
The pace of change in AI products is faster than almost any other category of software your organization uses, and the stakes around what changes are higher. When a vendor updates its AI data practices, it affects what happens to your client information, your donor records, your internal communications. When a new AI feature goes live inside a platform you already trusted, it may be accessing things the original review never considered.
A governance rhythm that does not explicitly include AI will miss these changes. Not because the rhythm is broken. Because it was not built for something that moves this fast.
What AI Specifically Adds to Your Governance Rhythm
You do not need a separate AI governance process. You need to add some specific questions to the rhythm you already have.
At every regular technology review, add:
Set a calendar reminder tied to each approved tool. When terms change, the review clock resets.
Built-in AI features update more often than standalone tools. Check what is active now, not just what was active when you first signed on.
Staff turnover is one of the most common reasons AI governance quietly falls apart. When the person who understood the tool leaves, the institutional knowledge about what was approved and why leaves with them. Ownership needs to be documented, not just assumed.
This is the one most organizations miss entirely. The AI risk review you did on your CRM does not cover the AI assistant your CRM vendor added six months later. New features need new reviews, even inside familiar platforms.
Ask this directly. Not as an accusation. As a standing question that keeps the picture honest.
If You Have a Governance Rhythm: Add These Questions To It.
You do not need a new process. You need AI to be explicitly named inside the one you have. Put it on the agenda. Assign the owner. Set the cadence. Treat AI tool reviews the same way you treat renewal reviews: on a schedule, with a record, and with someone accountable for the outcome.
The Nonprofit AI Readiness Toolkit gives you the structure to make that practical. The vendor and platform risk tab is designed to be a living document, not a one-time exercise. It is meant to be revisited, updated, and used as the record of what was reviewed, what was approved, and what is still open.
If You Do Not Have a Governance Rhythm Yet: Start There First.
AI governance does not work in isolation. If your organization is making technology decisions without a consistent review rhythm, renewal process, or clear decision ownership, adding AI to the mix will not fix that. It will expose it.
The governance pillar covers how to build a practical technology governance rhythm your nonprofit can actually keep, including how to structure reviews, assign ownership, and keep the roadmap aligned as conditions change.
AI belongs inside that rhythm. Not beside it.
A Practical Starting Point
If this post raised questions about what your organization is currently doing with data, or where AI tools may already be touching information nobody has reviewed, the Nonprofit AI Readiness Toolkit is where to start.
It walks you through the process of mapping sensitive information, documenting current AI use, and evaluating vendor risk. It gives the person you named a structure to work from.
Lisa Montague is Partner and CEO at Coat Rack, a nonprofit technology consulting firm based in Cedar City, Utah.