How to Navigate AI Regulations and Compliance for Nonprofits

Currently, there is no comprehensive federal legislation specifically regulating AI development or use in the United States. This gap has left federal agencies to interpret AI compliance within their existing mandates—resulting in sector-specific guidance rather than unified requirements. Nonprofits must understand both the limitations of federal AI regulation and the existing federal frameworks that may apply to their AI use.

The federal approach to AI has shifted between administrations. The Biden administration issued several executive orders on AI, including guidance on AI safety and government AI procurement. The January 2025 policy shift under the Trump administration emphasized enhancing US global dominance in AI by reducing regulatory barriers to foster innovation. Neither approach established binding compliance requirements for nonprofits, leaving organizations without clear federal direction.

Despite the absence of comprehensive AI legislation, federal agencies have actively applied existing laws to AI contexts. In 2024 alone, federal agencies introduced 59 AI-related regulations—more than double the previous year—interpreting how existing frameworks apply to AI systems. These agency actions provide important guidance even without new legislation: they signal how regulators view AI compliance within established legal frameworks and foreshadow enforcement priorities that may affect nonprofits.

The NIST AI Risk Management Framework deserves particular attention, even though it's voluntary rather than mandatory. This framework provides comprehensive guidance on identifying, assessing, and mitigating AI risks—and increasingly serves as a reference point for state regulators developing mandatory requirements. Nonprofits that align their AI practices with NIST guidance position themselves well for compliance with future regulations likely to incorporate similar concepts.

For nonprofits receiving federal funding, additional considerations apply. Federal grant agreements increasingly include AI-related requirements, from data privacy provisions that affect AI training data to performance reporting that may involve AI systems. The federal government's own AI adoption—as outlined in various agency AI strategies—may create expectations that funded nonprofits adopt compatible systems or meet specific AI standards. Organizations should review grant agreements carefully for AI-related provisions and stay informed about funder expectations regarding AI use.

Looking ahead, federal AI legislation remains possible. Multiple AI-focused bills have been introduced in Congress, addressing topics from AI transparency requirements to algorithmic accountability. While passage timelines are uncertain, nonprofits should monitor legislative developments and be prepared for potential federal requirements that could supersede or complement state regulations. For now, the absence of comprehensive federal law means state regulations take primary importance for most nonprofit AI compliance needs.

The European Union's Artificial Intelligence Act, which came into force in August 2024 with primary enforcement beginning August 2026, represents the world's first comprehensive legal framework for AI regulation. While US nonprofits might assume this international regulation doesn't affect them, the Act's extraterritorial scope means US-based organizations can be subject to its requirements under certain circumstances.

A US nonprofit can be subject to the EU AI Act if it places an AI system on the market in the EU or provides an AI system whose output is used within the EU. For nonprofits, this might apply if: the organization operates programs serving EU residents; the organization's website or services are accessible to and used by EU residents; the organization partners with EU-based organizations that use its AI-powered tools; or the organization processes data about EU residents in AI systems.

The EU AI Act categorizes AI systems by risk level and imposes different requirements accordingly. "Unacceptable risk" AI systems are prohibited entirely—these include AI that manipulates vulnerable groups, social scoring systems, and certain biometric identification applications. "High-risk" AI systems face extensive requirements including conformity assessments, quality management systems, documentation requirements, and human oversight mandates. "Limited risk" systems have transparency obligations, while "minimal risk" systems face no specific requirements.

Given the complexity of AI regulation across jurisdictions and sectors, nonprofits need systematic approaches to compliance rather than ad hoc responses to individual requirements. Building an AI compliance program creates infrastructure for ongoing regulatory navigation, reduces compliance costs through standardized processes, and positions organizations to adapt efficiently as regulations continue to evolve.

The foundation of any compliance program is a comprehensive AI inventory. Organizations should document all AI systems in use or under consideration, including: the AI system's purpose and capabilities; vendors and their data practices; data processed by the system; populations affected by AI outputs; jurisdictions where the system operates or produces effects; and relevant regulatory frameworks that might apply. This inventory enables systematic assessment of compliance obligations rather than discovering requirements after problems arise.

Risk assessment should evaluate each AI system against applicable regulations. For each system in your inventory, assess: Does this constitute a "high-risk" AI system under Colorado, California, or other applicable state laws? Does it affect employment, education, healthcare, or essential services—categories receiving heightened regulatory scrutiny? Does it make consequential decisions about individuals that might trigger disclosure or appeal requirements? Does it process data from children, EU residents, or other specially protected categories? Does it have potential for algorithmic discrimination that might violate anti-discrimination requirements?

Documentation requirements under emerging AI laws are substantial. Colorado's AI Act requires deployers of high-risk AI systems to document risk assessments and maintain records demonstrating reasonable care to prevent algorithmic discrimination. California's 2026 requirements include documented privacy risk assessments for high-risk processing activities, with potential submission to regulators by April 2028. Organizations should establish documentation standards now to ensure compliance records exist when required—recreating documentation retrospectively is difficult and may not satisfy regulatory requirements.

Vendor management deserves particular attention in nonprofit AI compliance. Many nonprofits lack resources to build AI systems in-house, relying on vendor products for AI capabilities. This creates compliance dependencies: your organization's compliance may depend on vendor practices you don't directly control. Vendor due diligence should evaluate: How does the vendor handle data? Does the vendor train models on customer data? What contractual commitments does the vendor make regarding discrimination testing, security practices, and regulatory compliance? What documentation does the vendor provide to support customer compliance obligations?

Security is a critical dimension of compliance that extends beyond vendor evaluation. Whether you build AI tools in-house or use vendor platforms, the applications themselves can introduce vulnerabilities that create regulatory exposure. AI-generated code is particularly prone to issues around authentication, data access controls, and input validation. A dedicated AI application security review can identify these risks and help ensure that your AI deployments meet the security standards that regulatory frameworks increasingly require.

Accountability structures ensure someone is responsible for AI compliance. Organizations should designate roles responsible for: maintaining the AI inventory, conducting risk assessments, managing vendor relationships, ensuring disclosure requirements are met, coordinating bias auditing, responding to regulatory inquiries, and updating policies as regulations evolve. In smaller organizations, these responsibilities may be added to existing roles; larger organizations may justify dedicated compliance positions. For guidance on developing AI policies, see our article on AI policy templates for nonprofits.

The AI regulatory landscape will continue evolving rapidly. Industry analysts predict most states will have some form of AI regulation by 2026. Federal AI legislation remains possible and would likely create new compliance frameworks that supplement or preempt state requirements. International developments, particularly enforcement of the EU AI Act beginning in August 2026, will influence global AI governance norms and may affect US organizations with international exposure.

Several trends suggest the direction of future regulation. First, convergence around common concepts: terms like "high-risk AI," "algorithmic discrimination," "impact assessment," and "human oversight" appear across multiple regulatory frameworks, suggesting these concepts will anchor future requirements regardless of jurisdiction. Organizations building compliance around these concepts position themselves for regulatory developments across jurisdictions.

Second, increasing enforcement: as AI regulations mature past their effective dates, enforcement actions will begin providing clarity about regulatory interpretations and compliance standards. Early enforcement cases will establish precedents that guide compliance across the sector. Organizations with documented compliance efforts will be better positioned to demonstrate good faith if regulatory questions arise.

Third, integration with existing frameworks: AI-specific regulations increasingly connect to established legal frameworks—civil rights laws, consumer protection statutes, sector-specific regulations. This integration suggests that AI compliance will become part of general organizational compliance rather than a standalone specialty. Organizations should integrate AI compliance into existing governance structures rather than treating it as an isolated function.