D&O Liability and AI: How Nonprofit Board Members Can Protect Themselves from Personal Exposure

Not all AI deployments create equal liability exposure for board members. The risk is concentrated in several specific contexts where AI decisions have direct consequences for people, involve regulated activities, or create reliance by third parties on the accuracy of the organization's representations.

AI tools that affect which beneficiaries receive services, which job applicants are considered, or which volunteers are screened represent some of the highest-risk deployments for nonprofit boards. Court cases in 2025 involving AI hiring systems illustrate the risk: a federal court conditionally certified a massive age discrimination collective action against a major HR software company, establishing that using a vendor's AI system does not insulate an organization from liability for discriminatory outcomes. When a nonprofit uses an AI hiring tool and that tool systematically disadvantages protected-class applicants, the board faces exposure regardless of whether the nonprofit built the tool.

"AI-washing," the practice of misrepresenting AI capabilities or the extent of AI use to donors, funders, or grant-making foundations, represents another significant liability vector. When organizations claim AI capabilities they do not have, or claim AI-driven impact figures that the technology cannot substantiate, they create fraud exposure. For nonprofits that receive grant funding based on representations about their technology capabilities, this risk extends directly to board members who approved those representations.

The standard that courts and insurers apply when evaluating whether a board exercised adequate AI oversight is not perfection. It is defensibility. A defensible governance posture means that when a problem occurs, the board can demonstrate that it was informed, that it asked the right questions, that it established appropriate oversight structures, and that it acted reasonably on the information it had. The documentation that creates this demonstration is specific, and building it is entirely within reach for nonprofits at any budget level.

The NIST AI Risk Management Framework has emerged in 2025-2026 as the consensus standard that legal experts, governance advisors, and insurance underwriters reference when evaluating organizational AI governance. Adopting the NIST AI RMF as the foundation of a nonprofit's AI governance structure provides a recognized external framework that demonstrates the board exercised care in choosing its approach. Multiple legal and insurance sources now specifically recommend the NIST AI RMF for nonprofits as the basis for governance documentation.

The distinction between a board-approved policy and a management-delegated one is significant from a liability perspective. When management alone owns the AI governance policy, a claim can be made that the board never exercised oversight at all, which is precisely the "no system" Caremark vulnerability. When the full board has reviewed and approved the policy, that action creates a documented record of board-level engagement with AI governance. The policy does not need to be lengthy or technically detailed. It needs to reflect genuine board deliberation and approval.

An AI tool inventory is the operational foundation of defensible governance. When the board can demonstrate that it knew which AI tools were in use, what data they handled, who had approved their deployment, and what oversight mechanisms were in place, it becomes substantially harder for a plaintiff or regulator to argue that the board was ignorant of AI risks. Starting an inventory is simple: identify every tool currently in use across the organization that uses AI, including tools embedded in platforms the organization may not think of as "AI" such as donor management systems with predictive features, HR platforms with automated screening, or scheduling tools with optimization algorithms.

One of the most important legal developments in 2025 for nonprofits using AI vendors is the court ruling in the Workday case, which conditionally certified a massive class action against the HR software company for AI hiring discrimination. The significance for nonprofits is not the claim against Workday itself, but the legal principle it reinforces: organizations that use a vendor's AI system can face liability for discriminatory outcomes produced by that system, even if they did not build or configure the underlying model.

The Massachusetts Attorney General's July 2025 settlement with Earnest Operations LLC for $2.5 million over AI-driven lending discrimination established a complementary principle on the regulatory side: regulators expect organizations to proactively test AI systems for bias and disparate impact, not simply deploy and observe. A nonprofit that deploys an AI tool affecting beneficiary eligibility without conducting any bias assessment, and that later discovers the tool systematically disadvantaged certain populations, is exposed to both the substantive discrimination claim and the governance failure claim.

Vendor due diligence for AI tools should therefore go beyond the standard security and data privacy review that nonprofits conduct for technology vendors. For any AI tool that affects people directly, boards should ensure management can answer specific questions about how the model works, what data it was trained on, whether bias testing has been conducted, and who is responsible for ongoing monitoring of the model's outputs. The nonprofit AI vendor evaluation checklist provides a framework for this assessment that can be adapted to different tool types and risk levels.

For the highest-risk AI deployments, including any tool that affects beneficiary services, hiring decisions, or sensitive personal data, boards should require that management conduct an independent bias audit before deployment and on a regular basis thereafter. Many vendors will resist this request, citing intellectual property protections for their model details. That resistance is itself a governance signal. Organizations should insist on contractual language that provides audit rights, or should evaluate whether the tool's risk profile justifies using a vendor that will not provide them.