Define who approves AI use, what staff may enter, and how incidents are handled with a governance framework sized for Canadian nonprofits.
AI governance for a Canadian nonprofit is the system for approving uses, assigning responsibility and responding when something goes wrong. It needs to work when a staff member wants to try a tool, when a supplier changes its terms, and when an inaccurate output reaches a donor. A policy document helps, but someone must have the authority and time to apply it.
Keep an inventory that answers operational questions
Record each approved use, its business owner, the product involved, the information it receives and the people affected by its outputs. Describe actions precisely. Drafting a donor letter for review differs from selecting recipients or sending messages automatically. An inventory that records only “communications uses AI” misses those distinctions.
Include informal trials in the inventory. Give staff a straightforward way to report existing use without making disclosure feel like an admission of misconduct. Otherwise, management may approve a polished policy while remaining unaware of the tools already handling organizational information.
Assign decisions to existing roles
| Decision | Accountable role | Evidence to retain |
|---|---|---|
| Approve a new workflow | Executive or delegated programme owner | Purpose, boundaries and approval conditions |
| Approve information access | Designated information owner | Permitted data and users |
| Accept a generated output | Qualified staff reviewer | Checks proportionate to its consequences |
| Pause an unsafe use | Named operational owner | Issue, containment and restart decision |
One person may hold several roles in a small organization. That makes explicit delegation more important, not less. Arrange a backup for absences and a route to specialist advice where the decision exceeds internal expertise.
Make approval conditions specific
For a donor communications assistant, an approval might allow drafting from public campaign information while excluding donor histories and personal circumstances. The communications manager reviews accuracy, tone and permissions before anything is sent. Expanding the assistant to donor segmentation would require a separate review because the purpose and information have changed.
The NIST AI Risk Management Framework is a voluntary reference for managing AI risk. It can inform your approach without being presented as a legal requirement or a certification.
Prepare for a mistake before one occurs
Write a short response procedure: stop the affected workflow, preserve the relevant records, identify who received the output and involve the people responsible for privacy, communications or service delivery. Assess notification obligations in the actual circumstances rather than assuming every error has the same reporting requirement.
Then fix the cause. An outdated source document requires a different response from excessive access or a reviewer who never received training. Restart should depend on evidence that the relevant issue has been addressed, not simply on the passage of time.
Report exceptions, not just adoption
A useful management update records new approvals, material changes, incidents, unresolved controls and uses that were stopped. A rising licence count does not show that governance is working. Track whether owners complete reviews, whether staff can report problems, and whether conditions remain appropriate as workflows change.
Review the arrangement when a product gains new capabilities, a team introduces more sensitive information or an output starts influencing a consequential decision. Nimblox can help assess governance gaps and establish an approval process staff can actually follow.