Artificial intelligence has moved into the workplace faster than almost anyone anticipated. Employees are using it to draft emails, summarize meetings, analyze data, and automate everyday tasks. Meanwhile, lawmakers are trying to catch up, balancing AI’s enormous potential against concerns about privacy, security, discrimination, and accountability.

This week’s U.S. midterm elections could add another twist to an already complicated regulatory landscape. With a new Congress taking shape, the direction of federal AI policy could shift, potentially bringing greater scrutiny of AI developers, stronger consumer protections, or renewed debate over how much regulation is necessary. For organizations trying to make responsible decisions about AI today, the uncertainty only reinforces the need to establish their own safeguards rather than wait for Washington to settle the rules.

The Regulatory Landscape Is Getting Complicated

There is no single global rulebook for AI, and governments are taking different approaches.

The European Union has adopted the EU AI Act, a sweeping regulatory framework that classifies AI systems according to their potential risks. Applications considered especially dangerous face restrictions or outright bans, while high-risk uses—such as certain employment and education decisions—are subject to additional requirements. Its provisions are being phased in, with some implementation deadlines still evolving.

In the United States, the picture is considerably less straightforward. There is no comprehensive federal AI law governing all uses of the technology. Instead, federal agencies, state legislatures, and existing privacy and anti-discrimination laws all play a role.

California and Colorado, for example, have pursued legislation addressing AI transparency, consumer protections, and potentially discriminatory automated decisions. Other states are developing their own approaches.

For organizations operating across state or international boundaries, keeping track of these differences could become a significant challenge.

What Does This Mean for Nonprofits and Foundations?

It’s easy to assume AI regulation is primarily a concern for companies developing sophisticated AI models. But organizations that simply use AI may also have responsibilities, particularly when the technology influences decisions affecting people.

Consider a foundation using AI to evaluate grant applications, a nonprofit using automated tools to screen job candidates, or an organization entering sensitive donor information into an AI chatbot. Each situation raises important questions. Is the AI system making fair decisions? Is confidential information adequately protected? Can the organization explain how an AI-assisted decision was reached?

Even where specific AI regulations don’t apply, existing laws governing privacy, employment, and data protection may still come into play. And beyond legal compliance, there’s a reputational issue. For mission-driven organizations, maintaining the trust of donors, grantees, employees, and communities is essential.

Don’t Wait for the Rules to Settle

The regulatory environment will continue to evolve, but that doesn’t mean organizations should put AI adoption on hold. It means they need to approach it thoughtfully.

A good starting point is understanding how AI is already being used throughout the organization. You might be surprised by how many employees have incorporated AI tools into their daily work without formal approval or guidance.

From there, organizations should establish a few basic safeguards:

• Create an AI usage policy. Define which tools employees can use, what information they can share, and when human review is required.
• Protect sensitive data. Make sure confidential donor, employee, and organizational information isn’t being exposed through AI applications.
• Keep humans accountable. AI can assist with decisions, but important judgments—particularly those affecting individuals—should involve meaningful human oversight.
• Review your vendors. Understand how third-party AI providers handle data, security, and compliance.
• Stay informed. Assign someone responsibility for monitoring relevant regulatory developments and updating internal policies.

These steps aren’t just about avoiding penalties. They’re about making AI safer, more reliable, and ultimately more useful.

Good AI Governance Is Good Business

Here’s the encouraging part: You don’t need to become an expert in AI legislation to start preparing. Because many of the practices regulators are emphasizing—transparency, accountability, data security, and responsible oversight—are simply extensions of good IT governance. Organizations that already have strong cybersecurity practices, clear data-handling policies, and thoughtful technology oversight are starting from a much better position.

And for those that don’t? AI regulation provides another compelling reason to put those fundamentals in place.

AI regulation may be a moving target, but responsible AI use doesn’t have to be.

At CGNET, we help nonprofits and foundations adopt AI tools like Microsoft 365 Copilot while keeping security, privacy, and organizational needs front and center. From reviewing data permissions and developing practical AI usage policies to helping organizations evaluate AI tools and train employees, we can help you establish the guardrails needed to use AI responsibly. Contact CGNET to learn how we can help your organization prepare for what’s ahead.