What your organisation needs to decide about AI
Most of what a board needs to decide about AI has nothing to do with AI. It has to do with the data the organisation already holds, the permissions it already has, and the promises it has already made to members about how it would use both.
The pressure at the moment is to have a position on AI, and the people asking for one usually mean “should we buy something?” The right questions are smaller, older, and entirely within the board’s control.
What the privacy policy actually allows
Most membership organisations collect data under a privacy policy written for a particular set of uses: renewals, the newsletter, event bookings, the insurance scheme. Feed that data into an outside tool - a chatbot on the website, a system that flags which members are likely to lapse, a service that rewrites the newsletter for each reader - and the organisation may have stepped outside what members agreed to. Read the policy. If it doesn’t cover this, update it before doing anything else.
Who is allowed to put member data into an outside service
This is a management question, not a technical one. Anyone with a login and a browser can paste a membership list into a free AI tool and ask it to sort the members into groups. That may already be happening. The board doesn’t need to understand the tools. It needs a one-paragraph rule on what data leaves the building, and it needs every member of staff, and every volunteer with access, to have read it.
What you would tell members
If the organisation would happily explain what it was doing in the newsletter, it’s probably fine. If it would rather not mention it, that’s the answer. Most of the hard cases come out under this test, and it’s the test a member would apply.
What to leave alone
Almost everything else can wait a year. The tools are changing fast enough that anything bought now will be cheaper and better in twelve months. Locking into a platform, or restructuring a team around a technology that hasn’t settled, is a way of spending the money twice.
What won’t change is what sits underneath. Get the policy right, decide who can do what with the data, and settle what you’re willing to say out loud to the people whose data it is. Those three decisions will still be the right ones whichever tools the organisation ends up using, and whenever it ends up using them.
The technology is moving. The questions are not.