AI governance for associations: what boards should ask

The short answer: a board does not need to understand how the technology works. It needs to know what AI the organization uses, who answers for it, what could go wrong for members, and how the board would find out. Seven plain questions to the chief staff executive get you most of the way there.

Board members tend to hold back on AI because they assume they lack the technical background. They do not need it. Boards govern outcomes and accountability, and they already do that for finances, risk and reputation. AI is one more place where the organization acts in the members' name.

Seven questions

1. Where is AI used in our organization, including inside software we already pay for? A good answer names functions and owners, and admits that the list is still being completed. A weak answer is "we don't really use it." Here is how to build the list.

2. Which uses touch member data, and where does that data go? The follow-up is whether any of it is used to train a vendor's models, and whether that is a contract term or an account setting that someone could change.

3. Which uses are member-facing? Chatbots, automated messages and AI-assisted communications speak in the organization's voice. Ask how anyone knows they are accurate. Here is what testing looks like.

4. Does AI play any part in decisions about individuals? Membership, credentials, awards, complaints and disciplinary matters carry real consequences. If AI touches any of them, the board should hear about it directly.

5. Who is accountable? One named role, not a committee and not "the team". If no one can be named, that is the finding.

6. What have we told members, and is it true? If the organization has published a statement about its AI use, ask what evidence supports each sentence. If it has not, ask when it will. Here is what a good statement contains.

7. How would we find out if something went wrong, and how fast could it be stopped? In ISACA's 2026 poll, roughly 56% of professionals were unsure how long it would take to halt an AI system during an incident. Your board should know the answer for your own systems, including the ones a vendor runs.

What good answers sound like

Good answers are specific, include things the organization has not finished, and name who will finish them. Be wary of answers that are reassuring but vague, such as "our vendors take care of that." Vendors do their part, but accountability to members stays with the organization.

Governance is not management

It is worth keeping a clean line between the two. The board's job is oversight: asking these questions, setting expectations and requiring evidence. Staff run the tools. When a board starts choosing products or configuring settings, it takes on operating responsibility it cannot discharge, and it loses the distance that makes its oversight credible. The same logic is why independent advice works best when it stays strategic and does not extend to implementation.

How often

Once a year is the floor for a full review. Beyond that, ask for a short update whenever a significant new tool is adopted or a vendor announces a material change, and add AI to the risk register if it is not already there.

What we do not know

We do not have data on how many association boards currently review AI at all, and we would be skeptical of anyone who claims to. What we see in practice is that boards that ask these questions once usually find the exercise less technical, and more useful, than they feared.

Where to start

If you want an outside view to bring to the board, our Board and Executive AI Advisory is strategic only: we help you frame the questions and read the answers, and we do not select, buy or configure tools for you. If you want an independent review of what is actually running, the AI Assessment is a fixed-price, three-week review, and the report stays confidential to you. The free AI Trust Readiness Scorecard takes about five minutes and is a quick way to start the conversation.