Resources

Generative artificial intelligence (“AI”) is ubiquitous. Even those most skeptical of AI almost certainly use AI as matter of routine, whether through the spell-check feature in Microsoft Word, the auto-correct feature in text messages, the auto-complete feature in various applications, web searches, closed-captioning, digital traffic maps, smart home devices, suggested responses on Gmail, Siri, and so forth. At this point in time, it is not realistic to imagine a business where AI is not used in some form. Even so, nonprofit organizations should carefully weigh the benefits of AI against legal and reputational risks. For example, a nonprofit may wish to authorize the use of AI to capture committee or working group notes, but, might there ever be times when such authorization is imprudent, for example, if a committee or working group is discussing sensitive, confidential, or proprietary information? Consider another example where a nonprofit uses AI to assist in the peer review of a journal article. This could be efficient and highly valuable, but it also could prompt legal, reputational, or scholarly concerns.

As technology evolves, AI will become more and more intertwined into the fabric of nonprofit operations. Nonprofit leaders should thoughtfully consider the promise and perils of AI with respect to their organization’s specific needs and should thoughtfully craft policy and practice that is tailored to the nonprofit’s specific needs, all the while managing legal and reputational risks and aligning policy with accepted practices, industry standards, and strategic aspirations. This article outlines legal, reputational, and other risks related to AI and outlines some strategies for managing those risks.

1. Primary Risk Areas
While the promise of AI presents transformative opportunities, the use of generative AI presents legal and other risks that must (and can) be managed. Primary risk areas include intellectual property[1] ownership, use, and infringement, privacy and data security, discrimination, and tort liability. These risks are borne from a complicated web of evolving federal, state, and international laws related to privacy and data security and, to a lesser extent, to AI itself, that in many ways intersect but that all have various nuances. In addition to legal risks, AI also may present reputational risks. While the potential risks are significant, appropriate risk mitigation measures can reduce both legal exposure and reputational risk.

A. Who owns the copyright to AI-generated content?
The U.S. Copyright Office will only register an original work of authorship that has been “created by a human being.”[2] The Office’s Compendium of Copyright Office Practice clarifies that “the Office will not register works produced by a machine or mere mechanical process that operates randomly or automatically without any creative input or intervention from a human author.”[3] To evaluate ownership claims, the Office will look at “whether the ‘work’ is basically one of human authorship, with the computer [or other device] merely being an assisting instrument, or whether the traditional elements of authorship in the work (literary, artistic, or musical expression or elements of selection, arrangement, etc.) were actually conceived and executed not by man but by a machine.”[4] The U.S. Copyright Office reaffirmed this position, most recently in an August 30, 2023 call for comments published in the Federal Register, but, in so doing, acknowledged the inherent challenge in discerning between AI-generated content and human-generated content, especially when a new work had both human and artificial imprints. As it reflected, “Although we believe the law is clear that copyright protection in the United States is limited to works of human authorship, questions remain about where and how to draw the line between human creation and AI-generated content.”[5]

The law governing copyright rights with respect to AI-generated content is novel and rapidly evolving.[6] Based on existing law, nonprofit organizations should assume that they have no intellectual property rights in and with respect to AI-generated content. As a matter of course, nonprofit should require human authors to substantially and materially contribute to any nonprofit work product.[7] Nonprofits should revise existing author and speaker agreements (both for volunteers and paid contributors) to require a written attestation from employees, contractors, and volunteer authors and speakers representing and warranting that (i) any submitted content has been revised substantially such that the author/creator has all necessary rights to assign or license the work to the nonprofit and (ii) the submitted content does not infringe the intellectual property rights of any third party. As discussed later in this article, that same attestation should also address defamation, privacy, and other third-party rights. At least for paid contributors, the author/creator should indemnify the nonprofit for any breach of these representations and warranties.

B. What third-party intellectual property rights exist that could be leveraged into an actionable claim against a nonprofit for the improper use of AI?
Under U.S. copyright law, a copyright holder has the sole and exclusive rights to create derivative works from the underlying copyrighted work, unless the author assigns or licenses that right to a third party. “[A] ‘derivative work’ is a work based upon one or more preexisting works, such as a translation, musical arrangement, dramatization, fictionalization, motion picture version, sound recording, art reproduction, abridgment, condensation, or any other form in which a work may be recast, transformed, or adapted.”[8]

Assume that an author/contributor submits an original work that relies, in part, on AI-generated content and that the nonprofit publishes the work on its website and distributes the work to its membership. Assume also that the AI-generated content that is embedded in the submitted work infringes someone else’s copyright. It is possible, in this circumstance, that the third party whose copyright was infringed may have actionable claims against the author and against the nonprofit that published and redistributed the work. Ultimately, an infringement claim will hinge on the facts, focusing on the extent of the infringement, as well as an analysis of whether the appropriated content amounts to permissible use under the Fair Use Doctrine.

The factual analysis, though, is hardly simple. Even the U.S. Copyright Office is not certain how to distinguish new works from derivative works when AI is used in the development of a work. They have asked for public input on (1) “whether or when the use of copyrighted works to develop datasets for training AI models (in both generative and nongenerative systems) is infringing”; (2) “the proper scope of copyright protection for material created using generative AI”; and (3) how liability should be apportioned for AI generated content that infringes upon a copyright.[9]

As before, risk can be mitigated by requiring human authors to indemnify the nonprofit for works that infringe upon third-party intellectual property rights.[10] Indemnity essentially transfers risk from the nonprofit to the submitting author, thus protecting the nonprofit from any liability that might arise from third-party intellectual property claims. That being said, for volunteer authors, it often can be difficult to get them to agree to such indemnification.

C. What are the legal risks of using AI with respect to privacy and data security?
Nonprofit organizations use of AI, while embedding great promise, also carries substantial risk, especially with respect to privacy and data security.[11] AI relies on inputted data to generate new data. It does not differentiate between public data and personally identifiable information (“PII”) or confidential information. Because PII is so heavily regulated by federal, state, and international law, nonprofits should not allow staff, contractors, volunteer contributors, or other agents to input PII into an AI application unless comprehensive compliance measures are implemented and enforced. For other reasons—namely to safeguard confidential, proprietary, sensitive, and/or attorney-client privileged information—nonprofits also should prohibit staff, contractors, volunteer contributors, and other agents from inputting confidential, proprietary, or sensitive information or privileged content of any sort into any AI application—even if the “sharing”/”learning” feature of the AI application is disengaged, as can be done with paid and enterprise versions of most of the leading AI platforms.

If it is not possible or practicable to segregate PII or other confidential information—for example, if a nonprofit uses targeted advertising to tailor member or donor experiences—the organization should implement additional risk mitigation measures to comply with federal, state, and international data privacy laws. While each of these laws contains various nuances, in general, these robust laws derive from a uniform set of principles that endeavor to protect PII from unauthorized disclosure by (1) requiring organizations to obtain informed consent prior to collecting and using PII, (2) requiring that organizations provide an opportunity for individuals to change their preferences at any time about whether and how their data will be used, and (3) requiring organizations to provide a mechanism for individuals to access personal data. A robust privacy and data security policy, coupled with aligned organizational practice, can help to mitigate liability for a data breach. Where a nonprofit relies more heavily on sensitive PII, we recommend engaging expert privacy counsel to (1) determine applicable data privacy laws, (2) review and classify all existing data that may be used by the AI application, (3) identify the purpose and use of the data in a clear and articulable way, (4) develop a compliance plan, and (5) monitor compliance over time and take appropriate action in the event of noncompliance.

D. What are the legal risks of using AI with respect to discrimination?
In an October 2023 Executive Order, President Biden acknowledged the perils of AI in perpetuating discrimination: “Artificial Intelligence systems deployed irresponsibly have reproduced and intensified existing inequities, caused new types of harmful discrimination, and exacerbated online and physical harms.”[12] Indeed, because AI relies on pre-existing inputted data, it can inadvertently replicate and perpetuate bias and discrimination. We have seen this play out most prominently in the human resources context, where AI resume review has the potential to introduce unlawful bias into the hiring process, exposing nonprofit and for-profit entities to legal liability under Title VII of the federal Civil Rights Act, state employment laws, and other federal, state, and local laws. Here, especially, it is critical for human reviewers to analyze and test for bias and/or discrimination.

While discrimination only creates legal exposure in certain contexts (e.g., employment), algorithmic bias may have other adverse implications for nonprofit organizations as well. Imagine, for example, that a nonprofit inputs 50 years of journal articles into a generative platform that conducts AI “peer reviews” of scholarly works. The peer review function draws from past scholarship to generate feedback on new works. Quite possibly, the generative feedback could rely on outdated nomenclature or debunked data in producing reviewer feedback that may be offensive, at best, or replicate biased or discriminatory scholarship, at worst. Whether or not that undesired result materializes, it is almost assured that use of an AI application of this sort will privilege existing content over novel theories, which could result in stagnation and stale scholarship, among other potential adverse consequences.

To best guard against this undesirable outcome, humans should always review AI processes and outputs for bias and/or discrimination and should record efforts to test for bias (e.g.,documentation of a hiring process, meeting minutes) or submit an attestation as an accompaniment to submissions fixed in any tangible medium (e.g., written works, artistic works, videos, recordings, etc.).

E. What are the legal risks of using AI with respect to tort liability, scholarly reputation, and academic/professional integrity?
AI-generated content is not always accurate, potentially bearing on the reputation of a scholar, a scholarly publication, or a nonprofit publisher. To the extent that a statement of fact is not only false, but also adversely bears on a person’s reputation, the publication of the false statement could expose an author and/or publisher to liability for defamation. Again, sufficient human vetting is the best risk mitigation strategy to capture and correct factual inaccuracies. In addition, nonprofits should consider requiring that authors affix a conspicuous disclaimer to any submissions incorporating AI-generated content signaling that “the content was produced with the assistance of artificial intelligence” and that “the author/creator(s) reviewed and edited the content as needed and take(s) full responsibility for the content of the publication.” Disclaimers of this sort likely also will satisfy the ethical requirements embedded in some international AI laws.

2. Policy Development and Insurance Coverage
Nonprofit organizations should develop and implement written AI usage policies, informed by the considerations outlined in this article as well as input from stakeholders familiar with various aspects of the nonprofit’s governance, management, and operations (e.g., legal, technology, membership, finances, human resources, scholarly and educational departments, etc.). Some nonprofits have developed AI usage policies that cover everyone who uses AI for or on behalf of the organization (such as staff, contractors, and volunteer contributors), while others have created different policies for different sets of users. Generally, and at a minimum, such policies should set forth a purpose, define material terms, scope coverage, describe permitted and prohibited uses of AI, require disclosures and disclaimers, and describe potential consequences of non-compliance. Because international data privacy and AI laws vary and continue to evolve, and because AI itself is rapidly evolving, nonprofit organizations should commit to revisiting the policy(ies) on a periodic basis to ensure that it/they remain(s) legally compliant, reflect(s) best practices and industry standards, and meet(s) the nonprofit’s needs.

In addition, nonprofits should review their directors and officers liability and cyber insurance coverage, as well as their errors and omissions liability (sometimes called media liability) insurance coverage, to ensure that potential claims arising from the nonprofit’s use of AI are covered to the greatest extent possible. Nonprofit organizations should work closely and proactively with their insurance broker and legal counsel to do everything possible to minimize insurance coverage gaps in these areas.

3. Conclusion
While the promise of AI presents transformative opportunities for nonprofits, the use of AI presents legal and other risks that must be managed and mitigated. Nonprofits should thoughtfully consider the benefits and perils of AI and craft thoughtful policies that appropriately circumscribe use in a legally compliant and ethical manner that, in all instances, aligns with the nonprofit’s values, ethics, policies, and unique circumstances. Finally, be sure to revisit such policies on a regular basis, as this is, without question, a rapidly evolving area for every nonprofit organization.

[1] While “intellectual property” includes copyrights, trademarks, patents, and trade secrets, for the purpose of this article, it is primarily referring to copyright.
[2] U.S. Copyright Office, Compendium of the U.S. Copyright Office Practices at 7 (3d ed. Jan. 28, 2021).
[3] Id. at 21-22.
[4] Id.
[5] U.S. Copyright Office, Artificial Intelligence and Copyright, Fed. Reg. Vol. 80, 59943 (Aug. 30, 2023).
[6] In March 2023, the U.S. Copyright Office launched an initiative to examine copyright law and policy in relation to AI. It issued its first report on Digital Replicas on July 31, 2024. For more information, see https://www.copyright.gov/ai/ (last visited Aug. 5, 2024).
[7] U.S. Copyright Office, Artificial Intelligence and Copyright, Fed. Reg. Vol. 80, 59943 (Aug. 30, 2023) (contributions must be more than de minimis).
[8] U.S. Copyright Act, 17 U.S.C. §1101.
[9] U.S. Copyright Office, Artificial Intelligence and Copyright, Fed. Reg. Vol. 80, 59943 (Aug. 30, 2023).
[10] U.S. Copyright Office, Artificial Intelligence and Copyright, Fed. Reg. Vol. 80, 59943 (Aug. 30, 2023) (contributions must be more than de minimis).
[11] President Biden’s Executive Order, Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (Oct. 30, 2023). Note that this Executive Order merely directs federal agencies to develop policies and procedures regarding the use of AI and does not apply to nonprofit organizations, but it does provide an excellent overview of some of the benefits and perils of AI.
[12]President Biden’s Executive Order, Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (Oct. 30, 2023).

“ESG” refers to the three broad pillars of Environmental, Social, and Governance which have become increasingly important in assessing certain for-profit businesses, especially publicly traded ones. With ever-intensifying demands from regulators, investors, and the public for attention to ESG issues, for-profit companies are increasingly focused on ESG considerations, initiatives, and compliance. ESG-related shareholder and class-action litigation and governmental investigations and enforcement actions in the corporate world have expanded at a rapid clip. In addition, regulators both in and outside of the United States have promulgated new mandatory rules, disclosure obligations, and enforcement mechanisms for ESG-related conduct. The Securities and Exchange Commission (“SEC”), the Federal Trade Commission (“FTC”), and state Attorneys General have taken the regulatory enforcement lead domestically.

While there are no universal definitions of ESG, the three primary ESG pillars generally involve the following issues, among others: Environmental (climate change, resource depletion, waste and pollution, and deforestation); Social (working conditions, employee relations and DEIA, health and safety, local communities (including indigenous communities), and conflict and humanitarian crises); and Governance (board diversity and structure, executive compensation, and ethics).

While ESG is a broader concept than Diversity, Equity, Inclusion, and Accessibility (“DEIA”), it includes and incorporates DEIA. DEIA programs fostering the hiring and promotion of workers from racial and ethnic minorities, women, members of the LBGTQ+ community, diverse religious groups, and others have been prominent in corporate America in recent years.

For-profit corporations have been under enormous scrutiny as of late regarding their hiring and promotion policies and practices – from both the left and right sides of the political aisle. A number of states have passed laws and issued executive orders both requiring, and in some cases prohibiting, DEIA practices. Most recently, the U.S. Supreme Court’s June 2023 decision banning race-conscious college admissions – and the rationale underlying it – have raised concerns about the ruling’s potential broader implications, particularly in federal employment law, and perhaps even more broadly, such as in connection with contracting, fellowships, scholarships, and internships, and federal funding. And even in advance of future court rulings, concerns have been raised about some employers’ curtailing of current, and halting new, diversity efforts in the workplace.

ESG and DEIA are controversial in some circles. There is a growing attack from the political right on corporate policies aimed at diversity in hiring and promotion and other social and environmental goals in the form of lawsuits, requesting agency investigations, congressional investigations, public pressure, and in other ways.

So, what does any of this have to do with nonprofits? While nonprofit, tax-exempt nonprofits are not subject to the specific ESG regulatory requirements and legal standards applicable to certain for-profit companies (such as those enforced by the SEC), nonprofits have incorporated DEIA into their programs, activities, governance, and operations for years, and are increasingly voluntarily incorporating ESG principles and practices into their organizations. They may do so under pressure from their boards of directors, donors, members, employees, grant-makers, sponsors, advertisers, exhibitors, and other third parties. They also may do so in order to attract and retain a younger generation of staff that is increasingly sensitized to and mindful of ESG principles.

In doing so, nonprofits expose themselves to potential legal jeopardy in a wide array of areas. This article explains the legal risks inherent with ESG-related initiatives for nonprofits and provides practical tips and guidance on how nonprofits can effectively mitigate those risks.

The Primary Legal Risks of Nonprofit ESG Programs

When an nonprofit voluntarily decides to weave ESG principles and practices into its organizational and operational fabric, it is taking on a certain degree of legal risk. To be sure, that risk is not anything remotely like the risk faced by for-profit companies – particularly publicly traded companies – that are subject to ESG statutory and regulatory mandates from the SEC and elsewhere. Nonprofits are not subject to such mandates. Nonetheless, nonprofits do face ESG-related legal risks.

Here is a non-exhaustive list:

Employment Law: ESG initiatives – and particularly those that involve DEIA issues – can involve changes to hiring and promotion practices, workplace diversity, and employee compensation and benefits, which can trigger employment-related legal risks such as discrimination, harassment, and wrongful termination. This is nothing new and laws like Title VII of the federal Civil Rights Act and state equivalents have been applied to nonprofit employers for over 50 years. But what is new is the potential impact of the U.S. Supreme Court’s June 2023 ruling (Students for Fair Admissions v. Harvard and Students for Fair Admissions v. University of North Carolina) rejecting race-conscious admissions in higher education. While the new decision does not impede employers from pursuing diversity in their workforces (as it is limited solely to higher education admissions), many experts maintain that, as a practical matter, the ruling will likely discourage some employers from putting in place ambitious diversity policies in hiring and promotion – or prompt them to rein in existing policies – by encouraging new lawsuits in the employment arena under the new legal standard. In principle, the logic of the Court’s ruling on college admissions could threaten employer programs that, as of today, can take race into account, such as if members of a racial minority were previously excluded from a job category or to remove obstacles (such as unconscious bias) that prevent employers from having a more diverse workforce. But the more meaningful effect of the Court’s decision is likely to be greater pressure on policies that were already on questionable legal ground. These could include staff leadership acceleration programs or internship programs that are open only to members of underrepresented minority groups.

Contracts (Including Fellowships, Scholarships, and Internships): Section 1981 of the federal Civil Rights Act of 1866 prohibits racial discrimination in contracting. The law, which was passed after the Civil War to protect the rights of people freed from enslavement, is limited solely to race discrimination and does not apply to discrimination based on other protected characteristics, such as other forms of discrimination prohibited by Title VII of the federal Civil Rights Act of 1964.

In 2023, the American Alliance for Equal Rights (“AAER”) – led by the same conservative activist (Edward Blum) who filed the higher education affirmative action cases described above – sued Fearless Fund Management LLC, a Black women-run venture capital fund, for claims of racial discrimination and violations of Section 1981, using the reverse discrimination rationale underlying the U.S. Supreme Court’s 2023 decision regarding race-conscious college admission practices. AAER alleges that the Fearless Fund is operating a racially discriminatory program called the Strivers Grant Contest that violates Section 1981’s “guarantee of race neutrality” in making “contracts.” AAER claims that the Fearless Fund’s grant program discriminates against other races by awarding $20,000 grants, business support services, and mentorship specifically and only to Black women-owned businesses. The lawsuit was settled in September 2024, with the Fearless Fund agreeing to terminate its grant program for Black women-owned businesses.

AAER also filed lawsuits in 2023 against two national law firms that have operated paid diversity fellowship programs for many years aimed at bolstering diversity and inclusion in their attorney ranks. The lawsuits allege that the paid fellowship programs – which are limited solely to certain underrepresented groups in the legal profession, such as students of color, those who identify as LGBTQ+, and those with disabilities – are a violation of Section 1981 by illegally discriminating against students on the basis of their race. Because these fellowships require students to enter into contracts with the law firms, the lawsuit alleges they are covered by Section 1981.

If these lawsuits – and/or others like them which have been filed and are working their way through the courts – are ultimately successful, it is not at all inconceivable that the result would be a prohibition of numerous nonprofit fellowship, scholarship, internship, and other programs (where contracts are involved) aimed at increasing diversity and inclusions.

State Laws and Executive Orders Restricting DEIA Policies, Trainings, and Practices: Since 2022, Florida’s Individual Freedom Act, or the so-called “Stop-WOKE” law, restricts diversity related training in private Florida workplaces – including nonprofits based in Florida or (presumably) which have Florida-based employees – and also bars the teaching of critical race theory in K-12 schools and universities. That law is currently the subject of litigation and is working its way through the courts. In 2022, Texas Governor Abbott issued a memorandum to state agencies warning them to not use any DEIA programs in hiring that are “inconsistent” with Texas law, including setting diversity goals or interview targets for diverse candidates. While the memorandum is limited to public employers, it is unclear whether the Governor may take similar action toward private employers in Texas. While California had adopted laws requiring certain racial and ethnic, as well as gender, diversity on boards of directors of public companies headquartered in California, both laws have been struck down by courts and appeals are underway.

Observers widely expect a proliferation of such laws and executive orders restricting DEIA policies, trainings, and practices, particularly in certain politically “red” states. Beyond the employment realm, it would not be surprising to see new state laws and executive orders that could effectively prohibit DEIA initiatives in other aspects of nonprofit governance and management, such as board composition, volunteer leader selection, grantmaking, contracting, and government grants, contracts, and cooperative agreements.

Misrepresentation and Greenwashing: There is a risk of publicly misrepresenting or overstating a nonprofit’s ESG performance, which could lead to charges of “greenwashing” or otherwise engaging in deceptive or misleading conduct. This could result in donor or member backlash, reputational damage, and potentially even regulatory enforcement by the FTC (for trade and professional associations) or state Attorneys General, as well as private litigation. While nonprofits should always be mindful of these longstanding risks of making misleading or non-substantiated claims in connection with all of their programs and activities – well beyond ESG – the legal and public relations risks can be particularly acute here.

Member “Derivative” Suits: Trade and professional associations that incorporate ESG into their investment policy statement and base investment decisions, in part, on ESG criteria and then face material investment losses may risk being on the opposite end of “derivative”-type lawsuits from members alleging that the association’s board of directors and/or investment committee were not prudent stewards of the organization’s resources. Such lawsuits also can be brought by state Attorneys General in the association’s state of incorporation.

Date Privacy and Security: Nonprofits’ ESG activities often involve, in part, collecting, processing, and storing sensitive data about volunteer leaders, employees, donors, members, and other stakeholders. There is a risk of data breaches or mishandling of information, which could result in legal action, regulatory penalties, and reputational harm. If a data breach occurs, there is an ever-increasing web of requirements imposed by state, federal, and international laws that must be followed.

Mitigating the Legal Risks of Nonprofit ESG Programs

To mitigate these legal risks, there are a number of proactive steps that nonprofits can take. Below is a non-exhaustive list:

• Design scholarship, fellowship, grant, and similar programs using race-neutral criteria which are designed to accomplish the purpose of the scholarship, fellowship, grant, or other program.
• Ensure that your nonprofit’s employment policies and practices are fully compliant with all current federal and state legal standards in areas involving discrimination, harassment, wrongful termination, and otherwise. This necessarily means ensuring that any current or future employment diversity initiatives are narrowly tailored as permitted by current law and do not result in reverse discrimination. It also means not overreacting to the June 2023 U.S. Supreme Court decision involving race-conscious college admissions but keeping a close eye on future legal developments in the employment context. For those nonprofits with remote employees in different states, remember that state employment laws generally apply to any employee who regularly works from the state, irrespective of where the nonprofit is based. Be sure to always consult with employment counsel fluent in both federal law and the laws of the applicable states. Finally, outside of the workplace setting, keep an eye on future rulings from the U.S. Supreme Court and other courts that could apply the rationale underlying the college admission decision to other aspects of nonprofit governance and management, for instance, in connection with contracting, fellowships, scholarships, or internships, or federal funding.
• While Florida’s Individual Freedom Act restricts diversity related training in private Florida workplaces – including nonprofits based in Florida or (presumably) which have Florida-based employees – most other state laws and executive orders to date that restrict DEIA policies, trainings, and practices do not apply to nonprofits. But that may well change in the coming months and years, particularly in certain “red” states. It is important to stay on top of all new state developments in this area – both those affecting the workplace and potentially other aspects of nonprofit governance and management, such as board composition, volunteer leader selection, grantmaking, contracting, and government grants, contracts, and cooperative agreements – and take all necessary steps to comply with them.
• Ensure that all public statements regarding your nonprofit’s ESG performance are accurate, fully substantiated with appropriate data and documentation, and not in any way overstated, misleading, or deceptive.
• Working with a professional investment advisor, adopt an investment policy statement that reflects the nonprofit’s priorities, goals, risk tolerance, and financial needs but that is defensible as being reasonable, prudent, and appropriate. Be sure to revisit it on a regular basis and update it as needed.
• Implement strong data privacy and security measures to protect sensitive information about nonprofit volunteer leaders, employees, donors, members, and other stakeholders and to mitigate the risk of data breaches or mishandling of such information. If a data breach occurs, be sure to closely follow the ever-increasing requirements imposed by state, federal, and international laws.
• Develop clear and consistent ESG policies and practices that align with your nonprofit’s values, mission, and stakeholder expectations.
• Regularly engage with donors, members, and employees to ensure that your nonprofit’s ESG initiatives are transparent and meet their needs.
• Maintain up-to-date knowledge of applicable state, federal, and international ESG-related laws and regulations, and ensure full compliance with them.
• As with all areas of legal risk management, work with experienced legal counsel to help your nonprofit navigate the complex and ever-changing legal landscape governing ESG initiatives.

Conclusion

While ESG initiatives are not regulated for nonprofits as they are for certain for-profit companies, for a variety of reasons, nonprofits are increasingly voluntarily incorporating ESG principles and practices into their organizations and operations. In doing so, nonprofits expose themselves to potential legal risk in a wide array of areas. That being said, if properly understood and appreciated by nonprofit executives and leaders, those risks can be effectively mitigated by incorporating a number of practical tips and suggestions.