Resources

On April 2, 2026, NetHope released a landmark report titled "Mapping the Missing Middle." For the nonprofit sector, the findings are a wake-up call. The "Missing Middle" refers to a massive governance gap existing between high-level international regulations (like the EU AI Act or GDPR) and the small, often insufficient, internal rules that individual organizations write in their employee handbooks.

The warning is clear: Most nonprofit boards are operating in a vacuum. They assume that being "compliant" with the law or having an "IT guy or gal" means their data is safe. In reality, the strategic layer of governance: the part that translates global risk into daily operational tasks: is nonexistent.

At Association Options, we’ve spent decades helping leadership teams navigate complex transitions. What we are seeing today is a shift where data governance is no longer a technical checkbox; it is a primary fiduciary duty. If your board isn't discussing the "Missing Middle," you aren't just behind the curve, you're assuming a level of liability that could jeopardize your mission.

What Exactly is the "Missing Middle"?

In the private sector, there are massive frameworks and legal departments dedicated to "regulatory translation." They take a 500-page government regulation and turn it into 50 specific SOPs for the staff.

In the nonprofit world, we tend to skip that step. We see a new AI regulation or data privacy law, we read a summary in a newsletter, and then we tell the staff to "be careful with ChatGPT." According to NetHope’s research, the areas with the lowest governance coverage are those most specific to nonprofit operations. For example, funder-grantee data expectations have a dismal 9% coverage rate.

The "Middle" is the translation layer. It’s where a Board of Directors establishes a governance assessment that asks: How does this specific law apply to our unique member or donor data? What are the ethical boundaries of using AI to predict member churn?

Moving Data from the "IT Basement" to the Boardroom

For too long, nonprofit boards have treated data management like the plumbing of the building: you only think about it when there’s a leak. This approach is a violation of modern board of directors etiquette and fiduciary responsibility.

I recently sat in a board meeting where a director asked, "Why are we spending twenty minutes on data retention policies? Isn't that an IT task?"

My response was simple: "If your organization is sued because you kept sensitive beneficiary data ten years past its legal limit, the judge won't ask your IT manager why. They will ask the Board why they failed to provide oversight."

When leadership fails to own the data strategy, you get "digital hoarding." You get "access creep" where interns have the same database permissions as the CEO. Most importantly, you lose the trust of your members, stakeholders, and donors. Also, think about where all of your emails go as well. Is your personal email filled with emails from the organization over the past 20 years. That is all discoverable.

Policy Deep-Dive: Three Pillars of the "Middle"

To fill the gap identified by NetHope, boards need to move past generalities and focus on three specific, high-risk policy areas.

1. Data Retention and Disposal: The Liability of "Digital Hoarding"

Many nonprofits suffer from a "keep everything forever" mentality. Storage is cheap, so why delete anything? Just keep it all in your emails and files and it won't hurt us, but in fact it can.

From a risk perspective, every byte of data you keep is a liability. If you are breached, you are legally responsible for every record stolen. If you have data on a member or donor from 1998 that you haven't contacted in twenty years, that record is of zero value but carries significant risk. A "Missing Middle" policy defines exactly when data must be purged. It moves from a "PDF on a drive" to a scheduled, audited operational task.

2. Access Controls: Protecting the Vulnerable

NetHope found that data protection in low-infrastructure or high-risk settings is only covered in about 20% of nonprofit governance frameworks. Even for domestic associations, the risk is high.

Does your organization use Role-Based Access Control (RBAC)? If your marketing manager can see the private medical history of a scholarship applicant, your technology tools are not being governed correctly. The board’s role is to ensure that a system exists to restrict data access to the absolute minimum necessary for a staff member to do their job.

3. Ethical AI Use: Setting the Boundaries

AI is the newest inhabitant of the "Missing Middle." Most nonprofits are currently in a "Wild West" phase where staff members are feeding sensitive internal documents or member, sponsor, or donor lists into public AI models to generate reports.

Without a board-approved policy on Ethical AI, you are effectively allowing your data to be used to train external models without consent. A robust nonprofit toolkit must include boundaries on how AI processes community data.

The "Missing Middle" Checklist for Boards

If you want to ensure your organization is meeting its fiduciary duties, take this 5-point checklist to your next executive session. This is how you begin to close the gap NetHope has warned us about.

1. Do we have a sector-aligned AI governance framework? (Are we just following general "business" rules, or have we accounted for the specific ethical needs of our members, stakeholders, and donors?)
2. Are our funder-grantee data expectations documented? (NetHope found only 9% coverage here. Do your donors know exactly how their data is used, and do your grant-makers have clear requirements for data return or destruction?)
3. Is there a process for translating new regulations into operational tasks? (Who is responsible for reading the news and telling the staff, "We need to change how we collect this specific form field"?)
4. Have we audited access controls in the last 12 months? (Do former employees still have "ghost" accounts? Do junior staff have "God-mode" access to the database?)
5. Is our data retention policy actually enforced, or just a PDF on a drive? (Ask for a report showing when the last batch of expired data was permanently deleted.)

Strategy Over Software

One of the biggest mistakes in non-profit association management is thinking that a new software purchase will solve a governance problem. You can buy the most secure CRM in the world, but if your board hasn't defined who can see the data and how long it stays there, the software is just an expensive bucket with holes in it. It is a policy issue not a software issue.

NetHope’s "Mapping the Missing Middle" report isn't just a technical paper; it's a call for leadership. As NetHope notes, these gaps cannot be filled by broad regulations. They require frameworks built from operational experience.

If your board is feeling overwhelmed by the "information curve," you aren't alone. Most leadership teams are struggling to keep pace with the speed of digital change. However, ignoring the "Middle" is no longer an option.

"Governance is not a task you delegate to the IT person; it’s a standard you set as a leader," says William Pawlucy, President of Association Options. "The boards that survive the next decade of digital transformation will be the ones that stop looking at data as an 'IT issue' and start looking at it as the lifeblood of their mission."

Closing the Gap: Your Next Steps

Building a mature governance layer takes time, but the risks of waiting are too high. Whether you are dealing with past presidents syndrome where legacy systems are protected at all costs, or you're a young organization chasing squirrels with every new tech trend, you need a baseline.

At Association Options, we help boards look under the hood. We provide the governance assessment tools necessary to identify your "Missing Middle" and build a bridge to a more secure, ethical, and mission-aligned future.

Don’t let your data be a liability. Let’s build a framework that protects your members, stakeholders, and donors while empowering your staff to innovate safely.

Are you ready to audit your board’s digital oversight?
Contact Association Options today for a consultation on filling the gaps in your data governance and strategic planning.