Independent counsel for the insurance decisions that matter most.

I've spent more than six years at Simpson | McCrady as an Account Executive, working with nonprofits of every size since day one. I'm a member of the Special Needs Consortium, where I serve on the board and the education committee. In those roles I've seen firsthand why nonprofit D&O insurance (Directors and Officers coverage) matters.

Recently I sat on a panel with respected peers, speaking with executive directors, staff, board members and donors. The question that got the biggest reaction was a simple one: can board members be sued personally?

Can nonprofit board members be personally sued?

Yes. Board members, officers, staff and volunteers can be named in a lawsuit alongside the organization, by employees, donors, regulators, creditors and even the people you serve. Even a claim without merit has to be defended, and legal bills hit small budgets hardest. D&O insurance is designed to pay defense costs, settlements and judgments when leaders are accused of a wrongful act, such as an error, a misleading statement or a breach of duty. That's why the details of your policy matter. As boards gather for year-end reviews and 2027 planning (in between fundraising campaigns and holiday functions), here are five questions I'd want every board to bring to the table.

1. Who counts as an insured?

A policy only protects the people it names. Many include current and former board members, officers, employees with certain managerial responsibilities, volunteers, committee members and the organization itself. Check whether yours does.

Two myths come up here. Volunteer protection laws limit some personal liability, but they don't stop a lawsuit, pay legal fees or protect the organization. And bylaws that promise to indemnify (reimburse) the board are only as strong as your bank account.

2. Is employment practices liability included, and at what limit?

Employees are the most common source of nonprofit D&O claims, from wrongful termination to discrimination, harassment and retaliation. Employment practices liability (EPL) coverage is built for these claims.

Some nonprofit management liability policies include EPL. Others sell it separately, and some programs lack it entirely. Ask whether you have it, what the limit is, and whether it's shared with the rest of the policy. Some policies also extend this coverage to claims brought by volunteers, so check whether yours does. A small staff doesn't mean small exposure.

3. Does everyone share one limit, and do legal fees come out of it?

This one surprises boards most. Most D&O policies have an aggregate limit, the most they'll pay for all claims combined in a policy year. In many policies, the organization, its leaders and any EPL claims all draw from that single limit, and defense costs usually reduce it rather than sitting on top of it.

In practice, a $1 million policy that spends $400,000 on defense has $600,000 left for a settlement, a judgment or the next claim. When leaders' interests differ and each needs their own attorney, that limit shrinks even faster. For illustration, picture an animal shelter whose donors sued the board over how it represented its finances. Three lawsuits followed, with defense costs over$530,000. On a $1 million shared limit, that alone would use more than half.

Ask your broker whether your limit fits your size, the number of people insured and your budget. Options can include separate limits for D&O and EPL, or an added limit just for individual leaders. Also ask about your retention, the amount the organization pays before the policy kicks in, much like a deductible. Make sure it's one your budget can handle.

4. Who handles the defense, and when are legal bills paid?

Some policies give the insurer a “duty to defend,” meaning it appoints and manages the attorneys. Others let you choose counsel and reimburse covered costs. Ask how much say your board has.

Timing matters too. Ask whether defense costs are advanced as bills come in or only reimbursed later, which can take months. For a nonprofit with tight cash flow, fronting those fees pulls money from programs and payroll. One catch: if a claim turns out not to be covered, advanced costs may have to be repaid.

Finally, know the settlement rules. Most policies require the insurer's consent before you settle or take on legal costs, and some include a “hammer clause” that can cap the insurer's payment if your board turns down a settlement it recommends.

5. What's excluded, and what happens if we merge?

Every policy has exclusions worth reading before you need them. Three to watch for:

·    Insured vs. insured: excludes or limits claims one insured brings against another, like one board member suing another. Some policies carve back certain claims, such as those by employees.

·    Prior or pending litigation: claims tied to lawsuits that existed before a set date are usually excluded.

·    Wage and hour: pay and overtime disputes are often excluded or capped.

If a merger or affiliation is on the horizon, talk with your broker before it closes. Many policies then cover only acts that happened before the deal.

Put nonprofit D&O insurance on your next board agenda

Bring these five questions to your next board meeting or year-end planning session. We're happy to review your policy and walk your board through it, no cost, no pressure. Reach me at 724-650-5145 or DGallagher@Simpson-McCrady.com, or visit our management liability page.

‍

‍

This article is a general guide, notlegal advice. Every policy and claim is different.

A best-practice guideline for preparing your facility or home for the safe use and storage of batteries and energy storage systems.

The Growing Risk

Lithium-ion (Li-ion) and lithium-polymer (Li-Po) batteries now power nearly every corner of modern operations: cordless tools and equipment, material-handling fleets, electric vehicles, micro-mobility devices, and the large stationary energy storage systems (ESS) that stabilize power supply and support renewable generation. Their high energy density, long service life, and fast recharging have made them the default choice. Those same qualities, however, concentrate a great deal of energy into a small, chemically reactive package. When a Li-ion battery is defective, damaged, poorly stored, or improperly charged, it can fail violently, releasing intense heat, toxic gas, and a self-sustaining fire that conventional extinguishers struggle to control.

The scale of the exposure is growing with adoption. Since the start of 2025 alone, the U.S. Consumer Product Safety Commission has issued 46 recalls and safety warnings for consumer products powered by lithium-ion batteries, and several high-profile facility fires have reshaped how regulators, fire officials, and insurers view the hazard. For any organization that uses, charges, or stores these batteries in more than trivial quantities, the question is no longer whether to manage the risk, but how thoroughly.

This guideline is a practical roadmap for our clients. It explains how and why these batteries fail, summarizes the emerging legal and regulatory landscape, and lays out configuration-specific best practices for preparing your facility, from a handful of tool batteries on a charging bench to a container-scale energy storage system.

Understanding the Risk

How lithium-ion batteries fail: thermal runaway

Nearly every serious Li-ion incident traces back to a single phenomenon: thermal runaway. It begins when one cell generates more heat than it can dissipate, often because of an internal short from a manufacturing defect, physical damage such as a puncture or crush, overcharging, deep discharge, or exposure to excessive heat. As the cell heats, it ignites its own flammable electrolyte; that heat spreads to adjacent cells, which fail in turn, producing a self-reinforcing chain reaction. Because the reaction generates its own oxygen, these fires are difficult to extinguish, can reignite hours later, and react violently with water where lithium metal is present.

Critically, failure does not happen all at once. It escalates through recognizable stages, and the earlier the failure is detected, the more options remain to intervene.

Beyond fire: toxic and environmental exposure

Li-ion fires are not only a combustion hazard. Burning cells release highly toxic gases, including hydrogen fluoride (HF) and per- and polyfluoroalkyl substances (PFAS, the persistent “forever chemicals”), that can injure the eyes, skin, and respiratory system and require evacuation. Water used to fight a battery fire can become contaminated with heavy metals such as cobalt, nickel, copper, and manganese, creating a risk of soil and groundwater pollution if it is not contained. After the January 2025 Moss Landing energy storage fire in California, which destroyed roughly 55,000 battery modules, EPA soil sampling detected several of these heavy metals at levels exceeding screening standards in the surrounding area.

The emerging legal and regulatory landscape

The regulatory picture is shifting quickly, and it increasingly reaches organizations that merely handle batteries rather than manufacture them. In May 2023, the EPA advised that most lithium-ion batteries on the market today are likely to qualify as hazardous waste under the Resource Conservation and Recovery Act (RCRA) based on their ignitability and reactivity. The agency is now developing a dedicated “universal waste” category for lithium batteries, with a proposed rule anticipated in 2026 and a final rule expected in 2027. At the state level, Extended Producer Responsibility (EPR) programs are expanding. Illinois requirements took effect January 1, 2026, and California has enacted both stewardship-plan obligations (AB 2440) and a point-of-sale recycling fee (SB 1215). Meanwhile, some states impose stricter hazardous-waste thresholds than the federal baseline.

The liability exposure is equally significant. Under the federal Superfund statute (CERCLA), cleanup liability is strict, joint-and-several, and retroactive: facility owners and operators, parties that arrange for disposal or recycling, and transporters can all be named, and even sending a small volume of defective cells to a contaminated site can expose a company to a share of the full cleanup cost. Following Moss Landing, the operator entered a CERCLA settlement in July 2025 to fund a cleanup expected to take two or more years. Organizations once considered removed from battery operations, such as auto dealerships handling EV batteries or retailers managing consumer returns, can now trigger hazardous-waste obligations, and California penalties can reach tens of thousands of dollars per day, with criminal exposure for knowing violations.

Foundations: Selection, Inspection, and Built-In Safeguards

Buy quality; avoid counterfeits

The single most effective way to reduce battery risk is to keep defective cells out of your facility in the first place. Purchase tools, equipment, and batteries from reputable manufacturers whose products are certified to the applicable Underwriters Laboratories (UL) standards, and buy replacement batteries and chargers only from the original equipment manufacturer (OEM) or its authorized vendors. Counterfeit and aftermarket batteries frequently omit the internal safeguards that protect genuine cells and are a leading contributor to failures. Where your application allows, consider lithium iron phosphate (LFP / LiFePO₄) cells, a Li-ion chemistry known for greater thermal stability and lower susceptibility to thermal runaway.

Inspect on arrival and before every use

Establish a quality-control step so a designated employee inspects new batteries on delivery, and personnel check batteries before each use. Remove from service, and dispose of properly, any battery showing bulging or swelling; cracked, broken, or discolored casings; excessive heat during charging or use; hissing; leaking; or smoke or unusual odors. Multimeters and digital or infrared thermometers support periodic, documented health checks. Keep a Safety Data Sheet (SDS) on file for every battery on site; these drive correct storage, handling, and emergency response.

Rely on built-in protections, but not on them alone

Quality Li-ion batteries include layered safeguards: a separator that shuts down ion flow as temperature rises, a pressure-relief vent, thermal interrupts and fuses, overcharge and short-circuit protection, temperature sensors, cell balancing, and a Battery Management System (BMS) that monitors state of charge, temperature, and cell health and can disconnect the pack when it detects an anomaly. These features reduce risk but do not eliminate it; facility controls remain essential.

Preparing Your Facility by Configuration

The right controls depend on how batteries are used and stored. The practices below address the configurations our clients most commonly operate; a summary of key setbacks and standards appears in the table at the end of this section.

General and bulk storage

Charging stations for tools and equipment

Most tool-battery incidents occur during charging. To avoid this:

Energy storage systems (ESS / BESS)

Stationary energy storage introduces the largest concentration of stored energy on many sites and warrants a design-led approach. New systems should be certified to UL 9540 (Energy Storage Systems and Equipment) and evaluated using the UL 9540A test method, which characterizes thermal-runaway fire propagation and informs required spacing, ventilation, and fire protection; battery units should be UL 1973-listed and inverters UL 1741-certified. Installations should follow NFPA 855 (Installation of Stationary Energy Storage Systems) and NFPA 70 (Article 706). For further continuity:

Material-handling equipment (forklifts and pallet jacks)

Electric material-handling fleets increasingly use Li-ion packs with decentralized “opportunity charging” throughout the operation. System best practices for this equipment include:

Electric vehicles and micro-mobility

E-bikes, e-scooters, and hoverboards are a frequent source of facility fires, and many jurisdictions now regulate them; in New York City, for example, e-bikes must be certified to UL 2849. As such, it is recommended that a policy be adopted that outlines the following:

Emergency Response and Incident Readiness

Even well-run facilities should plan for failure. Build a written emergency response plan around the principle that early action and fast evacuation save lives and property. It is heavily recommended that the local fire department be contacted and made aware of the type, configuration, and location of battery systems within your facility. Having their insight and input into the development of your emergency response plan is vital.

Detection and isolation. Train staff to recognize the early signs (unusual odor, discoloration, swelling, excessive heat, hissing, or smoke) and, only if it is safe to do so, to move a suspect battery away from combustibles into a fire-rated isolation container. Keep a pail of sand nearby as a smothering agent.

Small, incipient fires. Because battery fires emit toxic fumes, all untrained personnel should evacuate immediately. Only personnel specifically trained to fight small battery fires should attempt to do so, positioned between the fire and the nearest exit; if the extinguisher is ineffective, smoke becomes heavy, or the responder is at all uncomfortable, they should evacuate. If flames are subdued, submerge the battery in sand or douse with water as directed by the SDS; sand is the safer choice where lithium metal may be present.

Thermal runaway and large fires. No one should attempt to fight a thermal-runaway or large-scale fire. Activate the alarm, evacuate the building, and call emergency services, providing the battery type and size, the location, and any hazardous materials present, and hand the relevant SDS to responders when possible.

First aid. For eye or skin exposure, flush with water for at least 15 minutes and seek medical attention; move anyone exposed to fumes or smoke into fresh air and administer first aid or CPR as needed. Because effects can be delayed, exposed individuals should be evaluated by a medical professional.

Disposal and cleanup. Never place Li-ion batteries in general waste; route them to a certified recycler, and store damaged units awaiting pickup in a non-combustible container located about 25 ft (8 m) from occupied buildings. Provide containment or retention basins to capture contaminated firefighting water, consistent with the environmental exposures described earlier.

Source: Google Threat Intelligence Group (GTIG), “Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access” — May 11, 2026. This memo summarizes key findings and their implications for your organization’s risk profile.

The Big Picture: What Google’s Intelligence Team Found

Google’s threat intelligence team published a landmark report documenting a fundamental shift in how cyberattacks are being carried out: artificial intelligence has become a standard weapon in attackers’ arsenals. The following is what the report found actively occurring:

• AI is discovering security flaws automatically: For the first time, Google confirmed that a zero-day exploit (a previously unknown vulnerability) was developed using AI. Attackers used it to plan a mass exploitation campaign targeting thousands of organizations simultaneously.
• Malware is now designed to fool your defenses: Russia-linked and other state-sponsored hackers are using AI to write malware that camouflages itself with decoy code, making it harder for traditional security tools to detect. One malware family included 32 repetitive, benign-looking code queries just to appear harmless.
• Attacks are becoming autonomous: A new Android malware called PROMPTSPY operates without human supervision: it navigates your phone’s interface, blocks uninstallation by placing an invisible overlay over the uninstall button, and can be updated remotely even if its infrastructure is identified and blocked.
• Phishing has become surgical: Attackers are using AI to research company org charts, vendor relationships, and individual employee roles before crafting personalized emails. The days of easily spotted mass-spam phishing are giving way to targeted messages that reference real people, real vendors, and real projects.
• Your AI tools are now a target: A criminal group compromised widely-used AI software packages including a popular AI gateway tool, stealing cloud credentials that were then sold to ransomware groups. If your organization uses AI software, those integrations expand your attack surface.

Why This Matters for Your Business

• The barrier to entry for sophisticated attacks has collapsed: AI has made expert-level hacking accessible to a far broader pool of adversaries. You do not need to be a Fortune 500 company to be in the crosshairs.
• Time-to-impact is compressing: AI automates the steps between initial compromise and ransomware deployment. Incident response windows that used to be measured in days are shrinking.
• No organization is too small to be a supply chain target: Attackers do not always come at you directly. They compromise a software tool you and thousands of others use, gaining access to all of you at once.
• Deepfake impersonation is operational, not hypothetical: AI voice cloning is actively being used to impersonate journalists, executives, and public figures. Business email compromise and wire fraud schemes now have an audio and video dimension.
• Your risk profile has changed even if your operations haven’t: AI has materially increased the frequency and sophistication of attacks against organizations of every size. Coverage and controls that were adequate two years ago may not reflect today’s environment.

How Insurance Responds: Key Coverage Areas to Review

The Regulatory Landscape: What’s Coming and When

AI governance is shifting from best practice to legal obligation. The regulatory timeline is compressed, and organizations that wait for binding enforcement to arrive will face a harder and more expensive path to compliance. Cyber insurance carriers and enterprise procurement teams are increasingly referencing these frameworks in applications and vendor reviews.

Where Does Your Organization Stand? A 90-Day Roadmap by Maturity

Not every organization is starting from the same place on AI governance. Identify your current stage below, then focus your next 90 days on the actions listed for that tier.

What We Recommend Discussing with Your Advisor

• Audit your AI software footprint: Identify every AI tool, plugin, or third-party integration in use across your organization. Each one is a potential supply chain entry point.
• Review ransomware sublimits: Many policies introduced ransomware sublimits in recent years. Confirm those limits still reflect your actual exposure given AI-accelerated attack timelines.
• Evaluate social engineering coverage: Verify your policy covers AI-generated phishing and impersonation scenarios, and confirm that coverage does not depend on security controls you may not currently have in place.
• Confirm your incident response plan is current: Autonomous malware and faster attack timelines demand a response plan that has been tested within the past year. One written before AI-powered threats became standard is no longer adequate.
• Discuss re-underwriting if your AI usage has grown: If your organization has adopted new AI tools since your last renewal, disclose that proactively. It positions you as a more credible risk and prevents coverage disputes after a claim.

Additional Resources

The following resources are recommended by practitioners and referenced by regulators and insurers:

• NIST AI Risk Management Framework (AI RMF) — The primary U.S. federal standard for AI risk governance. Free, framework-based, and increasingly referenced in procurement and insurance. airc.nist.gov
• NIST AI RMF Playbook — Practical implementation guidance with mapped actions for each function of the RMF. airc.nist.gov/Docs/2
• ISO 42001 Overview — The international certification standard for AI management systems. Relevant for organizations with enterprise customers or international operations. iso.org
• EU AI Act Summary — Plain-language summary of the EU regulatory framework. Relevant for any organization that operates in or sells into European markets. artificialintelligenceact.eu
• CISA AI Security Guidance — Cybersecurity and Infrastructure Security Agency guidance on AI security. Practical and security-focused. cisa.gov/ai
• Cranium AI Governance Platform — A purpose-built tool for AI inventory management and continuous AI risk monitoring. cranium.ai