67% of Australian Not-for-Profits Use AI Without Policies: Is Yours One of Them?

If you are reading this as an IT leader in an Australian not-for-profit, we bet you are already dealing with this:

Your fundraising team is using ChatGPT to draft donor appeals. Your comms manager swears by AI for social media content. Maybe someone’s even experimenting with Microsoft Copilot for meeting summaries. And you? You are lying awake, wondering: Should I have stopped this? Do we need a policy? What if something goes wrong?

This might actually help you sleep better: You’re not behind. You’re typical.

According to the 2025 Digital Technology in the Not-for-Profit Sector Report by Infoxchange, 67% of Australian not-for-profit organisations are now using generative AI in their work, mostly for content creation. AI tools are being adopted at twice the rate seen last year.

However, only 14% of not-for-profits have an official AI policy or guidelines in place.

That means 86% of Australian charities using AI are doing it without guardrails. No approved use policy, no risk assessment, no clear accountability. Your organisation is not an outlier. It’s experiencing exactly what hundreds of other not-for-profits are facing right now.

Why not-for-profit IT leaders are in an impossible position

Let’s acknowledge the reality you are working in.

Only 20% of small to medium not-for-profit organisations have an IT plan and budget for the next 12 months, compared to 56% of very large organisations. You are likely managing technology across an organisation where:

• The “IT department” is you, possibly part-time.
• Your board expects enterprise-level security on a community grant budget.
• Staff span from digital natives to volunteers who still print their emails.
• Every dollar spent on technology is a dollar not spent on mission delivery.

And now you are supposed to govern artificial intelligence? The same AI technology that has governments, Fortune 500 companies, and universities scrambling to figure out?

It’s not fair. But it is your reality.

Add that to the compliance deadline that most Australian not-for-profits do not know is coming.

New obligations about automated decisions in the reformed Australian Privacy Act

From the 10^th December 2026 the Privacy Act will require regulated entities to disclose in their privacy policies the types of personal information used in substantially automated decisions, the nature of decisions made solely or significantly by computer programs, and where those decisions could reasonably be expected to significantly affect individual rights or interests.

Translated into not-for-profit language: If you are using AI to make decisions about people (e.g. your donors, beneficiaries, volunteers, basically anyone), then you will need to disclose it publicly in your privacy policy by December 2026.

This is not a distant-future problem. It is only months away, and the organisations that wait until November 2026 to figure this out will be in crisis mode.

What counts as “substantially automated decisions”?

Think about your current AI use:

• Using AI to draft a newsletter = probably fine, no policy disclosure needed.
• Using AI to score grant applications = grey area, likely requires disclosure.
• Using AI to prioritise support requests or assess eligibility = definitely requires disclosure.

The key test: Could this AI-assisted decision significantly affect someone’s rights or interests?

If you are using Microsoft Copilot, Claude, ChatGPT, or any AI tool that helps make decisions about people, you need to be thinking about this now.

The good news: you don’t have to solve this alone, and you don't need a massive budget to get it right.

The free resources you probably didn’t know existed

Here is something that might actually make your job easier: A collaboration between the Australian Government’s National AI Centre (NAIC) and Infoxchange has created tailored AI adoption resources and templates specifically for the not-for-profit sector, including new training and advisory services.

NAIC’s 025 Guidance for AI Adoption provides a clear, practical framework purpose-built for not-for-profits to help use AI responsibly and support social justice.

The available free resources include:

1. Editable AI policy templates sized for small-to-medium not-for-profits.
2. Using AI to score grant applications = grey area, likely requires disclosure.
3. Using AI to prioritise support requests or assess eligibility = definitely requires disclosure.

You can access them here:

1. Guidance for AI adoption: foundations.
2. Planning tools and templates.
3. Explore practical activities to build confidence in using AI.

Your 3-Step Governance Starter Kit

You don’t need a 50-page AI governance framework. You need something you can actually implement this quarter.

Step 1: Document What’s Already Happening (2 hours)

Create a simple spreadsheet with these columns:

• Who is using AI? (team/role).
• What AI tools? (ChatGPT, Copilot, other).
• For what purpose? (content, research, analysis).
• What data are they putting into it? (public, internal, personal).
• Any concerns? (note anything that makes you uncomfortable).

Don't make this a witch hunt. Frame it as "We want to support you in using these tools safely." 50% of not-for-profits without an AI policy said they intend to formulate one. Your staff want guidance, not punishment.

Step 2: Create your “AI Acceptable Use” 1-pager (4 hours)

This is not your full policy. It’s the interim guidance your staff need right now while you build something more comprehensive.

Essential Elements:

• What's allowed: General use cases that are pre-approved (e.g., "AI can help draft content, but a human must review before publishing").
• What requires approval: Use cases that need IT/management sign-off (e.g., "Processing donor data through AI tools requires written approval").
• What's prohibited: Red lines that are never okay (e.g., "Never upload beneficiary case files, medical records, or sensitive personal information").
• Who to ask: Clear point of contact (probably you) for questions.

Pro tip: When deploying AI, consult the Office of the Australian Information Commissioner (OAIC), which has published guidance on privacy and the use of commercially available AI products. Use OAIC’s guidance when drafting your prohibited users. 

Step 3: Brief your Board (30 minutes + Q&A)

Your board needs to understand three things:

1. What is happening: "We're among the 67% of NFPs using AI; currently 86% of the sector lacks formal policies".
2. What the risk is: "Without governance, we face compliance issues (Dec 2026 Privacy Act), donor trust concerns, and potential data breaches".
3. What you're doing: "We're implementing a governance framework using government resources, and I need board approval to proceed".

What you’re asking for:

• Board resolution acknowledging AI use and authorising governance development.
• Small budget allocation (if needed) for training or consultation.
• Assignment of an AI governance champion (board member + staff lead).

What success looks like

By the end of next month, you should have:

1. A documented inventory of current AI use in your not-for-profit.
2. A one-page "AI Acceptable Use" guideline published to staff.
3. Board awareness and approval to develop full governance.
4. A timeline for Privacy Act 2026 compliance preparation.

You are not building enterprise AI infrastructure. You are creating a practical framework that protects your organisation, empowers your staff, and maintains donor trust, all while staying focused on mission delivery.

Conclusion

The biggest barriers to achieving not-for-profit technology goals are budgets, rising costs, access to affordable resources, and staff capability. You did not choose to become an AI governance expert. But as a not-for-profit IT leader, it's now part of your job.

Remember: You don’t have to do this alone. Professional Advantage is here to help. As a Microsoft Solutions Partner serving over 200 Australian not-for-profits and charities, we understand the industry’s landscape of limited budgets, high accountability expectations, and unique compliance requirements. We have helped Australian charities navigate AI adoption safely and affordably, with governance frameworks sized for your organisation.

Contact our technology specialists for a 60-minute, no-obligation consultation on AI governance for Australian not-for-profits.