At the beginning of November, I served as a judge for the AWS Breaking Barriers 2026: AI For Good Hackathon event. It got me thinking about how one of the biggest opportunities with AI is moving the conversation from “What can AI do?” to “What real problems can AI solve?”
While technology moves quickly, successful AI adoption isn’t about using AI for the sake of it. It’s about identifying the right business problem and applying technology in a way that creates measurable value in a governed environment.
If you run technology for a nonprofit, this should resonate with you, especially because teams can be thin and on tight budgets. Different parts of your organization want to leverage AI to ease their workloads, but your responsibility for donor data pushes you to slow down, because a privacy incident involving your supporters isn't just an IT problem. Donors who lose trust don't come back, and for most nonprofits, trust is the entire operating model.
Fortunately, you don't have to choose between moving fast and protecting donor data. You just have to do AI in the right order, or do the right things to get it back on track. Here's how.
The adoption numbers are striking. In a December 2025 survey of 346 nonprofit organizations, the Virtuous 2026 Nonprofit AI Adoption Report found that 92% of nonprofits now use AI in some capacity, but only 7% report major impact from it.
That’s just one survey. Today, most organizations leverage AI in one way or another, and nonprofits follow suit. The pressure of adopting AI to work faster brings along risks. Most aren’t pausing to put policies in place or making sure there are guardrails. They are just using it and hoping for the best.
The risk rarely arrives through a dramatic breach. It usually arrives through everyday work:
A fundraiser pastes a major-donor list into an AI tool to draft personalized appeals. That donor information involving giving history, household details, and contact records now sits on a third-party server, possibly used to train a model.
A grant writer uploads a partially redacted client story to polish the narrative. The names came out, but the identifying details didn't.
A volunteer uses a personal AI account on a shared laptop because nobody gave them a sanctioned alternative.
This is shadow AI, and it’s happening within most organizations. While it’s not being used maliciously, shadow AI needs to be evaluated so you know how your team is using it. Then, you can take the next step towards formulating a governed AI policy.
Donor research consistently shows that 76% of donors say it's important for nonprofits to disclose when and how AI is used, yet only 26% of nonprofit professionals say their organization does this today. And roughly 31% of donors say AI use would make them less likely to give.
A donor data incident compounds this. When an incident happens, you can’t only think about remediation costs and notification letters. You’ll have to plan out the story you tell your community about why their generosity ended up in someone else's system. For organizations built on relationships, that's a steep cost.
You don't need to ban AI to protect donor data. You need structure. This is the same governed AI approach we build for credit unions, financial services firms, and manufacturers, adapted to the realities of a nonprofit budget and staff.
Most donor data exposure happens because well-meaning people don't know where the line is. Firm-wide AI training that includes what responsible use looks like, the difference between a free public tool and an enterprise environment, and what happens to a prompt after you hit enter is the cheapest risk reduction available.
You can't protect donor data flowing through tools you don't know about. Shadow AI governance gives you visibility into every AI platform your staff and volunteers actually touch, and in our experience, the first usage report is usually the surprise. Lead with education instead of punishment. Show people the safer path before you enforce one.
An acceptable-use policy answers the questions your team is already asking: Which tools are approved? What donor information can never be entered into an AI system? Who do we ask when we're unsure? It should be specific to your organization, formatted for your employee handbook, and updated as regulations evolve.
This is the step that makes the first three stick. You should pick one AI tool, whether that is ChatGPT, Claude, Copilot, or something else, that works best for you and your goals. With one tool, you can govern the environment and ensure that data that should be secure doesn’t end up as training material on a personal-use tool.
Nonprofits that follow this sequence get real capability without the exposure. Development staff draft donor communications in a governed environment where the donor CRM data stays under your control. Grant writers work faster without pasting client stories into public tools. Leadership can tell donors exactly how AI is used and what protects their information. That last part is very important because transparency plus verifiable controls are how you keep the donors who want disclosure on your side.
And you don't need to hire an AI specialist to get there. The platform, the policy updates, and the ongoing governance can run as a managed service, which matters when every dollar has a mission attached to it.
You don't have to do all four steps at once. You can start with training if you want visible progress before your next board meeting, visibility if you suspect shadow AI is already on your network (it probably is), or policy if the pressure you're feeling is "what are the rules?"
What you shouldn't do is wait for an incident to set the agenda.
NetCov's AI Opportunity Assessment is a structured review of your workflows, systems, and data. You get an AI readiness score, a risk and compliance map, prioritized use cases for fundraising and operations, and a 90-day roadmap, so you can get a practical picture of where AI can help your mission and where donor data needs protection first.
Schedule your AI Opportunity Assessment with NetCov today.
1. Is it safe for nonprofits to use free AI tools like ChatGPT with donor information?
No. Free, public AI tools typically process your inputs on the provider's servers, and their terms of service may allow those inputs to be reviewed or used for model training. When a fundraiser pastes a donor list into a free tool, that donor information leaves your control entirely.
The safe alternative isn't banning AI. It's giving your team a governed, enterprise-grade platform where data is encrypted in transit, never reaches the model providers' own servers, and is contractually guaranteed never to train a model. People will use AI either way. The question is whether they use it in an environment you control or one you can't see.
2. What donor information should never be entered into an AI system?
At minimum: full names paired with giving history, home addresses, phone numbers, email addresses, payment or banking details, and any beneficiary or client information your organization holds in confidence. Also, watch for indirect identifiers: a "partially redacted" client story that still includes a location, a rare medical condition, or a family circumstance can identify someone just as effectively as a name.
The right approach is a written acceptable-use policy that spells out exactly what's off-limits, which tools are approved, and who to ask when the answer isn't obvious.
3. How do we stop staff and volunteers from using unsanctioned AI tools?
Start with visibility. Most organizations have no idea how much AI usage is already happening on their network. The first shadow AI usage report is usually the surprise. Once you can see what's in use, lead with education. Explain the risks, show people the sanctioned alternative, and give them a tool that's genuinely better than the free one they're currently using. Only then enforce a block on unsanctioned platforms.
Blocking first, without a sanctioned alternative, doesn't eliminate the behavior. It just pushes it to personal phones and home networks, where you have zero visibility, and the risk is actually higher.
4. Does NetCov help Nonprofits figure out where to get started with AI?
Yes, NetCov can help nonprofits with getting started with AI, whether it’s a Shadow AI audit, an AI opportunity training, policy creation, or training. Our team of experts are here to help you get on the right path with governed AI.