86% of AI-Adopting Nonprofits Have No Governance Framework

The Infoxchange 2025 Digital Technology in the Not-for-Profit Sector Report surveyed 824 organisations across Australia and New Zealand. The findings describe a sector that is adopting AI at speed while governing it almost not at all.

67% of surveyed organisations are now using AI in some capacity. Only 14% have developed AI-specific policies or governance frameworks. That is an 86% governance gap among AI-adopting nonprofits -- not a gap between aspiration and action, but between adoption and the most basic institutional safeguards.

The report surfaces another striking shift: evidence-based decision-making has jumped from 17% to 44% as the sector's number one digital priority. This is a threefold increase in a single reporting cycle. Organisations are telling researchers that they want to make decisions based on evidence rather than intuition -- but the infrastructure to capture, structure, and audit that evidence largely does not exist.

Meanwhile, 45% of organisations fall into the "At-Risk" category for IT strategic planning. Only 23% have a cyber security plan. The sector is not failing at any single dimension -- it is under-governed across every dimension simultaneously.

The governance gap is not a mystery. It is a resource problem compounded by a structural one.

Budget pressure is the number one challenge reported by surveyed organisations, and it has been for years. 70% of respondent organisations have fewer than 20 staff. The average technology spend is AU$4,592 per full-time equivalent -- a figure that covers devices, internet, software licences, and whatever is left for anything else. There is no line item for governance infrastructure, because governance infrastructure has historically meant either expensive consultants or enterprise GRC platforms designed for organisations with compliance departments.

The result is predictable. Organisations that cannot afford a dedicated IT person -- let alone a governance specialist -- are not going to purchase, configure, and maintain governance tooling. They are not going to draft AI ethics policies from scratch. They are not going to build audit trail infrastructure. They will do what under-resourced organisations have always done: adopt the tools that make their work easier and deal with the governance implications later, if at all.

This is not negligence. It is triage. When you have 15 staff, a constrained budget, and increasing demand for services, writing an AI governance policy is not where the day starts. But the legal and institutional obligations do not scale with the budget. A 15-person charity has the same duty of care around data, the same obligations to stakeholders, and -- increasingly -- the same regulatory exposure as a 1,500-person enterprise. The governance requirement is fixed. The capacity to meet it is not.

The report captures a paradox that extends well beyond the nonprofit sector but is particularly acute within it. Organisations are adopting AI faster than they are governing it, and they know this is a problem.

50% of respondent organisations cite security and ethics concerns related to AI. But only 14% have translated those concerns into policies, frameworks, or operational safeguards. The report states it directly: "adoption is outpacing development of strategies, governance frameworks, or safeguards."

This is not a knowledge gap. The sector is aware of the risk. The problem is that awareness does not produce governance infrastructure. Knowing that AI raises ethical questions does not create an audit trail. Recognising that data privacy matters does not generate a constraint that prevents an AI tool from processing sensitive client information. Concern is not a control.

The paradox deepens when you consider the nature of AI adoption in the sector. Nonprofits are not deploying custom machine learning models. They are using commercial AI tools -- ChatGPT, Copilot, Gemini -- for content generation, data analysis, and administrative tasks. These tools are adopted at the individual staff level, often without organisational procurement processes, because there is no procurement process for a tool that is free or nearly free. The governance surface area expands with every staff member who opens a browser tab, and the organisation has no visibility into what data is being shared, what decisions are being informed by AI outputs, or what institutional commitments are being shaped by tools that sit entirely outside the governance perimeter.

The jump from 17% to 44% in evidence-based decision-making as a top priority is the most consequential finding in the report, because it reveals what the sector actually needs -- and how far current tooling is from providing it.

Evidence-based decision-making is not a dashboard. It is not a reporting tool. It is not a data warehouse. It is the institutional capacity to make decisions that are grounded in evidence and to demonstrate, after the fact, that the evidence existed, was considered, and informed the outcome.

This requires three capabilities that most nonprofits do not have.

These are governance capabilities. They require infrastructure that captures institutional activity as structured data with relationships intact. The 44% of organisations that have identified this as their top priority are, whether they know it or not, describing the need for governance infrastructure. The question is whether the tools available to them will meet that need, or whether they will settle for dashboards that visualise activity without capturing the decision context that makes evidence-based governance possible.

Nonprofit boards carry the same governance obligations as their for-profit counterparts. In Australia, the ACNC Governance Standards require registered charities to operate lawfully, demonstrate accountability, and manage their affairs responsibly. Directors have duties of care, diligence, and good faith under the Corporations Act (and equivalent state legislation for incorporated associations). These obligations are not relaxed because the organisation is small, under-resourced, or mission-driven.

The governance gap described in the Infoxchange report is therefore not just an operational concern. It is a board-level liability. When 67% of organisations are using AI and only 14% have governance frameworks, the remaining 86% have boards that are legally responsible for the governance of tools they may not know are being used.

This is not hypothetical. As AI tools become embedded in service delivery, fundraising, financial management, and stakeholder communication, the decisions informed by those tools carry institutional weight. A fundraising appeal drafted by AI that contains inaccurate claims. A service allocation decision informed by AI analysis that reflects embedded bias. A financial report generated with AI assistance that contains errors. In each case, the board is responsible for the governance framework -- or lack thereof -- that allowed the output to pass without scrutiny.

The speed of AI adoption makes this particularly urgent. The gap between "some staff are using ChatGPT" and "AI is embedded in core operational processes" can close in months. Boards that wait for a governance incident before addressing the framework gap are accepting a risk that compounds with every passing quarter.

The Infoxchange report does not prescribe solutions, but the data points toward a specific conclusion: the sector does not need another software tool with per-seat pricing and a learning curve that assumes dedicated IT staff.

What the sector needs is governance infrastructure that meets three conditions.

These are not feature requests. They are structural requirements derived from the data. The 824 organisations in this report are not asking for AI governance because they read a thought leadership piece. They are telling researchers, through their answers, that they are adopting AI without safeguards, that they know this is a problem, and that their budget and capacity constraints prevent them from solving it with existing tools.

The sector's governance gap will not close through awareness campaigns, best-practice guides, or policy templates. It will close when governance infrastructure exists that is affordable, accessible, and operational at the scale at which nonprofits actually operate. The Infoxchange data makes the case. The question is whether the infrastructure will arrive before the liability does.