Somewhere in India, a program officer at a nonprofit is pressing “enter” after pasting a beneficiary’s case notes into an AI chatbot to write a donor update.
The tool is free.
The update takes a couple of minutes instead of hours it took earlier and it reads better than anything they would have written. The beneficiary’s name, personal details, and history is now part of the tools data sets.
Once that happens, that information now sits on a company’s servers, where its reviewers can read them or it can be used to train future models. Across the sector, nonprofit teams are making this trade every day and most of them have no idea of the cost.
Over the decades, nonprofits have seen many waves of digitisation and each brought change along with caution. Let’s examine some of them.
Starting with websites, which had to load fast, be user friendly, and also be secure. Then came newsletters that went digital. As a consequence, people had to agree to receive them and also be able to say no. Social media brought in two-factor logins and new questions about whose details could be shared. Online donations brought payment gateways but also introduced the duty to keep donor details safe.
In each case, the safeguard was visible through a padlock in the browser, adding OTPs, or an unsubscribe link at the bottom of an email. The pattern repeats itself — the tools arrive and safeguards follow later, if at all.
The sector adopted both the tools and their safeguards slowly and sometimes reluctantly. Our State of Nonprofits Digitization Report 2026 scored 500 Indian nonprofits at an average of 4.4 out of 10 on digital maturity. This is a measure of 20 unique signals covering digital assets a nonprofit owns, how they reach people online, and whether they measure the results of these activities.
With the GenAI wave, something remarkably different is happening— the sector isn’t waiting to adopt it. Six in ten nonprofits we surveyed use it daily and many of them have more than one tool. A small team suddenly has extra hands to draft a proposal, respond to a donor or translate a field report.
The sector that spent decades lagging in digital adoption has moved fast on GenAI, and that deserves credit. Moving fast also calls for caution as it is a form of care for nonprofits.
Safeguards Should Come First With GenAI
In earlier waves, safeguards came a little after the technology. There was always a risk gap between adoption and safeguards, but it could be closed later. With GenAI, the equation is reversed therefore the safeguards have to come first.
Among the nonprofits we surveyed, only one in four have safeguards for sensitive data. The inputs shared with AI add up every day— a donor list uploaded to draft thank-you notes, a field report with names, and health details dropped in for translation.
Over time I’ve learned that while mission awareness and fundraising are primary goals for nonprofits, the sector’s real currency is trust.
The same teams that show care and empathy on the ground may, without knowing it, be putting that trust at risk with AI. A beneficiary who shared her story never agreed to it leaving the room, and the nonprofit that promised to keep it safe has broken that promise without meaning to.
Now increasingly funders have started asking about data protection, and from May 2027, India’s data protection rules will make it a legal duty. Trust takes years to build, but very little to lose.
‘AI and I Go Together’
For years I have said “AI and I” go better together. I still believe it, but with one change— the “I” now comes first. Five questions every nonprofit should be able to answer before GenAI becomes part of daily work.
Awareness: Which tools are our people using? As staff often sign up using personal logins, it becomes important to list every tool and the account they are using whether it is free, paid, personal, or enterprise.
Consent: Would the beneficiaries agree to this? Sensitive information, such as recipient records, health and legal details, donor lists, or anything shared in confidence should not be entered into a tool without understanding how the tool might use the information.
Judgment: Who checks what comes out? While GenAI offers speed and fluency, it does not know the people behind the data and can easily hallucinate. The final content piece should always be reviewed by a human before it goes out.
Accountability: Who is responsible if something goes wrong? An AI-generated proposal carries the nonprofit’s name. One person from the team should draw out the nonprofit’s AI policy and serve as the point-of-contact when something slips.
Capability: Where do we draw the line? Raising awareness and ensuring AI training for team members and evolving the training along with the changing tools. The training should cover what the tool does with the data and what one should check before putting anything out.
These five questions, when answered deliberately and built into how an organisation adopts and aligns with AI, can close most of the gap between adoption and safeguards.
Nonprofits should use GenAI but with caution as it will help them accelerate their digital maturity and become self-reliant. It must not come at the cost of trust they have built over the years. While AI and I go better together, the “I” just comes first. Nonprofits must put the I before AI so that it happens with them and not to them.
The full findings are in the State of Nonprofits Digitization Report 2026.