Artificial intelligence has moved from experimental to nearly universal across the nonprofit sector in the span of about two years. Survey data collected in early 2026 puts adoption at 92% of nonprofits using AI in some capacity, yet only 7% report major mission-level improvement from it, and just 4% have built documented, repeatable AI workflows. That gap between adoption and impact is the central problem nonprofit leaders need to solve.

A second 2026 survey, covering 917 nonprofit staff and executives, found AI use even more widespread. 98% of respondents reported using it in some form. But only 32% of staff had received any formal training, and organizations were clearly divided on how organized that use actually was: 44% of staff described AI use as informal and unsupported by the organization, while only 32% of executives saw it the same way. Leadership consistently believes AI use is more structured than frontline staff experience it to be.

This disconnect matters as donors are paying attention. A March 2026 survey of over 1,000 donors found 76% consider it important that organizations disclose when and how they use AI. Nonprofits that have not yet formalized a policy are already operating with a transparency gap their supporters expect them to close, and 47% of nonprofits report having no AI governance policy at all.

In finance and operations specifically, AI has concentrated in a few practical areas: drafting grant narratives, board memos, and donor correspondence; supporting analysis such as variance explanations and reserve modeling; and assisting with close-related tasks like documenting procedures and building review checklists. These are legitimate, time-saving uses. But none of them should replace human review. Every AI-assisted output still needs an accountable owner who has actually read and verified it before it reaches a funder, auditor, or board.

Two risks deserve particular attention. First, staff frequently paste confidential donor, financial, or program data into free consumer AI tools with no data protection, often without realizing the organization has effectively lost control of that information. Second, AI-drafted content, especially grant and compliance narratives, has been shown to fabricate citations to regulations or sources that don’t exist. If AI-assisted content is going to a funder or regulator, someone accountable must verify the underlying facts.

Governance isn’t only about how staff use AI productively, it’s also about defending against how bad actors are using it against nonprofits. Internal audit leaders surveyed in February 2026 ranked AI-powered phishing as their top concern (88%), followed by fabricated invoices and financial documents (65%), automated social engineering (58%), and deepfake audio or video impersonation (45%). Eighteen percent of organizations already know of at least one AI-enabled fraud attempt against them, and another 34% simply aren’t sure, meaning more than half of nonprofits may already have been targeted.

Nonprofits are attractive targets precisely because of characteristics core to the sector: sensitive donor data, lean IT budgets, and a culture built on trust and responsiveness. A convincing voice or video is no longer reliable proof of identity. Controls that matter now include out-of-band verification for any payment or banking change request (call a phone number already on file, never one provided in the request), dual authorization regardless of who appears to be asking, and a rehearsed escalation path so staff know what to do when something feels off.

●        Adopt a written AI use policy before your next board meeting. At minimum, name the tools staff are approved to use, prohibit entering confidential donor or financial data into unapproved or consumer-grade tools, and require human review before any AI-assisted content reaches a funder, auditor, or the board.

●        Put AI governance on the board’s agenda, not just IT’s. Given the split between how executives and staff perceive current AI use, boards should ask directly what staff are actually doing today, not assume existing informal practice is already governed.

●        Train before you restrict. Only 32% of staff surveyed report receiving formal AI training. A policy without training simply drives usage further underground into unmonitored tools.

●        Build disclosure into donor communications. With three-quarters of donors saying AI disclosure matters to them, transparency should be treated as a trust-building practice, not a defensive one.

●        Harden payment and banking controls specifically against AI-enabled fraud. Require out-of-band verification for any change to vendor banking details or unusual payment requests and test the escalation process at least once a year.

●        Plan for the accounting impact, not just the operational one. Under ASU 2025-06, effective for fiscal years beginning after December 15, 2027, iterative AI and automation development projects are expected to see more costs expensed rather than capitalized. Finance leaders should flag this now so it doesn’t surprise boards as a budget variance later.