By Cameron A. Axford and Martin U. Wissmath

As artificial intelligence continues to move from novelty to necessity, many charities and not-for-profit organizations (NFPs) find themselves experimenting with AI tools in informal or unstructured ways. Staff and volunteers may use generative AI to draft communications, volunteers may rely on automated translation tools, or fundraising teams may experiment with AI-enabled donor analytics, often without formal approval, oversight, or documentation. While this kind of experimentation is common, organizations increasingly recognize the need for a clearer, more intentional path forward. Moving from experimenting with AI to integrating AI responsibly requires careful planning, governance, and a realistic understanding of both opportunities and risks.

As this informal experimentation develops, organizations should consult with knowledgeable legal advisors and develop a responsible AI policy that sets guardrails for acceptable use, privacy protection, and risk management, as discussed in the October 2024 Charity and NFP Law Update. However, many organizations may wish to experiment with AI first to better understand how the technology fits their workflows. Whether an organization develops a policy first or uses experimentation to inform a future policy, the key is to ensure that AI is onboarded in a deliberate, transparent, and risk-aware manner. Planned, practical steps can guide responsible adoption regardless of where an organization begins.

Canadian regulators have echoed this need for structure. The federal Office of the Privacy Commissioner of Canada (OPC) has emphasized that organizations deploying AI must centre transparency, data minimization, and privacy by design. Ontario’s Information and Privacy Commissioner (IPC) has similarly encouraged strong governance and human oversight where AI may affect individuals or public-facing work.

Most organizations begin their AI journey through informal use, but intentional experimentation is far more effective. A controlled pilot program, limited in scope, time, and participants, makes it easier to identify risks flagged by OPC and IPC, such as accuracy issues, hallucinations, privacy implications, and over-collection of data. Documenting outcomes for a pilot program helps organizations understand what works and what requires stronger controls. Sector initiatives, such as the Canadian Centre for Nonprofit Digital Resilience, have used pilot projects and prototyped solutions to help nonprofits test digital tools before scaling them, including a national Responsible AI Adoption for Social Impact (RAISE) pilot program to help organizations test tools before broader adoption. Critically, pilots should be documented. Even basic notes on what worked, what did not, and what risks emerged will prove valuable when shaping broader policy.

As experimentation expands, organizations need to define what AI is – and is not – appropriate for. Clarity of purpose helps reduce both overuse and misuse. Charities and NFPs may wish to specify acceptable use cases, such as creative drafting, summarization, translation, and administrative support, while restricting AI use in higher-risk areas, such as legal analysis, individualized decision-making, sensitive client interactions, or assessments that affect eligibility for services.

OPC guidance highlights principles including data minimization, limiting the purposes for collecting and using data, and transparency about automated tools that may affect individuals. Establishing these principles early prevents confusion and protects against unintentional breaches of trust or regulatory compliance. These are basic elements of an AI policy, and are highly recommended guidelines to have in place for even a pilot program.

AI adoption is as much a cultural change as a technical one. Staff and volunteers may fear replacement, misunderstand the technology, or feel uncertain about acceptable practices. Short, practical training sessions focused on prompts, risk awareness, and common pitfalls can significantly improve confidence and reduce inappropriate use. Organizations should also encourage a culture of transparency, where staff and volunteers feel comfortable disclosing their use of AI tools rather than hiding it.

Staff and volunteers should understand how to double-check outputs, apply professional judgment, and when the use of AI may be inappropriate. Training is most effective when grounded in realistic examples drawn from the organization’s own context. Privacy regulators have emphasized the importance of meaningful human oversight, which is especially relevant for charities and NFPs interacting with vulnerable communities. As AI evolves, so too must the organization’s approach. Annual reviews of tools, policies, and risk assessments, recommended by both OPC and IPC, help ensure that practices remain effective and aligned with legal and ethical standards. Responsible AI adoption is a process, not a single decision. By progressing from small-scale experimentation to thoughtful integration, charities and NFPs can harness AI’s benefits while protecting the trust that is essential to their missions.

​Read the November 2025 Charity & NFP Law Update