AI for Nonprofits (6 of 10): Is Your Nonprofit Data Ready for AI

November 5, 2026/ Mark Becker / ThursdAI

AI does not require perfect data. It does require the organization to understand which data it is using, whether that data is trustworthy, who may access it, and what could happen if the system produces a wrong or harmful result.

Begin with the use case

Data readiness is contextual. Drafting a generic event description requires a different level of scrutiny than analyzing donor records, recommending service eligibility, or communicating directly with a beneficiary.

For each proposed use case, identify:

The information the AI will receive
Where that information originates
Whether it is complete and current
Who is authorized to use it
Whether it includes personal, confidential, health, financial, or protected information
Where prompts, files, and outputs are stored
Whether the provider uses the information to train models
Who reviews the output and who is accountable

Data quality still matters

AI can summarize inaccurate records just as efficiently as accurate ones. Duplicate constituents, incomplete histories, inconsistent codes, outdated contact information, and ambiguous definitions can produce misleading results.

Document the source of truth, important field definitions, known gaps, and limitations. If an AI output relies on incomplete data, the user should know that before acting on it.

Start with a small, trusted set of records. Give the tool a short explanation of field meanings, reporting periods, exclusions, and how blanks differ from zero. A donor ID identifies a record; it does not explain whether that record represents an individual, household, or organization.

If the task depends on several systems, define how records will be matched and which system controls each value. A reviewed export may be enough for a pilot; a permanent integration is not always the first step.

Permissions come before convenience

Many AI tools inherit access from the systems they connect to. Review whether users already have excessive access to shared drives, mailboxes, CRM records, reports, or folders. Correct those issues before enabling broad AI search or summarization.

Apply the principle of least privilege: give users and systems only the access needed for the approved purpose.

Check each connector separately. Some work under an individual’s permissions; others use a shared account or a broader authorization. Read-only access prevents source changes but can still expose confidential information through answers, exports, or shared conversations. Review who can see saved chats, memory, and project files as well as the original records.

For agents that can send messages or update records, define permitted actions, approval points, activity logs, and how to stop access. Treat instructions found in retrieved emails, documents, or web pages as untrusted content; they should not override your organization’s rules.

Create usable governance

An AI policy should answer practical questions:

Which tools are approved?
What information may not be entered?
When must a person review the output?
When must the organization disclose AI use?
Which uses require additional approval?
How are errors, bias, privacy concerns, or incidents reported?
Who owns the policy and how often is it reviewed?

Avoid a policy so broad that it says little more than “use AI responsibly.” Staff need examples that connect to their work.

Include meeting notes and recordings

Set clear expectations for notice and consent before an AI notetaker records or transcribes a conversation. Specify meetings where recording is prohibited or needs additional approval, who can access the transcript, and when it is deleted. HR discussions and conversations about sensitive client circumstances deserve particular care.

Keep the guidance usable

Ask staff which tasks they would welcome help with and what concerns them. Include people who question AI use in policy discussions. Name a person staff can consult when the policy does not answer a question, and revisit guidance when tools, connectors, or workflows change.

Match oversight to consequence

Low-risk uses can have lightweight review. Higher-risk uses need stronger controls. A person should not merely click “approve” at the end of an automated process. The reviewer needs enough context, authority, and time to identify problems.

Any use that influences donor treatment, employment, benefits, program access, financial decisions, or communications with vulnerable people deserves heightened review.

Support established responsible AI principles

The Fundraising.AI Framework provides an important sector-specific foundation. Privacy and security protect donor and organizational information. Data ethics and inclusiveness require attention to bias, representation, consent, and impact. Accountability and transparency require clear ownership and honest communication about how AI contributes to decisions or interactions.

Apply the framework’s principles throughout the assessment. It calls for data-security and governance policies as a foundation for AI deployment. Put appropriate controls in place before using organizational data, and expand them as the scope and risk grow. Link: https://fundraising.ai/framework/

A minimum governance package

Before a meaningful pilot, most nonprofits should have:

An approved-tool list
Interim acceptable-use guidance
A data classification or handling standard
Named executive and operational owners
A process for reviewing higher-risk use cases
Human-review requirements
An incident and feedback process
A scheduled policy review

Add a public AI Transparency Statement

An internal AI policy tells staff what is permitted. A public AI Transparency Statement explains to donors, beneficiaries, volunteers, employees, and partners where and why the organization uses AI, what human review applies, how information is protected, and how to raise a concern. Describe actual practices and avoid promises your organization cannot verify. Google for Nonprofits recommends being open about AI use and explaining its purpose: https://support.google.com/nonprofits/answer/15231079

Using AI to assist with transaction reconciliation

Consider a nonprofit that receives a peer-to-peer gift through a fundraising platform, processes it through Stripe, and records it in a donor database. The donor covers the processing fee. The fundraising export contains two lines with the same transaction number—one for the gift and one for the donor-covered amount. Stripe represents the payment, fees, and net amount differently and groups the transaction into a payout. Gift, processing, settlement, and deposit dates may fall on different days. The donor database may store the original gift, a combined amount, or another representation.

In an approved organizational AI environment, AI can assist with exported files by:

Standardizing column names, dates, identifiers, and currencies.
Grouping lines with the same transaction ID and reconstructing the gross transaction.
Matching the result to the Stripe charge, payout, bank deposit, and donor-database record.
Applying finance-approved timing rules while retaining the original gift, settlement, payout, and deposit dates.
Flagging missing records, duplicates, amount differences, refunds, chargebacks, and items posted to different periods.
Producing an exception report and reconciliation summary for finance staff.

Use AI to help create repeatable matching and calculation rules, then verify the totals with spreadsheet formulas or code. Keep original files unchanged and retain source row IDs, rules, and exception notes so finance staff can reproduce the result. AI should not decide accounting treatment or post adjustments autonomously. Finance staff define the rules, review exceptions, and approve conclusions. Remove unnecessary names, emails, and other identifying details; never include card numbers or bank credentials. Replacing names with IDs reduces exposure but does not guarantee anonymity, especially if other details identify a person. Use only an approved organizational environment.

Choose a plan with the controls your use case requires. OpenAI states that ChatGPT Business and Enterprise data is not used for model training by default. Business includes SAML single sign-on; Enterprise adds controls such as automated user provisioning and more granular access management. Confirm retention, audit, residency, and connected-app requirements against the specific plan and contract. A no-training commitment does not mean no storage or no third-party processing. No platform is totally secure, and plan features do not replace sound permissions, policy, and human review. Details: https://openai.com/business-data/

Test the reconciliation on a previously reviewed period. Compare gross receipts, fees, refunds, and deposits; investigate unexplained differences before expanding the workflow. Count review and correction time when deciding whether the process saves effort.

Examples from nonprofits

Braven: In Anthropic’s nonprofit announcement, Braven describes providing staff access, running internal training, and sharing skills built by its IT team. This illustrates how reusable instructions and staff support can help an organization develop shared practices. Source: https://claude.com/es/resources/articles/expanding-claude-for-nonprofits
StriveTogether: In Anthropic’s nonprofit announcement, the organization describes using Claude skills to research funders and retrieve CRM relationship history so staff have more time for relationship building. This illustrates why record access and context matter. Source: https://claude.com/es/resources/articles/expanding-claude-for-nonprofits
Montgomery County Food Bank: In the same announcement, its CEO describes using Claude to compare a partner agency’s retail purchases with food-bank purchasing costs. For a similar analysis, Cathexis recommends checking quantities, units, dates, and comparable products before relying on the savings estimate. These are vendor-published examples, not independent evaluations or Cathexis client results.

Current tools and resources

New capabilities make these checks more relevant. Anthropic’s October 26, 2026 announcement introduces a nonprofit plugin with reusable instructions and connectors, including help applying an organization’s AI policy and mapping where information lives. Review permissions and memory settings before connecting confidential systems. Nonprofit plans and training: https://claude.com/solutions/nonprofits

Microsoft documents that Microsoft 365 Copilot respects existing user permissions and does not use prompts, responses, or Microsoft Graph data to train its foundation models. Existing oversharing still needs correction, and third-party agents need separate review. Details: https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy

Google for Nonprofits also provides responsible-AI guidance and describes organizational protections for eligible Workspace AI services. Check the exact service, account, and agreement rather than assuming a personal account has the same protections. Guidance: https://support.google.com/nonprofits/answer/15231079

What you can do today

Publish interim guidance naming approved tools and information that may not be entered.
Check whether shared-drive and CRM permissions reflect what employees actually need.
Select one low-risk use case, identify the minimum data needed, and test it against records a staff member has already checked.
Assign an owner for AI policy, approvals, questions, and incident reporting.
Record the pilot’s accuracy, exceptions, review time, and owner. Set a review date before adding more data or allowing automated actions.

Responsible AI questions to consider

Is the information used lawfully, ethically, with appropriate consent, and for a purpose people would reasonably expect?
Could incomplete or biased data create unequal treatment, and how will that be detected and corrected?
Can the organization explain the result, identify the accountable person, preserve an audit trail, and learn from errors?

Next ThursdAI: We will identify and score practical use cases—including communications planning and workflow automation.

Sign up to be notified when the next ThursdAI article goes live!

—

Cathexis Partners helps nonprofits assess their technology environment, improve business processes and select platforms based on documented organizational needs. Contact us to discuss your next step.