Three people on your team are probably using AI right now, and there's a good chance you found out by accident — someone mentioned, mid-meeting, that they'd used it to draft a funder update, summarize the board package, or write last week's social caption. Nobody asked permission first, and nobody's tracking any of it, so you're left not knowing whether that's fine or a problem, because nobody at your organization has actually been handed the job of deciding either way.
I hear some version of this in almost every Signal Check I run now. It became the new normal so fast that most leaders haven't caught up to what it actually means yet.
Why "write a policy" is the wrong first move
The instinct is to treat this as a skills gap or a compliance gap — get people trained, publish a policy, move on. I don't think either of those is useless, exactly. I think they're both aimed at the wrong layer of the problem.
This isn't really a technology adoption problem. It's the same held-not-owned pattern I've watched stall out nearly every other digital initiative in this sector, just with a new tool sitting on top of it. Held work runs on whoever happened to pick it up, with no name attached to it and no record that survives them. Owned work has both. Almost nobody's AI use is owned right now — it's just very, very widely held.
The number that proves it
Virtuous's 2026 Nonprofit AI Adoption Report surveyed 346 nonprofit staff and found that 92% of organizations have adopted AI in some form, but only 7% report it's made a major difference to their mission. Eighty-one percent are using it ad hoc, with no documented process behind it, and 47% have no AI governance policy at all. (virtuous.org)
Imagine Canada's January 2026 survey of 963 Canadian nonprofits found almost the identical shape: 80% are using AI, but only 10% have a formal policy, and 64% aren't even working on one. (imaginecanada.ca) Two surveys, two countries, and the same gap every time — near-universal use, and almost no organizational ownership of what that use is actually doing.
That tells me this was never a training problem. Training just makes people better at something the organization already decided, by default, to stay ambivalent about.
Why the gap exists
Adoption is free. Anyone with a laptop and five minutes to spare can start, and nothing in a typical nonprofit org chart requires permission first. Ownership costs something real — a named decision-maker, a documented process, someone who's accountable if a donor's data ends up somewhere it shouldn't — and nothing in most org charts assigns that cost to anyone either. So the organization gets the free thing, and skips the expensive one.
This didn't start with AI, either. NTEN's 2024 research on nonprofit digital investment found that 45% of respondents personally hold responsibility for every technology choice at their organization, with no mandate and no title attached — just whoever ended up sitting closest to the keyboard. (nten.org) AI adoption landed right on top of an ownership gap that was already there. It just happens to be the sharpest version of it yet, because it's the first tool that spreads without anyone having to install anything.
What ownership actually requires
Not a forty-page policy nobody's going to read. In my experience it comes down to three things: a named person who's accountable for how AI gets used, not just whether it's used — some organizations call this a fractional CIO, others just hand it to whoever's already closest to the problem — a written line on what it can touch — donor data, financial figures, anything going out under the organization's name — and what it can't; and an honest look at what's already happening, since right now most leaders are finding out the same way you did, by accident.
None of that requires slowing anything down. It just requires someone deciding, on purpose, what your organization's staff are already doing without you.
None of that requires slowing down. It requires someone deciding, on purpose, what your organization's staff are already doing without you.
Where to start
You don't have to solve this today. But you now know the real question to bring to your next leadership meeting, and it isn't "should we be using AI." It's "who owns this decision, and can they name the three rules governing it?" If nobody can answer that in under a minute, that's the whole diagnosis — not a reason to panic, just a reason to hand it to someone before the next accident is the one that actually matters.
(For what it's worth: about a third of the time, a Signal Check ends with me telling someone to keep their current consultant instead of hiring me. I mention that here because the same logic applies — naming this problem for you isn't about selling you a policy. It's about making sure someone's actually holding the question.)
