AI for Australian not-for-profits

Does the Privacy Act apply to your not-for-profit?

The Privacy Act 1988 applies to a not-for-profit if its annual turnover is more than $3 million, and to many smaller NFPs because of what they do rather than how big they are. Turnover for this purpose includes income from all sources, but not assets, capital gains or proceeds of capital sales. The small business exemption is where charities most often get this wrong.

Your situation	Covered by the Privacy Act?
Annual turnover over $3 million	Yes
Provide a health service, even as a side activity (for example a club program helping members with injuries)	Yes, regardless of turnover
Contracted service provider or subcontractor on an Australian Government contract, such as disability or aged care services	Yes, and check the contract for extra obligations
Sell, buy or trade personal information for a benefit, such as swapping supporter lists for sponsorship	Yes
A related body corporate of a larger organisation with turnover over $3 million	Yes
Under $3 million, none of the above	Generally no, unless you opt in

Even if the Act doesn’t apply, the OAIC points out that coverage can change as you grow or add services, and that poor privacy practice can cost funding and public trust. Building to the Australian Privacy Principles from the start is cheaper than retrofitting later. If you are covered, the Notifiable Data Breaches scheme applies too, and so do the automated decision-making disclosure rules from 10 December 2026, explained in our ADM guide.

Where does AI genuinely help in the not-for-profit sector?

AI helps charities most with writing and reading work that staff do repeatedly: grant applications and acquittals, donor communications, board papers, policies, and answering the same public questions. The risk rises sharply once it touches client records, especially sensitive information about health, family violence, disability or immigration status. The same holds whether you call yourself a not-for-profit, a charity or, in American usage, a nonprofit.

Use case	Data involved	Risk	Sensible approach
Drafting grant applications and acquittal reports	Program data, outcomes, past applications	Low	Licensed AI tools with a library of your past applications
Donor thank-yous, appeals and segmentation	Donor names, gift history	Moderate	AI features in your CRM, or a controlled integration; no bulk export to consumer tools
Website and phone enquiries	Public questions	Low to moderate	A chatbot grounded in your published information, clearly labelled as AI, with a handoff to a person
Summarising board papers and policies	Internal documents	Low	Enterprise productivity tools
Case note summaries and handovers	Client records, often sensitive	High	Controlled environment, Australian hosting, strict access, human review of every summary
Eligibility or intake triage	Client circumstances	High	Keep a person as the decision maker; assess ADM disclosure obligations
Volunteer rostering and matching	Volunteer availability, checks	Moderate	Automation first; AI only where rules can’t express the matching

A useful test is whether a person will read and correct the output before anyone relies on it. For drafting, the answer is naturally yes. For triage and case work, the process has to force it.

What do the ACNC Governance Standards mean for an AI project?

The Governance Standards don’t mention AI, but Standard 5 requires a charity’s Responsible People to act with reasonable care and diligence and to manage its financial affairs responsibly, and that extends to how new technology is adopted. The standards are principles rather than precise rules, so each charity decides how it complies and must be able to show that its steps suit its size, purposes and activities. The ACNC notes that a charity with vulnerable beneficiaries may need to take extra steps.

In practice, a board exercising reasonable care over AI would expect:

1. A register of AI uses. What tools and systems use AI, for what purpose, and with what data.
2. A short AI policy for the not-for-profit covering staff and volunteers: approved tools, what data never goes into them, who reviews AI output before it is relied on, and who to ask.
3. Risk assessment for anything touching clients. A privacy impact assessment is the OAIC’s recommended tool, and suits charities well.
4. Cost oversight. Subscription and usage costs that scale with activity need a budget line and a named owner.
5. Records. Registered charities must keep written financial and operational records, and the ACNC says to keep them for seven years. If AI drafts a record, the final approved version is the one kept.
6. An incident path. Who is told if an AI tool discloses information or produces something harmful, and how it’s reported.

How do donor and case management systems fit in?

Most charities already run a donor CRM and, if they deliver services, a case management system; AI projects work best as additions to those systems, not replacements. Salesforce, Microsoft Dynamics, Blackbaud and a long tail of Australian sector products each have their own APIs, AI add-ons and data models.

• Check what your existing platform already includes. CRM vendors increasingly bundle AI drafting and summarisation. It may be cheaper to switch on and configure than to build.
• Keep the system of record authoritative. An AI tool should read from and write back to the CRM or case system, never become a second, unsynchronised copy of client data.
• Integrate with care. Automations between forms, CRM, email and accounting are often best done with a workflow tool; our n8n vs Make vs Zapier guide compares the options, including self-hosting for data control.
• Mind consent flags. Donor communication preferences and client consents must flow into any AI-assisted campaign or process.

How can a charity keep the cost down?

Work up the ladder from cheapest to most expensive, and stop at the first rung that solves the problem. Figures are typical Australian market ranges (AUD, ex GST), labelled as ranges, not quotes, for an onshore team; basis in our custom software cost guide.

Rung	What it looks like	Typical cost (AUD, ex GST)
1. Use what you have	Turn on and configure AI features in your existing productivity suite and CRM, write an AI use policy, train staff	Licence costs plus a few days of setup and training
2. Automate the workflow	Connect forms, CRM, email and finance with a workflow tool; add AI steps for drafting or classifying	$5,000 to $20,000
3. Grounded chatbot or assistant	Answers the public or staff from your approved documents, with citations and handoff	$15,000 to $50,000 build, plus usage
4. Targeted custom build	A controlled tool for case note summaries or intake, hosted in Australia with audit logs	$30,000 to $90,000
5. Custom platform	Replacing a case management or donor system	Scoped individually; rarely the right first step

Ask vendors about nonprofit pricing, since many software companies run charity discount programs, but check what happens to the price if the program changes. Our AI chatbot cost guide goes into rung 3 in more detail.

Funding it with grants

Capacity building and digital grants from governments, foundations and corporate programs sometimes cover technology. Before applying, check whether the guidelines fund development as well as licences, whether they allow spending on training, and what reporting they require. Include at least two years of running and maintenance costs in your budget, because an unfunded system becomes a risk once the grant ends.

Worked example: an enquiries assistant for a service charity

This is an illustrative scenario, not a past project: a charity with a small intake team that answers the same questions about eligibility, locations and opening hours by phone and email every day. It shows how the obligations above turn into design decisions.

The charity provides counselling alongside other services, so it provides a health service and is covered by the Privacy Act even though its turnover is under $3 million. That single fact shapes the build.

1. Scope the assistant to public information. It answers from the charity’s published service guides, eligibility criteria and locations only. It doesn’t look up client records, so no sensitive information enters the model.
2. Label it and hand off. The chat window says it’s an AI assistant, and any question about a person’s own situation is routed to the intake team with the conversation attached.
3. Don’t collect what you don’t need. No name or contact details are asked for unless the person requests a callback, and then only the minimum.
4. Host in Australia. The document index, application and logs run in an Australian cloud region; the model provider’s retention terms are recorded in the privacy impact assessment.
5. Log and review. A staff member reviews a sample of conversations weekly for wrong answers and gaps in the source documents.
6. Budget. Rung 3 on the ladder above, the kind of AI chatbot development most charities start with: a build in the $15,000 to $50,000 range depending on channels and integrations, plus monthly usage that scales with conversations.

The same charity would treat case note summarisation as a separate, later project, with its own impact assessment, because it moves from public information to sensitive client records.

Red lines for sensitive client information

Some rules should hold regardless of budget. For charities working with vulnerable people, these protect clients first and the organisation second.

• No client information in free or consumer AI tools, ever.
• Sensitive information stays in Australian cloud regions unless there’s a documented reason and a lawful basis to send it elsewhere (see using personal information in AI systems under the Privacy Act).
• Every AI-generated summary of a client is reviewed by the worker before it’s saved.
• Access follows the case: workers see their clients, not the whole database.
• AI never makes eligibility or safety decisions on its own.
• Every query and output touching client data is logged.

How All Webbed Labs approaches not-for-profit projects

We start with a short paid discovery that checks your Privacy Act position, maps your existing systems and identifies the cheapest rung that works, then quote a fixed price. We’d rather configure your CRM than sell you a platform. Where custom work is justified, code goes into your own repository from day one, data stays in Australian regions by default, and every change passes automated quality gates and a senior engineer’s review. See our workflow automation service for where most charities should start.