AI in Your NFP: Who Owns the Decision?
Artificial intelligence is rapidly becoming part of everyday operations across Australia's Not-for-Profit sector.
NFPs are using AI to prepare grant applications, develop reports, analyse information, support recruitment, draft policies and correspondence, prepare meeting notes and improve administrative efficiency.
For organisations operating with limited resources, the attraction is obvious. Used well, AI can reduce administrative workload and allow employees and volunteers to spend more time on the work that directly supports their communities.
But there is a point where AI moves beyond helping people complete tasks and starts influencing decisions.
That raises a more important question.
Who is accountable when technology contributes to a decision affecting an employee, volunteer, client, member or service recipient?
This question is becoming increasingly important because, from 10 December 2026, organisations covered by the Australian Privacy Principles will have additional transparency obligations where computer programs use personal information to make, or substantially and directly contribute to, decisions that could reasonably be expected to significantly affect an individual's rights or interests.
This does not mean every Australian NFP suddenly has a new Privacy Act obligation. For many smaller NFPs, the more important issue is governance rather than legal compliance.
First, establish whether the Privacy Act applies
The Privacy Act generally applies to NFPs with annual turnover greater than $3 million. For Privacy Act purposes, annual turnover includes income from all sources. It is therefore broader than simply looking at an organisation's surplus, profit or a particular funding stream. Most organisations with annual turnover of $3 million or less are not covered by the Privacy Act. However, the $3 million threshold is not a blanket exemption. A smaller NFP may still be covered because of the work it performs or the way it handles information. This can include organisations that provide health services, certain organisations providing services under Commonwealth Government contracts, organisations that trade in personal information, and organisations that have voluntarily opted into Privacy Act coverage.
This is particularly relevant to the NFP sector. An organisation does not need to be a hospital or medical practice to potentially provide a health service for Privacy Act purposes. Depending on its activities, the definition can capture organisations providing services such as counselling, psychology, occupational therapy, social work and other services involving health information. A small community or charitable organisation should therefore not assume that turnover below $3 million automatically puts it outside the Privacy Act. The first practical step is to establish whether the organisation is actually covered.
For NFPs that are covered, the December 2026 changes mean reviewing whether computer programs use personal information in significant decision making and, where required, ensuring the organisation's privacy policy contains the necessary information. For NFPs that are not covered, the statutory requirement may not apply. That does not make the underlying governance issue disappear. The governance threshold is lower than the legal threshold
The Australian Charities and Not-for-profits Commission has encouraged charities to consider AI from a governance perspective, including whether systems are safe, fair, reliable and fit for purpose, whether information is adequately protected and whether Responsible People are exercising appropriate oversight.
This does not mean NFP Boards need to become technology experts. Nor does every small organisation need an elaborate AI governance framework. The starting point can be much simpler. Organisations should understand where AI is already being used.
That includes AI functions embedded within software employees may have been using for years, not simply standalone products such as generative AI applications.
An NFP could begin by asking:
+ What AI or automated tools are currently being used?
+ What organisational, personal or sensitive information is being entered into those systems?
+ Does the technology simply assist an employee, or does it influence a decision affecting another person?
+ Who checks whether the output is accurate and appropriate?
+ Can an employee, client or service recipient question or challenge a decision?
+ Who ultimately owns the decision if the technology gets it wrong?
These are governance questions, not technology questions. There is another important distinction. Having a person approve an AI generated recommendation does not automatically provide effective human oversight.
If an employee routinely accepts recommendations generated by a system without understanding the information used, questioning the output or exercising independent judgement, the human approval process may provide little practical protection.
Meaningful oversight requires someone to have both the authority and capability to disagree with the technology. For many NFPs, particularly smaller organisations, proportionate controls may be enough.This might involve an approved AI use policy, basic rules about what information can and cannot be entered into external systems, a register of important AI applications, management approval for higher risk uses and a requirement for genuine human review where decisions significantly affect people.
Boards should be interested in the higher risk uses rather than attempting to supervise every productivity tool being used by staff.
Three questions can provide a useful starting point for Board discussion:
+Where are we using AI or automated systems in ways that influence decisions affecting people?
+What controls ensure those decisions remain accurate, fair and appropriately reviewed?
+Who remains accountable when technology produces an inappropriate outcome?
The objective is not to discourage AI. Technology can improve productivity, reduce administrative burden and increase organisational capability. Smaller organisations may have particularly significant opportunities because technology can provide capabilities that were previously difficult or expensive to access.The opportunity should be embraced with appropriate safeguards.The important point is that legal compliance and good governance should not be confused.
As AI becomes part of normal business practice, good governance will increasingly mean understanding where technology influences judgement and making sure responsibility remains with the organisation. The technology can assist with the decision. It should not become the owner of it.
NFP Success assists Australian Not-for-Profits and community organisations with governance, policy development, HR, organisational design, workforce planning and Board capability.
Source note: This article draws on current guidance from the Office of the Australian Information Commissioner and the Australian Charities and Not-for-profits Commission. It provides general information and does not constitute legal advice. Organisations should assess their individual Privacy Act obligations and obtain advice where appropriate.
.png)
