VAIRA

How ready is your organization to use AI well?

Not “are you using AI”, but whether you’re using it deliberately, responsibly, and in service of your mission. That’s a harder question, and almost nothing out there helps a mission-driven organization answer it honestly.

VAIRA does. It’s a diagnostic built by Vivera from research and hands-on work at the intersection of organizational development, responsible AI, and evaluation, grounded in how nonprofits actually operate, not how tech companies wish they did. It looks past whether you’ve adopted tools to something more useful: whether your practice around AI is intentional, evidenced, and built to last, across strategy, people, governance, data, and the way you work.

What you’ll get. A clear picture of where your organization genuinely stands, your maturity stage, the strengths you can build on, and the specific areas where a small step would move you furthest. Not a score to feel judged by, an honest mirror you can act on.
A note of honesty. VAIRA is thorough, so it takes some real thinking, and it’s still in active development. We’d rather be upfront: it’s longer than its final form will be, and you’re helping us sharpen it. Tell us what’s unclear or off, there’s space at the end, and we read every comment.
And something bigger. If you agree, your responses, always anonymized and reported only in aggregate, will feed an open-access report on where mission-driven organizations really stand with AI, a resource the sector doesn’t yet have. Share your email at the end and we’ll send it to you when it’s out.

Full Name Organization Email

I understand my responses will be used anonymously and in aggregate, and I’m ready to begin.

Which of these feel true for your organization right now? Tick any that apply, there are no right answers, we just want to understand where you're coming from.

We’re worried AI might clash with our values or the trust we’ve built with the people we serve.

Our data is too messy or scattered for AI to help much yet.

Our team would need real training before this goes anywhere.

There’s resistance among staff, not everyone wants this.

We don’t really know where AI would be most useful for us.

We think AI could free our people for higher-value, human work.

We’ve done some AI work but haven’t seen a clear return yet.

We believe AI could help us serve more people, or serve them better.

It looks like a big investment we’re not sure we can afford.

We’d need to bring funders, or the board, along before doing much.

A lot of these AI companies feel untrustworthy or misaligned with our values.

Which of the following best describes how strategy and a Theory of Change actually work in your organization today?

No written strategic plan exists. Programs are planned without needs assessments, and no strategy is communicated to the team. No Theory of Change exists, and no structured evaluation practice is in place.

A strategic plan may exist but is rarely referenced and doesn’t guide programmatic or operational decisions. Program planning doesn’t draw on formal needs assessments, and the strategy — set mostly by leadership — isn’t known to most staff. A Theory of Change exists, and evaluation happens only when needed, without a regular schedule — typically done only to meet funder reporting requirements.

The strategic plan provides general guidance for programmatic and operational work, though it doesn’t yet drive routine decision-making. Programs are informed by documented needs assessments and occasionally revised, and most staff are aware of the strategy, with some involved in shaping it. A documented Theory of Change exists with periodic evaluation, reported to funders and other stakeholders — but findings rarely translate into program or organizational adjustments; evaluation functions mainly as a reporting exercise.

The strategic plan is focused on outcomes and impact and actively guides decision-making, with programs regularly reviewed and revised against documented needs assessments. The strategy itself is shaped by ongoing conversations with both internal and external stakeholders. Theory of Change and evaluation are integrated into a continuous MEL system: evaluation happens on a regular, planned, and replicable basis, and its findings directly and visibly guide changes to programs and the organization.

When your organization introduces or changes AI or digital tools that affect the people you serve, how much real say do those people have in the decision, and how are they protected from potential harm?

The community is not consulted about AI or digital tool decisions; tools are adopted or changed without any check-in. The community is not directly protected; we hope for the best. The organization wants to protect their data by collecting the minimum and ensuring no personal and sensitive information is pasted into unsafe tools but there is not a complete guarantee.

The community’s views on AI/digital tools have been informally gathered — casual conversations, isolated feedback — but with no structured process, and no evidence that this input shaped any decision. Community is protected by integrating humans in the loop when it involves a decision that may affect them such as eligibility. The organization protects their data by collecting the minimum and ensuring no personal and sensitive information is pasted into unsafe tools.

A structured consultation on AI/digital tool use has occurred, and its findings visibly shaped at least one specific decision — but this is a one-time event, not an ongoing practice. Community is protected by integrating humans in the loop when it involves a decision that may affect them such as eligibility. There is a named person that is accountable for the outcome. The organization protects their data by collecting the minimum and ensuring no personal and sensitive information is pasted into unsafe tools.

An ongoing, structured mechanism tracks community sentiment on AI/digital tool use over time, and this mechanism has real influence over deployment decisions — not just visibility into them after the fact. There is a process to assess risk across use cases that helps decide to what extent integrate AI. Community is protected by integrating humans in the loop when it involves a decision that may affect them such as eligibility or other high impact use cases. There is a named person that is accountable for the outcome. The organization protects their data by collecting the minimum and ensuring no personal and sensitive information is pasted into unsafe tools. Regular evaluations are performed to assess potential biases, there is transparency about AI/usage, and people can question and appeal any AI-influenced decision that affects them.

Is your organization's adoption of AI or digital tools driven primarily by genuine organizational need, or by funder expectation?

Funder expectations regarding AI (for or against) are unknown; the topic has never been discussed.

Funder sentiment on AI is known informally, but undocumented — the organization cannot say whether adoption pressure from funders exists.

Funder expectations on AI are documented and factored into planning, but the organization’s resulting stance (adopting, limiting, or declining) is largely reactive — driven by compliance with funder position rather than independent assessment.

The organization has its own independently reasoned position on AI use — which may align with or differ from funder expectations — documents that reasoning, and engages funders in genuine dialogue about it rather than simply complying either way.

Has the board discussed or set any expectations regarding AI or digital tool adoption?

Never discussed at board level. Moreover, the board holds no view and would have no way of knowing if AI/digital tool use created a problem.

Individual board members are informally aware that AI/digital tools are in use but the board has not discussed it as a body, holds no collective view, and has no reliable way of learning if a problem arose.

The board has discussed the topic and formed an informal view. However it was reactively, in response to a specific event or outside pressure, rather than its own initiative. It’s unclear whether the board would learn of a new problem unless it surfaced dramatically enough to force attention again.

The board holds a considered position it arrived at through its own deliberation — favoring adoption, caution, or declining to adopt — can explain its reasoning, and stays genuinely informed enough about how AI/digital tools are used. The board would likely learn of a serious problem before it became a crisis.

Which best describes how your workforce gets AI tools and the capability to use them responsibly?

There are no organization-provided AI tools and no training. Whatever staff know they have picked up on their own, from the news, from personal use, or from a colleague, and it varies widely from person to person. There is no shared vocabulary, no guidance on which tools are acceptable, and no instruction on the risks, so people who do use AI may be pasting sensitive information into tools we do not control or trusting outputs without checking them. Responsible use depends entirely on individual caution rather than anything the organization has taught or required. We could not say with confidence what our people are or are not doing with AI. We have started to build baseline AI literacy but it is partial. We may allow or encourage certain tools and have shared basic guidance or an acceptable-use policy, but access is still largely through personal or free accounts rather than vetted, organization-managed ones. Some staff have had a generic training, such as AI for nonprofits from Claude, rather than tied to people’s actual work and it was a one-off event rather that something that keeps pace with the tools. Staff are told to be careful with data, but this is not consistently enforced. The organization vets AI tools and provides approved, managed access (for example, business or enterprise accounts with proper data protections) to the staff who need them. Therefore people are not relying on personal logins for work that touches sensitive information. There might be some usage outside the approved tools that, unfortunately, we do not know about. However, role-relevant training is provided: staff prompt effectively, verifies outputs and knows when it is safe to use AI confidently and leaders have also received governance-oriented training. We review regularly if trainings need to be refreshed. Tool provisioning and capability are embedded and governed together. Access is vetted, matched to role, and reviewed; shadow use of unapproved tools is actively managed rather than ignored; and staff not only use approved tools but help evaluate and select them. AI capability is embedded in how we hire, onboard, develop and govern people. Staff have received enough trainings to be not only use AI safely but help redesign workflows around it, contribute to evaluate whether a tool genuinely fits, and are able to spot where a system is failing or excluding a particular group. Training is connected to our mission and Theory of Change, so we train staff to strategically accept or decline AI uses depending on whether they serve them.

Has the organization run a pilot or experiment with AI integrations in the last 12 months and revisited it afterward?

No deliberate experimentation has taken place. Some individuals may be trying new tools on their own initiative, but any value is incidental and stays with the person who found it. Beyond the occasional comment in a meeting or chat there is no documentation, no assessment of fit, cost or impact, and no owner. Nothing about how a win happened is captured, so it cannot be pointed at a different task or repeated by anyone else.

Experimentation happens from time to time, and it goes beyond individual tool use into some early task automation, for example drafting marketing communications, summarizing documents, scheduling meetings, classifying documents, or searching for grant calls. But it runs without structure or follow-up. Nobody assessed beforehand whether an initiative fits the organization’s values, what it might cost, or whether the expected return made sense, initiatives are not prioritized against one another, there is no written record, and impact is judged only by whether something seemed to work. Each attempt remains a one-off.

At least one structured initiative has been run and revisited in the last twelve months. You weighed the options against fit, cost, expected return and values alignment, set KPIs and success and kill criteria in advance, prioritized across several ideas, and produced documentation clear enough to evaluate progress and impact. Crucially, the method has been shown to be repeatable at least once: another team could reproduce a comparable result from what was written down. This may still be the work of one function or one sponsor rather than the organization’s default way of operating. A documented, criteria-based decision not to pursue an initiative counts here too, because choosing well includes choosing not to.

Structured piloting and review is a recurring, embedded practice rather than a single success. Several initiatives run in parallel, each assessed, prioritized and documented against shared criteria, with evaluation of progress ongoing against a defined process. Prioritization and impact review are continuous and govern the whole portfolio, not one project. Deliberate non-use is a normal, recorded outcome when an initiative fails the return or values test. At its strongest, the organization feeds what it learns back into its own method, improving how it selects, runs and evaluates AI initiatives over time, so that reproducing value across new use cases becomes the default rather than the exception.

When your organization considers a new expense or tool, including AI, does it go through structured cost-benefit reasoning?

No cost-benefit discipline exists. Spending decisions, AI adoption included, are made ad hoc. At most someone remarks that a tool seems to save time or runs fast (or the other way around), but no actual weighing of value against cost takes place at any scale. Cost-benefit reasoning is applied only above a size threshold. It switches on for major moves, automating a whole role or a large share of one, committing to an agent build, or a spend large enough to notice, and stays informal even then. Smaller and recurring AI decisions fall below the bar and go unexamined: whether a Claude or ChatGPT subscription earns its keep, token costs, whether a minor automation is worth the upkeep, these are never really assessed. The gate is scale, not discipline. A structured cost-benefit process is applied consistently to most or all initiatives regardless of size, AI and tech adoption included. It moves past the visible surface, “hours saved” or “this is faster,” to count the fuller direct costs that naive accounting omits: the oversight and checking a tool needs, integration effort, error risk, the near-term cost of running it well. Benefit is defined by outcome and quality, not speed alone, and the reasoning is documented well enough that others can learn from it and return to it. What bounds this level is its horizon: the analysis is sound but essentially near-term and visible. It weighs the costs and gains you can see and count in now. The analysis also books the costs that are real but invisible and slow to surface, and it reasons over a long horizon. It accounts for hidden and shadow labor, for the cumulative cognitive load and fatigue a tool places on the people using it, and for the way sustained reliance can erode a worker’s own capacity to judge the output, the very capacity the oversight depends on. It counts ongoing maintenance such as recalibration and model drift. So a change that is genuinely faster this quarter can still be scored as a poor long-term strategy if it quietly degrades judgment, evaluative skill or morale over a year. This is done with a method the organization has custom-built and calibrated to its mission, vision and values, and comparing what actually happened against what was projected is part of the loop, because these long-tail costs mostly reveal themselves only after the fact.

How does your organization actually use AI today? Select all that apply.

You ask a general assistant to help with a task, then use the result yourselves. For example: you paste a 40-page funder report into ChatGPT or Claude and ask for a one-page summary, ask it to translate a flyer into Spanish, or have it draft a thank-you letter you then edit and send. You start it each time and do the joining-up by hand. Often it feels a bit random, and sometimes you sense your own version would have been better if speed weren’t the point.

You’ve made that use less random and repeatable. For example: you’ve written down prompts that work, trained staff a little, and saved reusable setups, a shared prompt that turns any grant call into a standard go/no-go summary, or a Claude Project loaded with your program descriptions so anyone drafts in your voice. This is usually uneven, a good setup for writing, nothing yet for donor research; tick it if it’s true for even one task.

You’ve adopted a whole AI product that someone else built and runs. For example: a grant-discovery service you subscribe to that surfaces relevant funding calls, or AI donor scoring inside your CRM. You didn’t set it up or wire it together, you chose it and use it as a customer. The intelligence is the vendor’s; you switched from doing the job to buying the job done.

You’ve switched on AI features inside a tool you already used (configured, no technical skill needed). For example: scheduling Claude to email you a Monday summary, turning on Copilot in Microsoft 365, or enabling the AI surfacing in HubSpot or your CRM. The feature already existed in a tool you had, and you activated and configured it by pointing and clicking, nothing was built.

You’ve assembled your own workflow by connecting tools together (connected, some hands-on setup but no coding). For example: a Zapier you built where a submitted donation form triggers an AI-drafted thank-you and a CRM update, with no one pressing go. The distinguishing thing is that you did the assembling, choosing the tools, mapping what passes to what, deciding the logic, even if connectors made it click-together rather than code. This is “citizen developer” territory: it takes logic and integration thinking, not programming.

You’ve built something through traditional development (coded, someone who can write, read and maintain code, not only generate it with AI).. For example: a retrieval (RAG) system over your own policies and past reports so staff can ask questions and get grounded answers, or a custom agent that researches funders and compiles findings on its own. What marks this rung is the how, not the what: a RAG or agent assembled by uploading documents to a tool belongs under “configured” above, this is the version genuine engineering built.

You’ve built or adopted something that is used only internally. For example: staff use it, but it never touches the people you serve, an internal chatbot for HR or program questions, a funder-research agent, back-office automations.

You built or adopted something audience-facing built on LLM-powered AI. For example: an LLM-powered chatbot on your website answering beneficiaries’ eligibility questions or handling donor FAQs. This one meets the people you serve.

You’ve automated your AI governance itself, with dedicated tooling. For example: instead of a manual spreadsheet, a platform that automatically discovers “shadow AI” (tools staff started using without approval), keeps a live AI inventory, and may monitor policy compliance and guardrails. It might be using tools such as Credo AI, OneTrust, WitnessAI or Lakera.

None of the above yet.

Which of these best describes how your organization's tools are typically used across the organization? No organization does this perfectly. We're asking about the general pattern.

Present but Underused — tools exist but mostly sit idle or are used by one or two people (e.g., a CRM exists, but donor info still lives in someone’s inbox; an AI tool was purchased but barely gets opened).

Everyone Does Their Own Thing — tools are used, but inconsistently, with no shared approach (e.g., one staff member logs every contact in the CRM while another logs almost none; some use AI tools daily, others never touch them, for the same kind of work).

Integrated in Specific Use Cases — solid, consistent integration in a few areas, not organization-wide (e.g., fundraising runs fully through the CRM, but intake and case notes are logged inconsistently).

Integrated & Advanced, at Scale — tools are woven into workflows broadly, with automations and advanced features in active use across the organization, not just one team. Gaps and the occasional inconsistency still exist; they’re the exception, not the rule.

For the third-party LLM tools and GenAI platforms your organization relies on, does your organization actively understand and manage its share of security responsibility — or mostly just trust that the platform handles it?"

The organization relies entirely on whatever a platform provides by default, with no review of settings, no understanding of what the vendor is and isn’t responsible for, and no sense of what happens to data once it’s in a third-party tool, including whether anything staff type into an AI tool is stored or used to train the vendor’s models. Some basic settings are configured, but inconsistently and without a real grasp of what the organization owns versus what the vendor covers. Someone may have noticed an AI tool’s data or training setting, but it’s ad hoc, not a considered position, and staff mix free consumer AI accounts with business ones without anyone deciding it matters. The organization actively configures its own responsibilities within each platform: access permissions are deliberately set, and the settings that matter are handled on purpose: opting out of model training where needed, using business rather than consumer accounts, and knowing what data lives where and why. The organization goes further: vendors are actively vetted before adoption (checking their security practices, certifications, or data-handling terms), data placement decisions are deliberate based on sensitivity, sensitive information is kept out of open tools or walled off, and the whole picture is reviewed periodically as tools, vendors, and their AI features change.

This question is about AI tools or systems your organization builds or sets itself, a custom chatbot, a RAG system connected to your data, an agent, rather than AI products you buy ready-made. When you build it yourself, there's no vendor setting the defaults, so the security is yours to handle. How is that managed?

*“Setting up a system yourself” means you’ve connected that model to your own data or tools so it works on your material: a chatbot pointed at your documents, a RAG system over your files, an agent that acts in your accounts, an automation where an AI step runs on your data.

We haven’t set up any AI systems ourselves. We use ready-made tools, but we haven’t connected a model to our own data or tools or built anything around one. All the AI we use runs on outside vendors’ setups. We’ve connected a model to our data, but security wasn’t part of it. It works, but nobody limited what it can reach or who can use it. For example: a chatbot connected to a whole shared drive with no limit on which documents it pulls; anyone with the link can query it; it runs through someone’s personal account or login, so it can reach that person’s whole inbox or drive, not just what it needs. If it were compromised or misused, it could reach far more than it should. We’ve covered the obvious containment. The model is connected only to a deliberately chosen, non-sensitive set of documents rather than everything; there are basic controls on who can use it; and it runs through a dedicated account set up for it, not someone’s personal login, so its reach is limited to what that account can see. We’ve contained both what it can reach and who can reach it, even if it isn’t sophisticated. Containment is deliberate and matched to data sensitivity. Access is scoped to only what each system needs, with nothing sensitive reachable by default, and it runs under a dedicated, least-privilege account. New setups are tried in a sandbox, a walled-off space that can’t touch live systems, using fake or de-identified data before anything is pointed at real records. Where data is genuinely sensitive, the setup reflects that, for instance running an open model you host yourself so sensitive documents and queries never leave for a third-party model, while still using the convenient API route for non-sensitive work. There’s some logging of what the system was asked and returned, and the whole setup is revisited when the model, the data, or who has access changes.

How consistent and reliable is your organization's data, free of duplication, and usable when you need it?

No single place data is supposed to live. The same information exists in several disconnected places with no agreed home, so versions conflict and nobody can say which is authoritative. Donor records sit in both the CRM and a separate spreadsheet with different numbers, and there’s no rule about which one wins. There’s an agreed place, but no agreed way of keeping it clean. Everyone uses the same core system, so data has a home, but there’s no shared standard for how it goes in, so it drifts. The same contact appears several times under slightly different spellings; dates, categories, and formats vary by whoever entered them; nobody is cleaning it up. Data is structured and actively maintained. There’s an agreed way data is entered and where it lives, and someone actually keeps it clean, deduping, correcting, and reconciling as part of normal work, so the core records can be trusted for day-to-day decisions, even if it isn’t perfect everywhere. Data is reliable by design. Consistency is built into how data is captured, not fixed after the fact: shared formats and validation reduce errors at entry, a clear source of truth is defined for each kind of record, and data quality is checked periodically rather than only when something breaks. You can pull what you need, when you need it, and trust it.

For Monitoring, Evaluation & Learning, how developed and deliberate is the AI practice in this area? Please consider that what matters is the practice around AI, not only how advanced the tools are. Skip if you don't have this area.

Absent or hidden. AI has no acknowledged place here, either because it’s discouraged or forbidden, or because nobody has thought about it. If people are using it, the organization doesn’t know, so any use is invisible and unmanaged. This looks like “no AI,” but often hides a lot of shadow AI. Individual and ad hoc. People use AI as they see fit, one person deciding they can work faster, but there’s no shared approach, no team direction, no documentation. It’s real use, but private and uncoordinated, which usually means significant shadow AI and unmanaged data risk. Getting organized at the team level. The area has started to move from individual to collective: there’s some direction to do this department-wide rather than person-by-person, the beginnings of shared practice, and some measurement of whether it’s helping. They’re actively figuring it out, it’s forming, not settled, and shadow AI is shrinking as use comes into the open. Deliberate and governed. The practice is established: options and tools were assessed rather than adopted at random, some use has been tested with a real read on impact (whether that’s scheduling, agents, or something simpler), the team is aligned, and there are clear rules for how AI is used here. Shadow AI is at or near zero because sanctioned practice has replaced it.

For Program / Service Delivery, how developed and deliberate is the AI practice in this area? Please consider that what matters is the practice around AI, not only how advanced the tools are. Skip if you don't have this area.

Absent or hidden. AI has no acknowledged place here, either because it’s discouraged or forbidden, or because nobody has thought about it. If people are using it, the organization doesn’t know, so any use is invisible and unmanaged. This looks like “no AI,” but often hides a lot of shadow AI. Individual and ad hoc. People use AI as they see fit, one person deciding they can work faster, but there’s no shared approach, no team direction, no documentation. It’s real use, but private and uncoordinated, which usually means significant shadow AI and unmanaged data risk. Getting organized at the team level. The area has started to move from individual to collective: there’s some direction to do this department-wide rather than person-by-person, the beginnings of shared practice, and some measurement of whether it’s helping. They’re actively figuring it out, it’s forming, not settled, and shadow AI is shrinking as use comes into the open. Deliberate and governed. The practice is established: options and tools were assessed rather than adopted at random, some use has been tested with a real read on impact (whether that’s scheduling, agents, or something simpler), the team is aligned, and there are clear rules for how AI is used here. Shadow AI is at or near zero because sanctioned practice has replaced it.

For Fundraising & Donor Management, how developed and deliberate is the AI practice in this area? Please consider that what matters is the practice around AI, not only how advanced the tools are. Skip if you don't have this area.

Absent or hidden. AI has no acknowledged place here, either because it’s discouraged or forbidden, or because nobody has thought about it. If people are using it, the organization doesn’t know, so any use is invisible and unmanaged. This looks like “no AI,” but often hides a lot of shadow AI. Individual and ad hoc. People use AI as they see fit, one person deciding they can work faster, but there’s no shared approach, no team direction, no documentation. It’s real use, but private and uncoordinated, which usually means significant shadow AI and unmanaged data risk. Getting organized at the team level. The area has started to move from individual to collective: there’s some direction to do this department-wide rather than person-by-person, the beginnings of shared practice, and some measurement of whether it’s helping. They’re actively figuring it out, it’s forming, not settled, and shadow AI is shrinking as use comes into the open. Deliberate and governed. The practice is established: options and tools were assessed rather than adopted at random, some use has been tested with a real read on impact (whether that’s scheduling, agents, or something simpler), the team is aligned, and there are clear rules for how AI is used here. Shadow AI is at or near zero because sanctioned practice has replaced it.

For Finance & Accounting, how developed and deliberate is the AI practice in this area? Please consider that what matters is the practice around AI, not only how advanced the tools are. Skip if you don't have this area.

Absent or hidden. AI has no acknowledged place here, either because it’s discouraged or forbidden, or because nobody has thought about it. If people are using it, the organization doesn’t know, so any use is invisible and unmanaged. This looks like “no AI,” but often hides a lot of shadow AI. Individual and ad hoc. People use AI as they see fit, one person deciding they can work faster, but there’s no shared approach, no team direction, no documentation. It’s real use, but private and uncoordinated, which usually means significant shadow AI and unmanaged data risk. Getting organized at the team level. The area has started to move from individual to collective: there’s some direction to do this department-wide rather than person-by-person, the beginnings of shared practice, and some measurement of whether it’s helping. They’re actively figuring it out, it’s forming, not settled, and shadow AI is shrinking as use comes into the open. Deliberate and governed. The practice is established: options and tools were assessed rather than adopted at random, some use has been tested with a real read on impact (whether that’s scheduling, agents, or something simpler), the team is aligned, and there are clear rules for how AI is used here. Shadow AI is at or near zero because sanctioned practice has replaced it.

For HR & People Operations, how developed and deliberate is the AI practice in this area? Please consider that what matters is the practice around AI, not only how advanced the tools are. Skip if you don't have this area.

Absent or hidden. AI has no acknowledged place here, either because it’s discouraged or forbidden, or because nobody has thought about it. If people are using it, the organization doesn’t know, so any use is invisible and unmanaged. This looks like “no AI,” but often hides a lot of shadow AI. Individual and ad hoc. People use AI as they see fit, one person deciding they can work faster, but there’s no shared approach, no team direction, no documentation. It’s real use, but private and uncoordinated, which usually means significant shadow AI and unmanaged data risk. Getting organized at the team level. The area has started to move from individual to collective: there’s some direction to do this department-wide rather than person-by-person, the beginnings of shared practice, and some measurement of whether it’s helping. They’re actively figuring it out, it’s forming, not settled, and shadow AI is shrinking as use comes into the open. Deliberate and governed. The practice is established: options and tools were assessed rather than adopted at random, some use has been tested with a real read on impact (whether that’s scheduling, agents, or something simpler), the team is aligned, and there are clear rules for how AI is used here. Shadow AI is at or near zero because sanctioned practice has replaced it.

For Communications & Marketing, how developed and deliberate is the AI practice in this area? Please consider that what matters is the practice around AI, not only how advanced the tools are. Skip if you don't have this area.

Absent or hidden. AI has no acknowledged place here, either because it’s discouraged or forbidden, or because nobody has thought about it. If people are using it, the organization doesn’t know, so any use is invisible and unmanaged. This looks like “no AI,” but often hides a lot of shadow AI. Individual and ad hoc. People use AI as they see fit, one person deciding they can work faster, but there’s no shared approach, no team direction, no documentation. It’s real use, but private and uncoordinated, which usually means significant shadow AI and unmanaged data risk. Getting organized at the team level. The area has started to move from individual to collective: there’s some direction to do this department-wide rather than person-by-person, the beginnings of shared practice, and some measurement of whether it’s helping. They’re actively figuring it out, it’s forming, not settled, and shadow AI is shrinking as use comes into the open. Deliberate and governed. The practice is established: options and tools were assessed rather than adopted at random, some use has been tested with a real read on impact (whether that’s scheduling, agents, or something simpler), the team is aligned, and there are clear rules for how AI is used here. Shadow AI is at or near zero because sanctioned practice has replaced it.

For Volunteer Management, how developed and deliberate is the AI practice in this area? Please consider that what matters is the practice around AI, not only how advanced the tools are. Skip if you don't have this area.

Absent or hidden. AI has no acknowledged place here, either because it’s discouraged or forbidden, or because nobody has thought about it. If people are using it, the organization doesn’t know, so any use is invisible and unmanaged. This looks like “no AI,” but often hides a lot of shadow AI. Individual and ad hoc. People use AI as they see fit, one person deciding they can work faster, but there’s no shared approach, no team direction, no documentation. It’s real use, but private and uncoordinated, which usually means significant shadow AI and unmanaged data risk. Getting organized at the team level. The area has started to move from individual to collective: there’s some direction to do this department-wide rather than person-by-person, the beginnings of shared practice, and some measurement of whether it’s helping. They’re actively figuring it out, it’s forming, not settled, and shadow AI is shrinking as use comes into the open. Deliberate and governed. The practice is established: options and tools were assessed rather than adopted at random, some use has been tested with a real read on impact (whether that’s scheduling, agents, or something simpler), the team is aligned, and there are clear rules for how AI is used here. Shadow AI is at or near zero because sanctioned practice has replaced it.

For Governance & Board Administration, how developed and deliberate is the AI practice in this area? Please consider that what matters is the practice around AI, not only how advanced the tools are. Skip if you don't have this area.

Absent or hidden. AI has no acknowledged place here, either because it’s discouraged or forbidden, or because nobody has thought about it. If people are using it, the organization doesn’t know, so any use is invisible and unmanaged. This looks like “no AI,” but often hides a lot of shadow AI. Individual and ad hoc. People use AI as they see fit, one person deciding they can work faster, but there’s no shared approach, no team direction, no documentation. It’s real use, but private and uncoordinated, which usually means significant shadow AI and unmanaged data risk. Getting organized at the team level. The area has started to move from individual to collective: there’s some direction to do this department-wide rather than person-by-person, the beginnings of shared practice, and some measurement of whether it’s helping. They’re actively figuring it out, it’s forming, not settled, and shadow AI is shrinking as use comes into the open. Deliberate and governed. The practice is established: options and tools were assessed rather than adopted at random, some use has been tested with a real read on impact (whether that’s scheduling, agents, or something simpler), the team is aligned, and there are clear rules for how AI is used here. Shadow AI is at or near zero because sanctioned practice has replaced it.

Does your organization maintain an inventory of AI tools in use, including what each tool does and which workflows it touches?

No inventory, and no clear picture. Nobody could quickly say what AI tools are in use across the organization. There’s no list, and no shared awareness, if you asked around, you’d get different answers. In people’s heads, not written down. There’s rough, informal awareness, you know the obvious ones (say, Claude and HubSpot’s AI features), but it’s partial and undocumented. Nobody has actually compiled it, so lesser-known or individually-adopted tools are easily missed, and there’s no single place it lives. A written list exists, but it stops at the tools. There’s an actual documented inventory of the AI tools in use, and roughly what each one is, but it isn’t connected to how they’re used, which teams rely on them, which workflows they touch, what data they handle. It’s a catalog of tools, not a map of use. A living map, tools linked to how they’re used. The inventory is documented, kept current, and connected to use, each tool tied to the workflows or use cases it touches (and often the data it handles and who owns it). It tells you not just what AI is in use but where and why, and it’s updated as tools change.

Does your organization have an AI policy, is it grounded in explicit ethical principles, and is it actually put into practice?

No shared norms. AI-use decisions are made person by person, with no common expectations across staff, written or unwritten. Unwritten norms only. Some shared practical rules exist informally, “we don’t put donor names into ChatGPT,” “we always review AI-drafted content before sending”, but they’re followed as habit or caution, never written down and not tied to any stated principle. A written, principled policy exists, but mostly on paper. There’s a documented AI policy that names the values behind its rules (privacy, fairness, transparency, human oversight). But it isn’t fully lived: staff may not all know it, follow it consistently, or there’s no clear owner or process making sure it happens. It exists and is sound, but it hasn’t really landed. The policy is implemented and accountable. The same documented, principled policy is actually put into practice: someone owns it, staff know and follow it, and there are the workflows, checks, and processes that turn it from a document into how people actually work, and it’s kept current as AI use changes.

What form does your AI policy take, and who was involved in shaping it?

No policy in any form. Nothing exists, written or verbal. One person’s informal guidance. An informal note or verbal understanding exists, but it was drafted by one person alone, with no input from other staff, let alone the people the organization serves. Documented, shaped by staff. A written policy exists and was developed with input from staff across the organization, but entirely from an internal perspective. The people the organization serves, or others affected by its AI use, had no part in it. Documented, shaped with staff and those affected. A written policy developed participatively, with both staff and the community or people affected by the organization’s AI use. For example, asking service users how they feel about AI-supported case management, or involving them in setting limits on what AI should and shouldn’t be used for.

Is your AI policy actively enforced, and if so, through what mechanism?

No enforcement. Either no policy exists to enforce, or one exists but nothing backs it up in practice. Reactive and informal. Enforcement depends on someone happening to notice a problem and raising it informally. There’s no defined process, no one whose job it is, and nothing that looks for problems before they surface, issues get caught by luck, not design. A defined internal mechanism. Enforcement is deliberate: there’s a designated role or group responsible (a governance lead or committee), and some structured checking before tools are adopted or changed, testing for problems ahead of time rather than waiting for them. It’s real, but entirely internal. Internal mechanism plus a voice for those affected. On top of the structured internal checks, the people affected by the organization’s AI use, staff, community, or service users, have a real, usable way to flag concerns and get them acted on, and the whole enforcement setup is reviewed periodically for whether it actually works.

Has your organization assessed which workflows involve AI and what risks — bias, privacy, error, over-reliance — that creates?

No assessment. Nobody has checked the risks in AI-touched work. For instance, an intake tool sorts client applications by urgency, but no one has looked at whether it treats some applications unfairly, what happens to the data entered, how often it’s wrong, or whether staff still review its output closely. Noticed, but never checked. Concerns come up informally and go nowhere. A caseworker mentions the tool seems to flag Spanish-language applications as lower priority, or quietly double-checks its rankings after a near-miss, but nothing is documented or followed up. A structured assessment has been done for key AI-touched workflows. The organization actually tests the concerns: whether rankings really differ by language or location, what data the tool handles, how its error rate compares to staff judgment, and how closely staff still review its output. It’s been examined properly, at least once, for the workflows that matter most. Assessment is systematic, repeated, and changes what you do. Assessment happens regularly, not once, and findings actually reshape practice: a confirmed bias pattern triggers a required second check before any application is deprioritized; over-reliance is watched (for example, staff log their reasoning even when they agree with the tool, not only when they override it); and results are tracked over time.

Does your organization monitor outcomes of AI- or digital-supported processes and feed learning back into practice?

No monitoring. Outcomes aren’t tracked; once something is in use, nobody checks how it’s actually doing. Informal and occasional. Problems get noticed sometimes, but by chance rather than by design, nothing systematic is watching, so issues surface late or not at all. Structured monitoring that corrects practice. There’s regular review of how AI- or digital-supported processes are performing, and when something drifts from the goal or process, it gets caught and fixed. Learning improves how you do things (single-loop: you correct course against existing goals). Monitoring that also questions the goals. On top of structured monitoring tied into your MEL, findings don’t only fix how you work, they periodically prompt the organization to revisit the underlying aims themselves: whether the goal, strategy, or Theory of Change still holds. Learning improves not just the method but the direction (double-loop: you question the goals, not only the execution).

Having thought all this through, what's the biggest opportunity you see for AI in your work, and the biggest challenge or concern?

How ready is your organization to use AI well?

Not sure where to begin?