Not-for-profits (NFPs) in Australia are embracing AI and cloud platforms at unprecedented rates, yet the Infoxchange 2025 report reveals a troubling gap: only 14% of NFPs have an AI policy and fewer than a quarter have a documented cyber security plan.

By contrast, broader business adoption of AI and cloud in both countries is far more advanced, with 70–87% of enterprises reporting cloud maturity and AI integration. This mismatch underscores the urgent need for sector-specific policy guidance to ensure NFPs can harness technology responsibly, securely, and sustainably.

Why NFPs Need Policy Guidance on AI and Cloud

The Infoxchange 2025 Digital Technology in the Not-for-Profit Sector Report paints a clear picture:

• Cloud adoption is nearly universal among NFPs (87% use collaboration platforms), yet many rely on free or personal versions of tools, leaving them exposed to risks.
• AI uptake is mainstream (67% of NFPs use generative AI, with 43% using ChatGPT and one-third using Copilot), but 85% lack an AI policy.
• Data security and sovereignty concerns are the top barrier to AI adoption (50% of NFPs cite this), reflecting the sector’s sensitivity to client privacy and trust.
• Cyber security capability is stagnating, with only 23% of NFPs having a documented plan, compared to rising threats and breaches.

These findings show that while NFPs are enthusiastic adopters, they lack the governance frameworks to manage risks, protect vulnerable communities, and ensure defensible use of technology.

Comparing NFPs with Broader Business Adoption

When we look at the wider business landscape in Australia, the contrast is stark: The broader population is not only adopting AI and cloud but embedding them into strategic governance frameworks. NFPs, however, remain under-resourced and under-prepared, despite handling some of the most sensitive data in society.

Why Policy Guidance Matters

For NFPs, policy guidance is not just a compliance exercise—it is a trust-building mechanism. Vulnerable communities rely on these organisations to safeguard their dignity and privacy. Without clear frameworks:

• AI risks (bias, misuse, data sovereignty breaches) could undermine service delivery.
• Cloud risks (poor configurations, reliance on free tools) could expose sensitive client data.
• Cyber risks could erode donor confidence and disrupt critical services.

Sector-specific guidance would help NFPs:

• Develop AI policies that balance innovation with ethics, privacy, and sovereignty.
• Establish cloud governance frameworks that ensure secure, scalable, and affordable adoption.
• Align with national strategies like New Zealand’s AI Blueprint and Australia’s digital transformation initiatives, ensuring defensibility and compliance.

Call to Action

The Infoxchange report makes it clear: NFPs are eager adopters but lack the guardrails.

With broader business already embedding AI and cloud into governance, NFPs urgently need tailored policy guidance to bridge the gap. Governments, funders, and sector leaders must collaborate to provide templates, training, and defensible frameworks that empower NFPs to innovate responsibly.

Technology should be a force for social justice—not a source of risk. Policy guidance is the missing link to make that vision real.