AI governance in Australian not-for-profits and charities.

Most not-for-profits are covered by the Privacy Act where annual turnover exceeds three million dollars, or at any size where they trade in personal information or provide a health service. Covered organisations must handle donor, member, volunteer and client personal information under the 13 Australian Privacy Principles, governing collection, use, disclosure, security and access. AI tools that ingest personal information do not change these binding duties.

The Privacy and Other Legislation Amendment Act 2024 adds new privacy-policy duties that commence on 10 December 2026. Where a covered organisation arranges for a computer program to use personal information to make decisions that could reasonably be expected to significantly affect the rights or interests of an individual, the privacy policy must describe the kinds of information used and the kinds of decisions made. Update policies before the deadline.

The Department of Industry, Science and Resources published the Voluntary AI Safety Standard and, on 21 October 2025, the Guidance for AI Adoption setting out six essential practices for safe and responsible AI governance. Although voluntary, it is the reference the regulators expect: assign accountability, manage risk and data, test and monitor, keep humans in control, inform affected people, and keep records. Small charities can adopt it proportionately.

ACNC Governance Standard 5 requires registered charities to take reasonable steps to ensure Responsible People, meaning board and committee members, act with reasonable care and diligence, in good faith and in the charitable purpose, and manage financial affairs responsibly. When boards approve AI tools for donor triage, service allocation or communications, the duty of care extends to understanding and overseeing those systems and their risks.

ACNC Governance Standard 3 requires a registered charity not to act in a way that could be dealt with as an indictable offence, or as a breach of a law carrying a civil penalty of 60 penalty units or more, under Commonwealth, state or territory law. AI deployments that breach privacy, consumer, discrimination or fundraising law therefore threaten registration itself, not merely the underlying statute.

Organisations covered by the Privacy Act must comply with the Notifiable Data Breaches scheme. When an eligible data breach is likely to result in serious harm, the organisation must notify affected individuals and the Information Commissioner as soon as practicable. AI vendors, connected donor platforms and model integrations widen the attack surface, so breach-response plans must cover third-party and automated processing.

In New South Wales, raising more than fifteen thousand dollars in a financial year for a charitable purpose requires an authority to fundraise, with conduct governed by the Charitable Fundraising Act 1991 and its regulation and standard conditions. An ACNC-registered charity is taken to hold a deemed authority under section 19B only once it has notified the ACNC Commissioner that it intends to conduct a fundraising appeal in New South Wales. AI-driven donor targeting and appeals must still meet the honesty and record-keeping conditions attached to fundraising.

Under the model Work Health and Safety Act, a volunteer is a worker, and an organisation that engages paid staff is a person conducting a business or undertaking owing the primary duty of care to workers, including volunteers, so far as is reasonably practicable. AI tools that direct, monitor or roster volunteers, or that create psychosocial pressure, fall within that health and safety duty.

Charities that undertake or fund activities outside Australia, however small, must comply with the ACNC External Conduct Standards, taking reasonable steps to control resources, prevent fraud and protect vulnerable people, and keeping country-by-country records. AI tools used for offshore beneficiary screening, translation or partner due diligence must support, not undermine, this oversight and record-keeping.

Build an inventory of every AI or automated tool touching donor, client, volunteer or beneficiary data, and rate each for privacy and safety risk

Rewrite the privacy policy before 10 December 2026 to describe any automated decisions that significantly affect people and the information used

Brief the board on Governance Standard 5 duties and record who is accountable for approving and overseeing each AI system

Adopt the six practices in the DISR Guidance for AI Adoption, scaled to the size and risk of the organisation

Extend the data-breach response plan to cover AI vendors, model integrations and third-party donor platforms under the Notifiable Data Breaches scheme

Confirm fundraising authorities and the National Fundraising Principles apply to AI-driven donor targeting, and keep records of automated appeals

Assess AI tools that roster, monitor or task volunteers against the work health and safety duty, including psychosocial risk