It depends on which tools, how they’re configured, and what data is being entered into them. AI tools that haven’t been reviewed by IT can expose donor or beneficiary information in ways that aren’t immediately visible, and funders increasingly expect organizations to have a data governance position. The first step is understanding what’s already in use. That’s part of what Vertilocity’s AI Readiness Assessment addresses.

Copilot is embedded across the Microsoft 365 tools most nonprofits already use, but it surfaces information based on whatever your staff can access. If your SharePoint permissions haven’t been audited, Copilot can expose records that were never meant to be visible, including donor and beneficiary data. Before activating Copilot, we evaluate your Microsoft 365 environment to confirm your permissions, access controls, and data structure are ready for it. Many organizations also find they don’t have Copilot included in their current licensing, which is worth confirming before you plan around it.

Any AI tool that touches donor records, beneficiary information, or grant data needs to be evaluated against your confidentiality commitments and funder requirements. That includes confirming how vendors store and process your data and ensuring your staff understands acceptable use. Vertilocity’s AI governance approach is designed to address these questions before adoption, not after an incident surfaces them.

If your staff is using any AI tools today, approved or not, the conversation is already relevant. The question isn’t whether to engage with AI, it’s whether you have visibility into what’s happening in your environment and a governance framework that keeps donor and beneficiary data protected as it evolves. An AI Readiness Assessment doesn’t commit you to any tool or initiative. It gives you an accurate picture of where you stand so you can make a well-informed decision, scaled to your organization’s size and budget.