AI for Nonprofits: A Practical Maturity Framework (Crawl, Walk, Run)
A practical framework for AI adoption at nonprofits and NGOs. The Crawl, Walk, Run maturity model helps your organization move from everyday chatbot use, to organizational context, to autonomous workflows, with guidance on keeping sensitive data protected at each stage.
Key Takeaways
- You're probably already using AI. The choice is whether you adopt it on purpose, with guardrails, or by accident.
- Maturity is a ladder. Skipping the foundational stages can leave the problems they were meant to solve: weak governance, low trust, stalled adoption.
- Crawl = chatbot fluency: every staff member uses AI weekly, and knows what to keep out of it.
- Walk = organizational context: AI is connected to your approved data and packaged into workflows your team can reuse.
- Run = agentic workflows: AI executes multi-step processes like grant pipelines and compliance checks, with human oversight.
- Data protection applies at every stage. Beneficiary PII, financial records, and confidential grant information stay out of AI tools.
How can NGOs adopt AI responsibly?
Many NGOs are probably already using AI without realizing it. When Outlook finishes your sentence, Teams transcribes a meeting, or Word rewrites a paragraph, an AI model is doing the work. The real question is whether you adopt it on purpose, with guardrails, or let it happen by accident.
At Hikaya, we work with nonprofits making exactly this transition. Instead of a single big-bang rollout, we use a staged ladder: Crawl, Walk, Run.
Demystifying AI: Engines vs. Apps
First, clear up what "AI" means in practice. There are two layers, and confusing them can lead organizations to overspend.
Foundational models are the engines. These are the large language models that do the reasoning: ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google), Copilot (Microsoft). They understand and generate text, analyze documents, and answer questions.
AI features are the apps. These are what you touch every day, the same Copilot, smart compose, and transcription features from the examples above. Each one runs on an engine under the hood, but you don't need to understand the engine to get value from the app.
The distinction matters because "adopting AI" sounds like buying a new platform. It usually isn't. A good first step is getting more out of the AI already sitting inside the tools you pay for.
Key insight
Adopting AI often doesn't require buying new software. It can start with the intelligence already embedded in the tools your team opens every morning.
Why This Matters for NGOs
The nonprofit context raises the stakes for AI in four ways:
- Sensitive data: Beneficiary information, donor records, and program data demand strict protection. Tools that train on your inputs can expose it.
- Multilingual work: AI can help with translating, summarizing, and drafting across languages, which is daily reality for many NGOs. Accuracy still depends on careful prompting and review.
- Donor reporting: Proposals, narrative reports, and compliance documents take a lot of staff time. This is a common place to start.
- Resource constraints: Small teams carrying large mandates can benefit from the time AI saves, and have little room for expensive mistakes.
The ladder takes all four into account, one stage at a time.
The AI Maturity Ladder
Crawl: Chatbot Fluency
Timeline: Near-term, first ~6 months
What it looks like: Staff use AI platforms (ChatGPT, Claude, Copilot) for everyday work: researching a topic, drafting an email, summarizing a long document, shaping a workshop agenda.
The goal: Every staff member uses AI at least weekly and knows what to keep out of it. AI becomes a habit.
How to get there:
| Action | Detail |
|---|---|
| Choose a platform | Pick one primary tool (ChatGPT, Claude, or Copilot) and standardize on it |
| Train your team | Use free resources: Anthropic's AI Fluency for Nonprofits, Google's AI for Nonprofits path, Microsoft Learn's AI skills for nonprofits. Our AI training guide compares them by role |
| Share prompts internally | Create a shared channel or document where staff post prompts that worked well |
| Set boundaries | Define clearly what data is off-limits (more on this below) |
The signal you've arrived: AI is a weekly habit across the whole organization, including staff who don't think of themselves as tech-savvy.
Tip
Start with a "prompt of the week" in your team channel. One person shares a prompt that saved them time, and others try it. It's a low-effort way to build fluency alongside any formal training.
Walk: Context and Collaboration
Timeline: Mid-term, ~6–18 months
What it looks like: AI is no longer generic. It's connected to your organization's approved data and packaged into reusable workflows that mirror how your team actually works.
Three capabilities define this stage:
Connect: Add connectors (like MCP, the Model Context Protocol) so AI can read approved organizational data on demand. Point it at your document library, project database, or indicator framework, and it answers from your data instead of generic internet knowledge.
Curate: Build a team "LLM wiki" of tested prompts, system messages, and reference documents. Staff don't write prompts from scratch. They draw from a shared library of tested prompts.
Package: Turn recurring work into reusable setups such as Projects (ChatGPT and Claude), Gems (Google), or Custom GPTs (OpenAI). A "Grant Narrative Drafter" that knows your voice. A "Meeting Notes Summarizer" that outputs in your format. A "Donor Research Assistant" pre-loaded with your prospect criteria. These formats are changing: OpenAI is retiring custom GPTs on December 11, 2026 (OpenAI Help Center), and Google has started replacing Gems with skills (Google Workspace), so check each provider's current options before you build.
The signal you've arrived: AI runs on your organization's context. Outputs read like your team wrote them.
A guide to the practical steps at this stage, from project files to skills and the feedback loop that improves them, is coming soon.
From the field
A program team sets up a project pre-loaded with their theory of change, indicator definitions, and reporting template. When quarterly reports are due, staff paste in their raw notes and the AI drafts a first version in the report format, using the team's indicator names.
Run: Agentic Workflows
Timeline: Longer-term, ~18+ months
What it looks like: AI stops answering questions and starts doing work. It executes multi-step processes under human oversight. You define the workflow; AI runs it.
Use cases at this stage:
- Grant-writing pipelines: AI researches the funder, pulls relevant program data, drafts the narrative, and flags sections that need human review.
- Donor research: AI monitors funding databases, scores prospects against your criteria, and surfaces opportunities to the fundraising team.
- Compliance checks: AI reviews reports against donor requirements, flags missing elements, and suggests corrections before submission.
What it takes to get here:
- Consistent, well-structured data, because the AI is only as reliable as its inputs
- Clear governance: someone owns the question of who approves AI-generated outputs
- Sustained investment in AI as core infrastructure
The signal you've arrived: AI does the work instead of only supporting it. Your staff spend more of their time on judgment, relationships, and strategy.
Watch out
Don't try to jump to "Run" without solid foundations at "Crawl" and "Walk." Agentic workflows require clean data, clear governance, and staff who trust AI enough to delegate. Skipping stages can lead to expensive failures.
Protecting Your Data at Every Stage
Wherever you sit on the ladder, one rule stays the same: protect sensitive data.
What stays out of AI tools
- Beneficiary PII: Names, locations, case details, protection concerns
- Financial records: Bank details, transaction data, budget internals
- Donor PII: Personal contact information, giving history
- HR data: Staff records, performance reviews, salary information
- Confidential grant information: Pre-award budgets, partnership terms
- Passwords or access credentials
The comfort test
Before you paste anything into an AI tool, ask one question: "Would I be fine with this text showing up in a stranger's chat?" If the answer is no, it doesn't go in.
What gets saved
Projects, skills and memory keep information beyond a single chat, so what goes into them matters. Save redacted versions only: IDs instead of names, ranges instead of exact figures, and no case details. You can also tell the AI to do the same, and our upcoming guide to the Walk stage includes instructions you can copy.
Platform settings to configure
Think of this like the cookie banner on a website. The default is "accept," and opting out is on you. AI platforms work the same way.
A common misconception is that free tiers are risky while paid plans protect your data automatically. That isn't the case. On both ChatGPT Free and Plus, training is on by default. What protects you is the opt-out toggle so remember to configure this.
Turn off model training:
- ChatGPT: Settings → Data Controls → "Improve the model for everyone" → Off
- Claude: Settings → Privacy → Disable training (or decline when prompted)
- Copilot (M365): Managed by your M365 admin. Enterprise data stays in your tenant and isn't used for training by default
Key insight
Microsoft 365 Copilot isn't a separate AI. It's built on models from providers such as OpenAI and Anthropic, wrapped inside your M365 apps. Prompting skills carry over between it and other assistants.
Assessing Where Your Organization Sits
Use this quick diagnostic to identify your current stage:
| Question | If yes → |
|---|---|
| Do most staff use AI tools at least weekly? | You've achieved Crawl |
| Does your team share prompts or templates? | You're transitioning to Walk |
| Are AI tools connected to organizational data sources? | You're at Walk |
| Do you have packaged AI workflows (projects, skills, Gems or Custom GPTs)? | You're solidly at Walk |
| Does AI execute multi-step processes with human oversight? | You're approaching Run |
| Is AI treated as core infrastructure with dedicated budget? | You're at Run |
Most of the organizations we've worked with sit somewhere in Crawl, early or late, which is a reasonable place to start. Progress up the ladder comes from steady, intentional steps.
Getting Started
If you're at the start of this journey, do three things this week:
- Audit your existing AI usage. Ask your team: "Who's already using ChatGPT, Claude, or Copilot, and for what?" You may find more usage than you expect, and little of it governed.
- Set data boundaries. Before anything else, spell out what data stays out of AI tools. This protects your organization while you work out the rest.
- Pick one training resource. Anthropic's AI Fluency for Nonprofits is free and written for nonprofit staff. Give your team a month to finish it. Our guide to AI training for nonprofits suggests a first course for each role.
Reaching "Run" quickly isn't the goal. Each stage should rest on solid foundations, so that when you do hand work to autonomous AI, you have the data quality, governance, and trust to do it responsibly. The same iterative principle applies here as in how we build digital solutions for NGOs: start with what's achievable, gather feedback, and extend.
If your team's digital collaboration habits are still catching up to the tools you already own, AI adoption can add to that problem instead of solving it. Shared channels, written decisions, and a single source of truth are the infrastructure AI eventually plugs into.
At Hikaya, we help NGOs and nonprofits worldwide adopt AI at a pace that fits, with practical frameworks, hands-on training, and implementation support that respects the sensitivity of the data you work with.
A useful first step is knowing which stage you're on. If you'd like a clearer read on where your organization sits and what the next step looks like, start a conversation with us, or see how we partner with organizations like yours in our work.
