The AI Maturity Ladder for NGOs: Crawl, Walk, Run
A practical framework for AI adoption at nonprofits and NGOs. The Crawl, Walk, Run maturity model helps your organization move from everyday chatbot use, to organizational context, to autonomous workflows, without putting sensitive data at risk along the way.
Key Takeaways
- You're already using AI. The only choice left is whether you adopt it on purpose, with guardrails, or by accident.
- Maturity is a ladder, not a leap. Skip the foundational stages and you inherit the problems they were meant to solve: weak governance, low trust, stalled adoption.
- Crawl = chatbot fluency: every staff member uses AI weekly, and knows what to keep out of it.
- Walk = organizational context: AI is connected to your approved data and packaged into workflows your team can reuse.
- Run = agentic workflows: AI executes multi-step processes like grant pipelines and compliance checks, with human oversight.
- Data protection holds at every rung. Beneficiary PII, financial records, and confidential grant information never go into AI tools.
Most NGOs are already using AI. They just don't know it yet.
When Outlook finishes your sentence, Teams transcribes a meeting, or Word rewrites a paragraph, an AI model is doing the work. So the real question isn't whether your organization will adopt AI. It's whether you'll do it on purpose, with guardrails, or let it happen by accident.
At Hikaya, we work with nonprofits making exactly this transition. The ones who succeed don't attempt a single big-bang rollout. They climb a staged ladder: Crawl, Walk, Run.
Demystifying AI: Engines vs. Apps
First, clear up what "AI" means in practice. There are two layers, and confusing them is what leads organizations to overspend.
Foundational models are the engines. These are the large language models that do the reasoning: ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google), Copilot (Microsoft). They understand and generate text, analyze documents, and answer questions.
AI features are the apps. These are what you touch every day, the same Copilot, smart compose, and transcription features from the examples above. Each one runs on an engine under the hood, but you don't need to understand the engine to get value from the app.
The distinction matters because "adopting AI" sounds like buying a new platform. It usually isn't. Your first step is getting more out of the AI already sitting inside the tools you pay for.
Key insight
Adopting AI rarely means buying new software. It means using the intelligence already embedded in the tools your team opens every morning.
Why This Matters for NGOs
The nonprofit context makes AI both more valuable and more dangerous than it is in the private sector:
- Sensitive data: Beneficiary information, donor records, and program data demand strict protection. Tools that train on your inputs can leak it.
- Multilingual work: AI is strong at translating, summarizing, and drafting across languages, which is daily reality for many NGOs. Accuracy still depends on careful prompting.
- Donor reporting: Proposals, narrative reports, and compliance documents devour staff time. This is where AI pays for itself fastest.
- Resource constraints: Small teams carrying large mandates gain the most from AI, and can least afford expensive mistakes.
The ladder respects all four constraints while opening up AI's potential one rung at a time.
The AI Maturity Ladder
Crawl: Chatbot Fluency
Timeline: Near-term, first ~6 months
What it looks like: Staff use AI platforms (ChatGPT, Claude, Copilot) for everyday work: researching a topic, drafting an email, summarizing a long document, shaping a workshop agenda.
The goal: Every staff member uses AI at least weekly and knows what to keep out of it. AI becomes a habit, not a novelty.
How to get there:
| Action | Detail |
|---|---|
| Choose a platform | Pick one primary tool (ChatGPT, Claude, or Copilot) and standardize on it |
| Train your team | Use free resources: Anthropic's AI Fluency for Nonprofits, Google's Responsible AI course, Microsoft Learn AI fundamentals |
| Share prompts internally | Create a shared channel or document where staff post prompts that worked well |
| Set boundaries | Define clearly what data is off-limits (more on this below) |
The signal you've arrived: AI is a weekly habit across the whole organization, not just among the tech-savvy few.
Tip
Start with a "prompt of the week" in your team channel. One person shares a prompt that saved them time, others try it. This builds fluency faster than any formal training program.
Walk: Context and Collaboration
Timeline: Mid-term, ~6–18 months
What it looks like: AI is no longer generic. It's connected to your organization's approved data and packaged into reusable workflows that mirror how your team actually works.
Three capabilities define this stage:
Connect: Add connectors (like MCP, the Model Context Protocol) so AI can read approved organizational data on demand. Point it at your document library, project database, or indicator framework, and it answers from your data instead of generic internet knowledge.
Curate: Build a team "LLM wiki" of tested prompts, system messages, and reference documents. No one writes prompts from scratch; everyone draws from a shared library that already works.
Package: Turn recurring work into Custom GPTs (OpenAI), Gems (Google), or Projects (Anthropic). A "Grant Narrative Drafter" that knows your voice. A "Meeting Notes Summarizer" that outputs in your format. A "Donor Research Assistant" pre-loaded with your prospect criteria.
The signal you've arrived: AI runs on your organization's context. Outputs read like your team wrote them, not a generic chatbot.
From the field
A program team creates a Custom GPT pre-loaded with their theory of change, indicator definitions, and reporting template. When quarterly reports are due, staff paste in their raw notes and the GPT drafts a first version in the correct format, using the correct indicator names, in under a minute.
Run: Agentic Workflows
Timeline: Longer-term, ~18+ months
What it looks like: AI stops answering questions and starts doing work. It executes multi-step processes under human oversight. You define the workflow; AI runs it.
Use cases at this stage:
- Grant-writing pipelines: AI researches the funder, pulls relevant program data, drafts the narrative, and flags sections that need human review.
- Donor research: AI monitors funding databases, scores prospects against your criteria, and surfaces opportunities to the fundraising team.
- Compliance checks: AI reviews reports against donor requirements, flags missing elements, and suggests corrections before submission.
What it takes to get here:
- Consistent, well-structured data, because the AI is only as reliable as its inputs
- Clear governance: someone owns the question of who approves AI-generated outputs
- Sustained investment in AI as core infrastructure, not a side project
The signal you've arrived: AI does the work instead of supporting it. Your staff spend their time on judgment, relationships, and strategy while AI handles execution.
Watch out
Don't try to jump to "Run" without solid foundations at "Crawl" and "Walk." Agentic workflows require clean data, clear governance, and staff who trust AI enough to delegate. Skipping stages creates expensive failures.
Protecting Your Data at Every Stage
Wherever you sit on the ladder, one rule never bends: protect sensitive data.
What NEVER goes into AI tools:
- Beneficiary PII: Names, locations, case details, protection concerns
- Financial records: Bank details, transaction data, budget internals
- Donor PII: Personal contact information, giving history
- HR data: Staff records, performance reviews, salary information
- Confidential grant information: Pre-award budgets, partnership terms
- Passwords or access credentials
The comfort test
Before you paste anything into an AI tool, ask one question: "Would I be fine with this text showing up in a stranger's chat?" If the answer is no, it doesn't go in.
Platform settings to configure
Think of this like the cookie banner on a website. The default is "accept," and opting out is on you. AI platforms work the same way.
And here's the misconception that trips up most teams: that free tiers are risky while paid plans protect your data automatically. Not true. On both ChatGPT Free and Plus, training is on by default. What protects you is the opt-out toggle, not the price you pay.
Turn off model training immediately:
- ChatGPT: Settings → Data Controls → "Improve the model for everyone" → Off
- Claude: Settings → Privacy → Disable training (or decline when prompted)
- Copilot (M365): Managed by your M365 admin. Enterprise data stays in your tenant and isn't used for training by default
Key insight
Microsoft Copilot isn't a separate AI. It runs on OpenAI's GPT models, the same engine behind ChatGPT, wrapped inside your M365 apps. Prompting skills carry straight over between the two.
Assessing Where Your Organization Sits
Use this quick diagnostic to identify your current stage:
| Question | If yes → |
|---|---|
| Do most staff use AI tools at least weekly? | You've achieved Crawl |
| Does your team share prompts or templates? | You're transitioning to Walk |
| Are AI tools connected to organizational data sources? | You're at Walk |
| Do you have packaged AI workflows (Custom GPTs, etc.)? | You're solidly at Walk |
| Does AI execute multi-step processes with human oversight? | You're approaching Run |
| Is AI treated as core infrastructure with dedicated budget? | You're at Run |
Most NGOs today sit somewhere in Crawl, early or late. That's exactly where you should be. The ladder rewards intentional progression, not speed.
Getting Started
If you're at the start of this journey, do three things this week:
- Audit your existing AI usage. Ask your team: "Who's already using ChatGPT, Claude, or Copilot, and for what?" You'll find more usage than you expect, all of it ungoverned.
- Set data boundaries. Before anything else, spell out what data must never enter AI tools. This protects your organization while you work out the rest.
- Pick one training resource. Anthropic's AI Fluency for Nonprofits is free and practical. Give your team a month to finish it.
Reaching "Run" fast isn't the point. Building each rung on solid foundations is, so that when you do hand work to autonomous AI, you have the data quality, governance, and trust to do it responsibly.
At Hikaya, we help NGOs and nonprofits worldwide adopt AI at a pace that fits, with practical frameworks, hands-on training, and implementation support that respects the sensitivity of the data you work with.
The hardest part is often just knowing which rung you're on. If you'd like a clearer read on where your organization sits and what the next step looks like, start a conversation with us, or see how we partner with organizations like yours in our work.