AI governance for Australian not-for-profits and community organisations
Australian for-purpose organisations are increasingly exposed to AI governance risk not through deliberate adoption decisions, but through routine software updates that embed AI capability into tools already in use. Understanding this distinction is the foundation of effective AI governance for community organisations, NGOs, and not-for-profits operating without dedicated IT or legal capacity..
What We Are Finding
Your AI Policy Was Written for a World That No Longer Exists
May 2026
Research context: Infoxchange Digital Technology in the Not-for-Profit Sector Report, 2025 / Snopes, May 2026 / Office of the Australian Information Commissioner, 2024
Open Google Chrome this week and you may have noticed something new sitting in your address bar. A small label. Two words: “AI Mode.”
You did not turn it on. You did not install anything. It was not there last month. And if you went looking in your organisation’s AI policy for guidance on what it is and what it means, there is a reasonable chance you would not find an answer, because your policy almost certainly was not written with this in mind.
That is not a criticism. It is a description of where the whole sector finds itself right now.
AI is arriving in tools your organisation already uses, through updates you never approved. The policy gap is widening in real time.
Photo: Oleg Didenko / Unsplash
How to review your AI policy for vendor-side and embedded AI risks
The Back Door Problem
AI is arriving through the back door
For the past few years, the AI conversation in Australia’s for-purpose sector has largely focused on deliberate adoption: whether to use ChatGPT for grant writing, how to set rules around AI-assisted reports, what to tell funders about your organisation’s AI use. These are the right conversations. But they are incomplete.
Because while organisations have been debating whether to open the front door to AI, AI has been coming in the back, through software that was already trusted, already approved, already running on every staff member’s screen.
Adrian Hubble, Not-For-Profit People, April 2026
“The greatest risk of AI use in the workplace isn’t from using obvious tools like ChatGPT or Claude, but from it quietly creeping in the back door through software many organisations already use, like Microsoft Office’s Copilot, Canva’s Magic Design, and Xero’s JAX chatbot.”
That observation landed in April. By May, it had a very concrete example.
What Actually Happened With Chrome
Snopes Fact Check, May 2026
Mostly True
Google Chrome had silently installed a 4-gigabyte artificial intelligence model on users’ devices without consent. The model reinstalls itself if deleted.
Embedded inside recent versions of Google Chrome is a file called weights.bin, stored in a folder called OptGuideOnDeviceModel. It is the on-device version of Gemini Nano, Google’s AI model. It was downloaded to eligible devices automatically, without a consent prompt and without a notification. If a user finds it and deletes it, Chrome downloads it again on the next restart.
When questioned, Google confirmed the model’s existence and said it powers features including writing assistance and scam detection. The company’s Vice President for Chrome responded publicly but did not address the consent question.
4 GB
AI model silently installed on user devices
The “AI Mode” label in the Chrome address bar does not even use this local model. Queries are sent to Google’s cloud servers. The 4GB file powers background features most users will never knowingly access.
Note
This is not yet widely covered in mainstream Australian media. But it is confirmed, it is current, and it is happening on the devices your staff use every day.
What Australian privacy law requires from organisations using AI tools
The Office of the Australian Information Commissioner defines any organisation using an AI system internally as a deployer, carrying obligations under the Privacy Act 1988 and the Australian Privacy Principles regardless of whether a formal AI adoption decision was made. Community organisations that have not yet reviewed their software tools for embedded AI features may already be operating outside their governance frameworks without knowing it.
A Pattern, Not an Incident
This is not a one-off
If the Chrome situation feels surprising, it is worth knowing it is not isolated. The pattern has been building for at least two years.
Microsoft Windows, Recall (2024)
Microsoft announced an AI feature that would take screenshots of everything a user does every few seconds and store it in a searchable database. It was enabled by default. Only after an intense public backlash from cybersecurity experts did Microsoft reverse course and make it opt-in.
Microsoft 365, Copilot (2024 onwards)
Microsoft’s own documentation confirms that Copilot is automatically enabled on Windows devices through standard system updates, unless an IT administrator has previously configured a group policy to prevent it. For most small for-purpose organisations, this means Copilot can arrive without anyone deciding to adopt it.
LinkedIn, AI Training on Professional Data (2024 to 2025)
LinkedIn began using member profiles, posts, resumes, and public activity to train its AI models. The setting was enabled by default. Users were required to actively opt out, and any data collected before they did remained in the training environment regardless.
Meta, Facebook and Instagram in Australia (2024)
Unlike users in Europe and the United Kingdom, who were given the option to object, Australian Facebook and Instagram users have no opt-out mechanism for Meta using their public posts to train its AI models.
Photo: 43 Clicks North / Unsplash
The underlying pattern
Each of these examples shares the same dynamic: a technology platform that organisations already trust made a decision about AI capability that affected users without requiring their explicit consent.
The approved tool is no longer the same tool. The governance decision was made at the point of adoption. The tool has moved on since then.
4
major platforms. Same pattern.
AI capability embedded in trusted, familiar software through routine update cycles, without meaningful organisational decision-making.
The Policy Gap
The policy gap this creates
Australia’s for-purpose sector is already navigating a significant AI governance gap. Infoxchange’s 2025 Digital Technology in the Not-for-Profit Sector Report, which surveyed 824 Australian organisations, found that only 14% have an internal AI policy or governance framework, even as AI adoption has doubled year on year. Not For Humans has examined this gap in detail. See: 92% use AI. 7% see results. The AI governance gap is real.
But there is a second gap that sits inside the first one, and it is the one the Chrome situation illuminates most clearly.
Even organisations that have developed an AI policy have almost certainly written it to govern deliberate tool adoption. Policies typically name approved tools. They specify what data can be entered into which platforms. They require sign-off before staff use a new AI application.
One Hundred Nights, 2026
Many organisations “write AI policies focused on standalone tools like ChatGPT while ignoring AI features embedded in software they already use.”
An AI policy written this way cannot govern AI that arrives through a browser update. It cannot account for a productivity suite that enables AI features as a default. It cannot address the AI tools embedded in the CRM, the payroll platform, or the design software that nobody stopped to consider because they were not thinking of those tools as AI.
The policy was written for a world in which organisations decided to adopt AI. That is no longer the only world they are operating in.
14%
of Australian for-purpose organisations have an internal AI policy or governance framework
Despite AI adoption doubling in the previous 12 months. Survey of 824 Australian not-for-profits.
Infoxchange, Digital Technology in the Not-for-Profit Sector Report, 2025
Two gaps, not one
Gap 1: No policy at all
86% of Australian for-purpose organisations have no internal AI governance framework whatsoever.
Gap 2: Policy that does not cover what is already happening
The 14% who do have a policy have almost certainly written it to cover deliberate adoption, not AI arriving through routine software updates.
Related reading
Not For Humans has examined the broader AI governance gap facing Australian for-purpose organisations in detail.
92% use AI. 7% see results. The AI governance gap is real. →
Legal Obligations
The obligation does not wait for the decision
This is more than a governance concern. It carries legal weight.
The Office of the Australian Information Commissioner has published guidance making clear that the Privacy Act 1988 and the Australian Privacy Principles apply to all uses of AI involving personal information, including where information is used to train, test, or operate an AI system.
The OAIC defines a “deployer” broadly: any individual or organisation that uses an AI system internally, including productivity tools and browsers, is considered a deployer and carries obligations accordingly.
Australia’s Privacy Act reforms, passed in late 2024, have strengthened enforcement significantly. Individuals can now sue directly for serious invasions of privacy.
The obligation to understand how AI is processing personal information in your organisation does not begin when you decide to adopt AI. It begins when AI starts operating, which for many organisations has already happened.
Your legal position
The Office of the Australian Information Commissioner’s guidance is clear: the Privacy Act applies to all uses of AI involving personal information, including AI embedded in tools already in use.
Organisations are considered “deployers” even where no deliberate adoption decision was made.
OAIC, Guidance on privacy and the use of commercially available AI products →
$50M
maximum penalty for organisations under strengthened Privacy Act enforcement
Individuals can now also sue directly for serious invasions of privacy. Reforms passed in late 2024.
A Reason for Awareness
This is not a reason for alarm. It is a reason for awareness.
Before this starts to feel overwhelming, it is worth naming something clearly. The response to AI arriving in tools your organisation already uses is not to ban those tools. It is not to treat every software update as a threat. It is not to approach this with anxiety.
The response is awareness. Specifically, the kind of practical, grounded awareness that lets staff recognise when AI is operating, understand what it is doing with information, pause before assuming a familiar tool is behaving the same way it always has, and know what to do when they are uncertain.
Adrian Hubble, Not-For-Profit People, April 2026
“There’s such a large percentage of community organisations that haven’t thought about implementing an AI policy. This is an opportunity to slow down and embed deliberate processes within a policy that create space for really wise use of AI.”
That opportunity is still available. But the window for treating AI governance as a future consideration is narrowing. The tools have moved on.
Named and addressable
The human behaviours that shape how AI lands in organisations are documented, named, and addressable. Not For Humans has mapped these patterns across its behavioural foundations lexicon, including:
AI is arriving through familiar tools and routine updates. Most organisations have not yet built the awareness to notice. Photo: One Zone Studio / Unsplash
Starting Points
What you can do right now
None of what follows requires a budget, a consultant, or a dedicated IT department. These are starting-point actions any manager or leadership team can take this week.
Action 1
Build an AI tools register
Start a simple document, a spreadsheet is fine, and list every platform your organisation currently uses. Against each one, ask: does this tool have AI features? Are they currently active? Were they active when the tool was adopted, or did they arrive later? This is your baseline. You cannot govern what you cannot see.
Tools worth checking immediately: Google Chrome, Microsoft 365 (Word, Outlook, Teams, Excel), Canva, any CRM or case management platform, email marketing tools, and accounting software.
Action 4
Establish a review trigger for tool updates
Your AI policy should not be a static document reviewed annually. Set a trigger: whenever a software platform your organisation uses announces a significant update, someone is responsible for checking whether AI features are involved and whether the organisation’s existing guidance covers them.
This is what Not For Humans refers to as Capability Reassessment as Governance. The tool you approved last year is not necessarily the tool you are using today.
Action 2
Review your AI policy for vendor-side gaps
If your organisation has an AI policy, read it with this question in mind: does it only cover tools staff choose to use, or does it also address AI features that arrive in existing platforms? If the answer is the former, flag it for review.
If your organisation does not yet have an AI policy, the Australian Government has published a policy guide and template, and PwC has developed an NFP-specific template that Not For Humans founder Adrian Hubble recommends as a starting point.
Action 5
Protect the right to choose deliberately
AI may be arriving whether organisations choose it or not. But that does not mean the decision about how, when, and under what conditions to engage with it has been made for you. The most important thing an organisation can do right now is interrupt the assumption that adoption is inevitable and passive.
Asking “did we choose this?” is not resistance to AI. It is responsible governance. See: Inevitability Framing.
Action 3
Have a staff conversation about what AI looks like now
Most staff awareness conversations about AI focus on tools people choose to use. Broaden that conversation. Ask your team: have you noticed any new features in the tools you use regularly? Have you seen AI-generated suggestions appearing in places they did not used to appear? Do you know what to do when you encounter an AI feature in a tool that has not been covered in your policy?
The goal is not compliance. It is building a shared language and a shared habit of noticing. Staff who can identify AI when it appears, even in unfamiliar forms, are far better positioned to engage with it wisely than those who assume familiar tools have not changed.
References
All sources cited in this article
CNBC, 2024. Microsoft Recall backlash →
Snopes, 2026. Chrome Gemini Nano fact check →
Department of Industry, Science and Resources, 2025. AI Policy Guide →
TechRadar, 2025. LinkedIn AI training on member profiles →
Digital Trends, 2026. Google responds to Chrome Gemini install →
Information Age, 2024. Meta using Australian posts to train AI →
Gizmodo, 2026. Chrome 4GB AI model →
Infoxchange, 2025. Digital Technology in the Not-for-Profit Sector Report →
The Verge, 2026. Chrome AI features hogging 4GB storage →
Microsoft, 2024. Managing Windows Copilot →
Not For Humans, 2026. 92% use AI. 7% see results. →
OAIC, 2024. Privacy guidance on commercially available AI products →
Not-For-Profit People, 2026. Why your NFP needs an AI policy →
One Hundred Nights, 2026. How to create an AI policy in one day →
Not For Humans
Built for organisations navigating AI without specialist expertise.
The Human Behaviour Cards give community organisations the practical, self-guided resources they need to build shared language, name what is already happening, and create the habits that make better human judgement sustainable over time. And if this post has raised questions for your organisation, we would like to hear from you.
Not For Humans: Because AI’s greatest risk isn’t technical, it’s Human.