by The Computing Australia Group | 
Australian not-for-profits are being asked to do more, prove more and protect more, and not-for-profit technology sits at the centre of that work. For example, funding is competitive and boards are watching cyber risk closely. Meanwhile, staff and volunteers are stretched.
The right systems help with all of this. It cuts administration, protects the people you serve and frees your team to focus on the mission. This guide explains where to start, what has changed this year and how to build a plan your board can fund.
Updated 27 October 2026
What’s changed in not-for-profit technology for 2026
- ASD Essentials published (15 Oct 2026). It succeeds the Essential Eight, which ASD expects to retire over about two years.
- Microsoft’s free Business Premium grant has ended. It stopped at each organisation’s first renewal on or after 1 July 2025.
- Ransomware payment reporting is in force. Organisations with turnover over $3 million must report payments within 72 hours.
- More privacy reform is coming. The Government released draft Tranche 2 laws on 31 August 2026.
Why not-for-profit technology matters more than ever
For years, technology was treated as an overhead. If the laptops worked and email stayed online, the job was done. However, that approach no longer holds.
Today, almost every part of your organisation runs on technology. For instance, donor emails, volunteer rosters, client records, board papers and online donations all depend on it. As a result, a weak system now affects service delivery, not just the back office.
On top of this, AI adds a new layer. Used well, it takes repetitive admin off small teams, so more of their time goes to the people they serve.
When systems are well planned, staff spend less time chasing information. Donors also see a professional organisation, and boards get better reporting. In contrast, poorly planned technology creates workarounds, duplicated data and quiet cost increases.
So judge technology by its outcomes. Does it save time? Will it reduce risk? Can it help you reach more people? If not, your plan needs attention.
Five common technology challenges for Australian not-for-profits
Every organisation is different. Even so, the same five challenges come up again and again.
Tight budgets
Every dollar competes with frontline services, so spending must be staged and tied to outcomes.
Cyber risk
Charities hold donor, volunteer and client data. Attackers target them because they expect weaker defences.
People turnover
Volunteers and casual staff come and go. As a result, old accounts often stay active without clear offboarding.
Legacy systems
Spreadsheets, an old CRM and a separate donation tool rarely talk to each other.
Limited expertise
The “unofficial IT person” rarely has time for security, licensing, backups and AI as well.
None of these is solved in one go. Instead, the answer is a clear roadmap that reduces risk first, then cost, then effort.
Cyber security is a board-level responsibility
Many charities assume their not-for-profit technology is too small to be a target. Unfortunately, attackers look for weak passwords, unpatched systems and staff who can be tricked. After all, a positive mission offers no protection.
The consequences can be serious. For instance, a compromised mailbox can lead to invoice fraud. Similarly, ransomware can halt services. A data breach can damage trust with donors and funders for years.
The ACNC is clear that boards are responsible here. Under the ACNC Governance Standards, responsible people must manage the charity’s risks, and cyber risk is one of them. The ACNC’s Cyber Security Governance Toolkit includes a checklist and a template data breach response plan.
Controls every charity should have
- Multi-factor authentication on email and every cloud system
- A password manager and prompt removal of old accounts
- Automatic patching for devices and applications
- Endpoint protection on every laptop and phone
- Backups that are tested, not just taken
- Regular phishing awareness training for staff and volunteers
- A written, rehearsed incident response plan
Essential Eight or ASD Essentials? On 15 October 2026, the Australian Signals Directorate published ASD Essentials, the successor to the Essential Eight. ASD has said both will stay live during a transition of about two years.
For most not-for-profits, the practical advice is unchanged. Keep improving MFA, patching, backups and admin access. That work carries forward to the new framework.
Not sure where you stand? A cyber security audit gives your board a plain-English view of risk and priorities.
Your legal obligations in 2026
In addition, several laws now shape not-for-profit technology decisions, especially how you handle data and incidents. Which ones apply depends on your size and the services you provide, so check with your legal adviser.
Further change is also likely. The Tranche 2 exposure draft, released on 31 August 2026, revisits the small business exemption. If your organisation relies on that exemption today, plan as though it may not last.
Microsoft 365 for not-for-profits: licensing has changed
Microsoft 365 is the backbone of not-for-profit technology in many Australian organisations. However, most organisations use only a fraction of it. For example, SharePoint can end the chaos of scattered files, while Teams can support committees and remote staff. Power Automate can remove repetitive admin.
Licensing also changed in 2025. Microsoft retired the free grant of 10 Business Premium licences. It ended at each organisation’s first renewal on or after 1 July 2025.
Were you on the old Microsoft grant?
If so, check what you are paying now. Some organisations were moved to full price. Meanwhile, others dropped to Business Basic and lost security features without noticing. See Microsoft’s not-for-profit pricing for current plans.
For other software and hardware, the Connecting Up program run by Infoxchange offers donated and discounted products from many vendors. Learn more about getting more from Microsoft 365.
AI for not-for-profits: start small, stay safe
Used well, AI is one of the most useful additions to not-for-profit technology. It helps small teams produce better work with less admin. The value is not in replacing people. Rather, it gives staff a capable assistant for repetitive, time-consuming tasks.
Fundraising
First drafts of donor emails, campaign variations and supporter feedback summaries.
Leadership
Board paper summaries, policy drafts and action lists from meeting notes.
Grants
Structuring applications and checking drafts against funding criteria.
Volunteers
Induction guides, roster messages and FAQs.
Supporter enquiries
An assistant that answers common donor and volunteer questions, then passes the rest to a person.
Paperwork
Pulling key details from forms, invoices and reports, and drafting summaries for acquittals.
At the same time, the risks need managing. Never put client records, donor details or confidential board material into public AI tools. In addition, write a short AI use policy that covers privacy, accuracy and human review.
If you use Microsoft 365, Copilot works within the permissions you already have. So if people can see files they shouldn’t, Copilot can surface them. Therefore, review access before you roll it out.
How we help not-for-profits use AI
Our AI services start small and stay secure. To do that, we plan privacy, access and human review from day one, in line with the Privacy Act.
- AI opportunity assessment. We review your workflows and rank where AI would save the most time.
- Copilot readiness and rollout. First, we tidy permissions and data, so Microsoft 365 Copilot only sees what each person should.
- Workflow automation. We connect slow steps like enquiries, data entry and reporting, with staff checking what matters.
- AI assistants. Staff can find answers in your policies and procedures, and supporters get quick replies to common questions.
- Training and an AI use policy. We run practical sessions for staff and volunteers. We also set clear rules on what never goes into AI tools.
Above all, fix the process before buying software. New tools make an unclear workflow worse, not better. Our business process analysis maps how work really flows, then flags the tasks that AI or automation can take off your team.
Websites, fundraising and search visibility
Your website is often the first serious contact a donor, volunteer or funder has with you. Therefore it needs to do more than look good. It should explain your mission, show impact and make giving easy, especially on mobile.
Many not-for-profit sites are organised around internal structure instead of visitor needs. For example, a donor wants to know what their gift achieves. A volunteer wants to know how to help. So guide each audience to one clear next step, and build accessibility in from the start.
Search matters as well. People research causes and services online before they get in touch. As a result, clear, helpful pages make you easier to find on Google and easier for AI assistants to describe accurately. See our website development and SEO services.
Technology governance: questions every board should ask
Board members don’t need to be technical experts. However, they do need enough visibility to manage risk. Use these questions at your next meeting.
- What are our biggest technology risks, and who owns them?
- Do we know where sensitive data is stored, and who can access it?
- Does every user have multi-factor authentication?
- When did we last test a restore from backup?
- Do we have an incident response plan, and have we rehearsed it?
- Which privacy and reporting laws apply to us?
- Do we have an AI use policy?
A regular technology review answers these questions in plain English, without burying the board in detail.
Funding your not-for-profit technology roadmap
Technology is often delayed because it is seen as overhead. Yet better systems directly support program outcomes. When you apply for grants, link each request to an outcome: better reporting, more people helped or lower risk.
A staged roadmap also shows funders a considered plan, not a one-off request. We suggest three stages.
Year one: secure
MFA, tested backups, patching, a licensing check, and access reviews so AI tools can be added safely later.
Year two: simplify
SharePoint and Teams clean-up, online forms, workflow automation, CRM tidy-up and training.
Year three: scale
AI assistants, a Copilot rollout, dashboards, donor journeys and deeper system integration.
Finally, review the roadmap each year, so it can respond to funding and staffing changes.
What a not-for-profit technology review should include
A useful review is practical and outcome-focused. It should not frighten you with a long list of problems. Instead, it should cover support arrangements, cyber security, Microsoft 365 setup and licensing, backups, devices, your website and search visibility, data governance and an AI opportunity assessment.
The report should then show what is working, what needs attention and which changes will deliver the most value. For many organisations, it becomes year one of the roadmap.
Free for not-for-profits
Book a free not-for-profit technology review
Our Perth team will review your security, licensing, backups, website and AI opportunities, then give your board a plain-English summary of risks and next steps.
Not-for-profit technology: frequently asked questions
Not-for-profit technology strategy and costs
Do not-for-profits need a technology strategy?
Yes. A strategy helps you prioritise spending, reduce risk and link systems to your goals. Otherwise, decisions become reactive and costs creep up.
How much should a charity spend on IT?
There is no single percentage. Rather, it depends on your size, risk and how you deliver services. Instead, a better test is whether current spending reduces risk and improves outcomes.
Can charities still get free Microsoft 365?
Yes, partly. Eligible not-for-profits can get up to 300 free Business Basic licences. The free Business Premium grant ended in 2025, but Premium is available at up to 75% off.
Security, AI and support
Is the Essential Eight still relevant?
Yes, for now. ASD published its successor, ASD Essentials, in October 2026, and expects to retire the Essential Eight over about two years. Work on MFA, patching and backups carries forward.
Do we have to report a ransomware payment?
If your annual turnover is over $3 million, you must report a ransomware or extortion payment within 72 hours. This applies to not-for-profits too.
Where should a not-for-profit start with AI?
Start with one repeated task, such as drafting donor updates or summarising meeting notes. An AI opportunity assessment then helps you pick the task with the best payoff and the lowest risk.
Can you help us use Microsoft 365 Copilot safely?
Yes. We check permissions and data first, because Copilot can surface any file a person can already open. Then we set it up, train your staff and help you write an AI use policy.
Is AI safe for charities to use?
It can be, with clear rules. First, keep sensitive data out of public tools. Then check outputs for accuracy and make sure a person reviews anything that goes out.
Can AI help write grant applications?
AI can help with research, structure and editing. However, a person who knows your organisation and the funding criteria should always review the final application.
Do you support small not-for-profits?
Yes. In fact, smaller organisations often benefit most from practical planning, because they need to achieve more with fewer internal resources.
Sources and further reading
- ACNC — Governance Toolkit: Cyber security
- Australian Signals Directorate — ASD Essentials
- OAIC — Statutory tort for serious invasions of privacy
- Microsoft — Microsoft 365 nonprofit plans and pricing
- Infoxchange — Discounted and donated technology
This guide is general information, not legal advice. Last reviewed 27 October 2026.
About the author
Chris Karapetcoff
Director (Client Growth and Success), The Computing Australia Group
Chris has worked with The Computing Australia Group for over 20 years and looks after its client relationships. He helps organisations get outstanding value from their IT spend, with plain-English advice and a complete IT solution they can build on. As he tells every client: your IT system should just work.
