Agentic AI & Implementation For Nonprofits

Introduction

Humans and AI. This is what all of the drama, money, arguments, and expectations are all about. Can humans use AI to drastically change how we operate as a species and will it be useful or horrible? We are currently in the third stage of AI generation on a large scale. First, we saw massive rollouts of rule-based and predictive AI during 2010-2021 which was because of the Big Data Boom and mobile integrations such as Netflix recommendations or Siri being developed on iPhone. We then had Generative AI launched with ChatGPT's model 3 in August 2022, which completely changed the game with machine learning and gave birth to Large Language Models as we know them today. After this, we started seeing rises of Agentic AI capabilities like Model Context Protocol (MCP) systems, coding agents (Cursor), and automated consumer workflows. This is where we are today, with hopeful goals of AGI (Artificial General Intelligence) coming in 2027.

Today, I am going to be talking about Agentic AI, how it came to be, what it is exactly, and when nonprofits should and shouldn't be using it in their daily operations. I am always a strong encourager for organizations to make sure that their current operations and workflows have good systems and not just throw AI at the problem, because that is a big waste of time and money for everyone. Let's dive into Agentic AI and the capabilities that it does have for Nonprofits specifically.

What is Agentic AI?

Agentic AI is different from the ChatGPT experience that most of us are familiar with. Generative AI typically waits for us to ask a question, produces a response, and then stops. An AI agent can be given a broader goal and use different tools to actually complete steps toward accomplishing that goal. According to NIST, an AI agent is software that can interact with its environment, receive information, and take actions toward a specified goal. (NIST, 2026) The most important word in that definition is actions.

For example, you could ask ChatGPT to write a follow-up email to someone who attended your nonprofit's fundraiser. It can write the email, but you still need to find the person, copy the message, send it, update the CRM, and create whatever follow-up task comes next. An AI agent could theoretically complete all of those steps itself. It could look through the CRM, identify attendees who have not received a follow-up, generate personalized emails, prepare those messages, update their records, and create future tasks for the team. This is what makes Agentic AI so interesting, but it is also what makes it more dangerous. The biggest difference between normal Generative AI and Agentic AI is not necessarily how intelligent the model is. It is how much authority we give it.

Why Nonprofits Should Care

This technology has enormous potential for nonprofits because many nonprofits have the exact problem that AI is becoming increasingly good at solving. There is simply more work to do than there are people available to do it. A small nonprofit may have only a few employees responsible for donor relationships, volunteer management, fundraising, events, grant research, communications, databases, and administrative work all at the same time.

An AI agent could help monitor upcoming follow-ups, organize CRM records, research grants, summarize meetings, prepare communications, identify volunteer gaps, and retrieve information from internal documents without requiring someone to manually search through every system. That can create real capacity for organizations that are already stretched thin.

However, there is a very important difference between using AI to prepare work and allowing AI to make decisions. I am completely comfortable with an AI system telling a nonprofit employee, "Here are the 15 people who need a follow-up this week." I'm much less comfortable when that same system says, "I decided which donors were important, contacted them myself, changed their records, and scheduled future communication without anyone reviewing it." Those may sound similar on the surface, but they create completely different levels of organizational risk and security issues.

Agentic AI Still Breaks

I think some of the excitement around AI agents gets ahead of reality at this point. These systems are becoming incredibly capable, especially with the release of ChatGPT Astra and the new Claude Opus Model, but capability does not equal reliability. Stanford's 2026 AI Index found that the performance of leading AI agents on computer-use benchmarks has improved dramatically, but even some of the strongest systems still fail a meaningful percentage of tasks. On one major benchmark, leading performance reached approximately 66%, meaning that even a highly capable agent was still unsuccessful in roughly one out of every three attempts. (Stanford AI Index, 2026) We've talked before about tokens, what they are, and how they apply to using AI efficiently. AI agents consistently use more tokens than a human to complete a task, leading to higher costs overall.

That may be acceptable when the task is organizing files or preparing notes. It becomes much more concerning when the task involves donor information, finances, employee records, beneficiaries, or sensitive communications. Security is another major issue. NIST has been actively researching something called agent hijacking, where malicious instructions hidden inside emails, websites, or documents can manipulate an AI agent into taking actions the organization never intended. In NIST testing, increasingly sophisticated attacks were able to achieve very high success rates against tested agent systems. (NIST, 2025)

Imagine an AI agent that can read your inbox, access Google Drive, update your CRM, and send emails. If an instruction hidden inside one email can influence that agent, the problem is no longer that ChatGPT gave you a bad answer but the problem is that the bad answer now has permissions. That creates an entirely different level of security risk for your organization.

Human in the Loop

This is why I strongly believe Human in the Loop should be the default for nonprofit AI implementation. Human in the Loop simply means that a person remains involved at important stages of an automated process, especially before consequential actions occur. The AI can gather information, summarize it, identify patterns, recommend an action, and even prepare that action. But if the decision significantly affects another person, finances, sensitive information, or the mission of the organization, a human should still be responsible for approving it.

There is one warning here, though. Putting a human approval button at the end of an automated workflow does not automatically create good oversight. Research published in PLOS ONE found that people can develop automation bias, which we've been talking about before, but it means they begin trusting automated recommendations simply because they came from the system. In the study, participants frequently preferred algorithmic recommendations even when they were told that the human and algorithm had equal accuracy. (PLOS ONE, 2024)

So Human in the Loop should not mean that the AI makes a decision and a person simply clicks approval. It should mean that the AI gathers the information, explains its recommendation, and then gives a person enough context to independently review the situation and make the final decision. That distinction matters because oversight only works when the human is actually exercising judgment.

A Better Way to Implement AI

I do not believe most nonprofits need a completely autonomous AI agent running their operations today. A better solution is usually a combination of traditional automation, AI assistance, and human approval. Traditional automation should handle predictable rules. AI should handle language, interpretation, research, summarization, and recommendations. Humans should handle judgment, responsibility, and consequential decisions.

A nonprofit could start by allowing an AI system to read approved information and create reports. Then it could be allowed to make recommendations. After that, it could prepare actions for a person to approve. Only after the system has proven to be reliable should it receive limited authority to complete low-risk actions independently. This is essentially the cybersecurity principle of least privilege applied to Artificial Intelligence. Give the system only the permissions necessary to complete the job.

If an AI agent only needs to read donor records, do not give it permission to delete them. If it only needs to draft an email, do not automatically give it permission to send every message. If it only needs to identify an invoice, do not immediately give it access to move money. Start small and increase authority only when there is a clear reason to do so. For nonprofits, my preferred framework is simple: Automation where possible, AI where useful, and humans where consequential.

Agentic AI is going to become significantly more capable over the next few years, and I believe nonprofits will eventually benefit enormously from it. Smaller organizations will be able to operate with capabilities that historically required much larger teams, and employees will be able to spend less time completing repetitive administrative work and more time serving the people their mission exists to help.

But giving an AI system the ability to act is very different from giving it the ability to answer a question. The goal should not be to make the organization autonomous. The goal should be to make the people inside the organization more effective. The nonprofits that benefit the most from AI agents may not be the ones that automate the most. They may be the ones that understand exactly where automation should stop and the safe barriers and guardrails needed for their particular operation.