93% of Aid Workers Use AI; Only 22% Have Formal Policies

The gap between how fast humanitarian workers reach for AI and how slowly their organizations govern it is the story here, and the numbers make it uncomfortable. In TechPolicy.Press, Danai Nhando reports that 93% of aid workers have used AI tools, 70% rely on them weekly or daily, and 69% specifically use commercial products like ChatGPT that they chose themselves rather than being issued by their employer. Only 22% work in organizations with formal AI policies. Widen the lens to the nonprofit sector and 82% report using AI while fewer than 10% have formal policies governing its use.

The reason this matters more than the same headline would in a corporate setting is who is on the other side of the keyboard. UNHCR registers over 19 million people, including 15.8 million facial photographs, and WFP holds records on more than 31 million people across 59 countries. In early June, in what Nhando calls the largest-known breach of humanitarian beneficiary data to date, a cyberattack against the WFP exposed personal information on roughly 600,000 households in Gaza, including names, identification numbers, phone numbers, and location data. An earlier breach at the International Committee of the Red Cross exposed confidential data on more than 515,000 highly vulnerable people. A Victoria child-protection caseworker reportedly used ChatGPT to draft a Protection Application Report for the Children's Court, pasting names, risk assessments, and case details into a consumer AI tool.

Nhando's map of where ungoverned AI slips in is worth reading in full: shadow use by individual staff, free tools without privacy protections, procurement without AI-specific criteria, software licensing with default opt-in data sharing, partnership arrangements that transfer model risk to recipients, and vendor breaches delivered through routine updates. The recommended near-term moves are unglamorous but tractable: map every AI touch-point including embedded features, invest in role-specific AI literacy, and rewrite vendor contracts to require opt-in defaults and enforce breach timelines. Nhando points to the CDAC Network's SAFE AI framework and the NetHope Humanitarian AI Code of Conduct as rights-based contractual templates to build from.

The honest caveat is that this is one opinion analysis, and the piece does not disclose the survey's methodology or margins, nor does it name which commercial vendors dominate the embedded-AI layer. What Nhando is clear-eyed about, and what should sit with anyone funding this sector, is the incentive structure. Donors reward deployment, not the boring work of governance, and until governance costs sit inside grants alongside program delivery, aid agencies will keep running consumer AI on humanitarian-grade data.