Last week, on 10th and 11th February, the Edinburgh International Conference Centre buzzed with Scotland’s voluntary sector as The Gathering, the largest free event of its kind in the UK, brought together staff, volunteers, trustees and leaders from charities, social enterprises and community groups to learn, network and share ideas.
Organised by the Scottish Council for Voluntary Organisations (SCVO), the Gathering isn’t just a conference: it’s a sector moment, a place where big questions about the future of third sector work meet practical conversations about today.
One of the most talked-about sessions here at Pooka focused on Artificial Intelligence, not in abstract futurism, but in the real, urgent context of how charities are already using (and wrestling with) AI tools in everyday work.
What followed was a series of live polls with roughly 200 delegates, providing a snapshot of where the sector really is on AI adoption, governance and risk. Below, we explore the results and what they mean for charities navigating this fast-moving technology.
AI Has Already Arrived
One slide referenced Microsoft’s 2024 Work Trend Index:
- 75% of people are already using AI at work
- 80% of AI users are bringing their own AI tools into work
That second statistic matters. Because it suggests something we see often: adoption is happening faster than policy. People aren’t waiting for organisational sign-off. They’re experimenting. Testing. Trying to save time. And in a sector where teams are stretched thin, that makes complete sense. But it also raises questions about governance, data protection, and risk.
The Room Told Its Own Story
In the session’s live polling, here’s what stood out:
Are people using AI tools?
- 49% said yes, regularly
- 44% said yes, a little
- Only 6% said no
So AI use isn’t hypothetical. It’s already embedded in day-to-day work.
Do organisations have an AI policy?
- 42 said yes
- 53 said we’re working on it
- 79 people said no
That’s a pleasingly high number with policies in place, though it’s worth noting that many larger charities were represented in the room. Smaller organisations may not yet be as far along. Still, it shows momentum.
Does existing security awareness training cover AI?
- Only 9 said it’s covered extensively
- 110 said no
- 36 didn’t know
That’s where the tension sits.
AI is being used, and policies are emerging, but training and security frameworks haven’t caught up.
How do organisations approach tech governance?
Responses were split:
- 27 described tightly managed environments
- 71 said flexible but policy-driven
- 80 said they allow lots of freedom and rely on people to “do the right thing”
That last group is interesting. It reflects trust, something the third sector values deeply. But trust without guardrails can become exposure.
Risk Isn’t Theoretical
Another slide, from another session, shared a sobering statistic:
“Almost one in three (30%) charities experienced some form of cyber security breach or attack in the last 12 months” – 2025 UK Cyber Security Breaches Survey.
That’s not abstract. That’s today’s reality.
Now layer onto that:
- Staff experimenting with AI tools
- Personal accounts being used for work
- Potentially sensitive data being shared with platforms not vetted or compliant
You can see the issue.
What Comes To Mind When We Say “AI”?
The word cloud from the room was telling. Yes, there were positives:
- Efficiency
- Time saving
- Opportunity
- Helpful
But right at the centre were words like:
- Risk
- Data protection
- Inconsistent
- Fear
- Unethical
- Caution
That balance feels honest. The sector isn’t naïve, it sees both the potential and the pitfalls.
The Speed Of Adoption Is Unprecedented
Another slide compared how long it took technologies to reach 100 million users:
- Internet: 7 years
- Instagram: 2.5 years
- TikTok: under 9 months
- ChatGPT: 2 months
Two months.
That pace matters because governance structures, especially in charities, don’t move in two-month cycles. Boards meet quarterly, policies take time and budgets are constrained.
Technology doesn’t wait.
So What Does This Mean For The Third Sector?
From today’s results, it looks like most organisations are somewhere in the messy middle:
- People are already using AI
- Leadership knows it’s happening
- Policies are emerging
- Training is lagging
- Cyber risk is real
The question isn’t whether AI should be used, it’s how to use it responsibly.
And that means:
- Clear, proportionate AI policies
- Updated security awareness training
- Conversations between leadership, frontline staff, and subject experts
- Honest discussion about data handling
It also means acknowledging that smaller charities may need support, not just warnings.
Start Small. But Start.
One of the cybersecurity slides offered a simple framework:
- Make space on the agenda for cyber
- Get staff and volunteers switched on
- Preparation is key
- Start small, big impact
That advice applies to AI too. You don’t need a 40-page governance document to begin. But you do need clarity.
At Pooka, we use AI internally to improve efficiency, for research, code support, ideation, but never as a substitute for thinking. And never in ways that compromise client data.
AI is a tool, not a shortcut, not a strategy and certainly not a replacement for human judgement.
Final Reflection
What struck us most wasn’t fear, it was thoughtfulness. The room wasn’t dismissive, nor blindly enthusiastic. It felt like a sector trying to do the right thing, while navigating tools evolving at breakneck speed. And that’s encouraging.
Because the third sector has always been values-led. The challenge now is making sure those values shape how AI is adopted, rather than letting adoption happen by default.
If your organisation is somewhere in that messy middle, you’re not alone. The conversation has started. And that’s a good place to be.
Get In Touch
We’d love to hear what you’re up to. Please get in touch using hello@pooka.co or through the form linked below. Don’t be shy!
