The signals that you have outgrown that are specific. Scheduling has become a recurring job for somebody rather than a message. You cannot answer how many hours were contributed last quarter without reconstructing it. Volunteers are turning up at wrong times or not at all because the calendar and reality have diverged. You need documented background checks or training records, particularly if volunteers work with children or vulnerable people. Or a funder is asking for volunteer numbers you cannot produce.
Hours tracking is the requirement people underestimate. Volunteer time carries a recognised value that appears in grant applications, annual reports, and sometimes as a match against funding requirements. A business that has not been recording hours cannot recover them retrospectively, which means the first year of contribution becomes uncountable. Even without software, start a simple log from the beginning, because that data is only capturable as it happens.
There is a compliance dimension worth naming. Volunteers are not employees and the distinction has to hold in practice, not just on paper. Anything that looks like compensation, or a level of control that resembles employment, can create questions you do not want. Keeping clear records of who did what, when, and under what agreement supports the position that this is genuine volunteering.
When you do buy, choose for the scheduling and communication rather than the reporting, because scheduling is the daily pain and reporting is a monthly one. And check that you can export your volunteer records, since that history is exactly the kind of thing that becomes hard to retrieve later.
Record the agreement with each volunteer in writing even informally, because the distinction between a volunteer and an unpaid worker is one that matters legally and is established by the arrangement rather than the label. What they will do, that it is unpaid and voluntary, what expenses are covered, and that either side can end it. A short document per volunteer removes ambiguity that becomes difficult to resolve retrospectively.
Think about access and safeguarding early if volunteers will handle personal data or work with vulnerable people, because both carry requirements beyond ordinary employment practice. Background checks where applicable, restricted access to records rather than general access, and a clear reporting route for concerns. These are easier to establish as normal practice from the first volunteer than to introduce later to people accustomed to operating without them.