Thirty Second Answer: What should a charity do about AI right now?
If you want the short version, do these 7 things:
- Decide what AI is for in your charity (and what it is not for).
- Name an owner (usually a senior staff member) and agree trustee oversight.
- Pick approved tools and block the rest where possible.
- Set rules for personal data (including special category data).
- Create a simple checking process for anything public facing.
- Keep a log of where AI is used and for what.
- Train staff and volunteers with examples, not jargon.
If you do nothing, AI use will still happen. It will just happen in an unmanaged way.
If your charity is experimenting with ChatGPT, Microsoft Copilot, Canva, or any other AI tool, you are not alone. The opportunity is real, but so are the risks. The good news is you do not need a 30 page governance programme to start responsibly. You need clear decisions, basic controls, and a simple policy your team will actually follow.
This guide is written for UK charities and community groups that want to use AI to save time and improve communications without damaging trust or creating a data protection headache.
Why AI governance is becoming a hot topic in the UK third sector
Three things are driving this:
- Pressure on capacity. Teams are stretched, and AI looks like a way to get more done.
- Public trust. Charities rely on trust. Poor AI use can damage reputation quickly.
- Data protection and safeguarding. Many charities handle sensitive information, and AI tools can introduce new risks if used casually.
The Charity Commission has highlighted sector risks and expectations around good governance and managing risk. AI is now part of that conversation.
What counts as “AI” in a charity context?
For most charities, “AI” means tools that:
- Generate text, images, or video (generative AI)
- Summarise documents or meetings
- Help draft emails, policies, funding bids, or social posts
- Analyse data or spot patterns
You do not need to understand the technical details. You do need to understand what information goes in, what comes out, and who is accountable.
The real risks (in plain English)
1) Personal data going into the wrong place
If staff paste supporter data, case notes, or safeguarding information into a public AI tool, you may lose control over where that data goes.
Rule of thumb: if you would not put it in an email to a supplier, do not put it into an AI prompt.
2) Hallucinations and confident errors
AI can produce plausible sounding but incorrect content. That is a problem for:
- Advice to beneficiaries
- Medical or legal information
- Safeguarding guidance
- Financial information
3) Bias and discrimination
AI outputs can reflect bias. This matters if you use AI for:
- Screening applications
- Drafting sensitive communications
- Creating content about protected characteristics
4) Copyright and licensing
Some AI tools generate images or text that may raise copyright questions. You need a clear approach to using AI generated assets, especially in public campaigns.
5) Reputational risk
If supporters feel misled, for example if a “personal” message was actually mass generated, trust can drop fast.
A practical AI policy template (copy, paste, and adapt)
Below is a simple policy structure you can use. Keep it short. Make it real. Review it every 6 to 12 months.
1. Purpose
Our charity uses AI tools to support productivity and communications while protecting beneficiaries, supporters, staff, volunteers, and our reputation.
2. Scope
This policy applies to all staff, volunteers, trustees, and contractors using AI tools on behalf of the charity.
3. Approved uses
AI may be used for:
- Drafting first versions of content (emails, web pages, social posts)
- Summarising non confidential documents
- Brainstorming ideas and outlines
- Improving readability and accessibility of text
- Creating internal templates and checklists
4. Prohibited uses
AI must not be used for:
- Making final decisions about people (e.g., eligibility, recruitment shortlisting) without human review
- Providing personalised advice to beneficiaries without a qualified human checking it
- Processing safeguarding information, health data, or other special category data unless explicitly approved and risk assessed
- Uploading confidential documents or datasets without approval
5. Personal data rules
- Do not enter personal data into AI tools unless the tool is approved for that purpose.
- Never enter safeguarding information into a general AI chatbot.
- If you are unsure whether something is personal data, treat it as personal data.
6. Quality and fact checking
Anything created with AI that will be published externally must be checked for:
- Accuracy (facts, dates, claims)
- Tone and appropriateness
- Accessibility (plain English, inclusive language)
- Compliance (fundraising, privacy, safeguarding)
7. Transparency
We will be transparent where it is appropriate to do so, especially if AI is used in a way that could affect trust.
8. Tool approval and access
- Approved tools list is maintained by: [name / role]
- Requests for new tools go to: [name / role]
- Where possible, use organisational accounts rather than personal accounts.
9. Training
All staff and volunteers using AI tools will receive basic training and examples, including what not to do.
10. Review
This policy is reviewed every [6 or 12] months, or sooner if there is a significant change in tools, law, or risk.
A simple “AI use log” (takes 10 minutes to start)
Create a spreadsheet with:
- Tool name
- Who uses it
- What it is used for
- What data goes in
- What comes out
- What checks happen
- Notes and incidents
This is not bureaucracy for its own sake. It is how you stay in control.
Practical examples: safe prompts and unsafe prompts
Safer prompts
- “Rewrite this paragraph in plain English for a general audience.”
- “Summarise this public web page into 5 bullet points.”
- “Create three headline options for a fundraising appeal. Do not invent statistics.”
Risky prompts
- “Here is a list of donors with contact details. Draft personalised emails.”
- “Here are case notes about a beneficiary. Suggest next steps.”
- “Review this safeguarding incident report and advise.”
FAQs (AEO friendly)
Do trustees need to approve AI use?
Trustees do not need to approve every prompt, but they should ensure there is appropriate oversight, risk management, and policy in place.
Can a charity use AI under UK GDPR?
Yes, but you must still follow UK GDPR principles. The key is understanding what personal data you are processing, the lawful basis, and whether the tool is appropriate for the sensitivity of the data.
Should we ban AI?
A blanket ban often fails in practice. A better approach is approved tools, clear rules, and training.
What is the first AI tool a small charity should try?
Start with a tool that helps with low risk tasks, such as rewriting text for clarity, drafting outlines, or summarising public information. Avoid tools that require you to paste in sensitive data.
Next steps (no pressure)
If you want to keep this practical, focus on two outcomes:
- A one page AI policy your team can follow
- A repeatable content workflow where AI helps with first drafts and humans do the final check
If you would like help setting up a charity friendly website content process, accessibility checks, or a simple governance template that fits your organisation, that is exactly the kind of work we do at Third Sector Studios.
Divider Text