Quick answer: what is an “AI policy” for a charity?
An AI policy is a short set of rules that explains:- Which AI tools your charity can use (and for what)
- What data must never be entered into AI tools
- How you check accuracy and avoid harm
- Who is accountable (staff owners + trustee oversight)
- How you stay compliant with UK GDPR and fundraising expectations
If your charity is using (or even thinking about using) tools like ChatGPT, Microsoft Copilot, Canva, AI transcription, “smart” fundraising platforms, or automated email responders, you’re already in AI governance territory.
The good news: you don’t need a 40-page strategy to start. What trustees and senior leaders need is a clear, proportionate AI policy that protects beneficiaries, supporters, staff and the charity’s reputation — while still letting your team use helpful tools.
Why this matters right now
More people are getting answers from AI search (Google’s AI Overviews, Bing Copilot, Perplexity, ChatGPT browsing) and voice assistants. That means:
- Trustees are asking: “Is it safe for us to use AI?”
- Staff are asking: “What am I allowed to paste into these tools?”
- Supporters are asking: “Are you using AI to contact me or make decisions?”
If your charity can answer these questions clearly, you reduce risk and build trust.
The trustee checklist: 10 questions to agree this quarter
1) What are we using AI for (and what are we not using it for)?
Write down 3–6 approved use cases. Common low-risk examples:
- Drafting first versions of comms (then edited by a human)
- Summarising meeting notes (with consent and secure storage)
- Generating social post ideas
- Creating accessibility-friendly rewrites (plain English)
High-risk examples to pause and assess:
- Any automated decision-making about individuals (e.g., eligibility)
- Anything involving sensitive beneficiary data
- Anything that could be interpreted as professional advice
2) Which tools are approved?
List the tools your charity allows (and who can approve new ones). Include:
- Tool name
- Owner (staff role)
- Paid vs free plan
- Where data is stored
3) What data is banned from AI tools?
Create a “never paste” list. For most charities this includes:
- Beneficiary personal data
- Supporter payment details
- Passwords, API keys, access codes
- Safeguarding information
- Anything that could identify a vulnerable person
4) What’s our rule on personal accounts?
Decide whether staff/volunteers can use:
- Personal ChatGPT/Google accounts
- Personal devices
A simple starting rule: work content must be done in approved work accounts only.
5) How do we check accuracy and prevent misinformation?
AI can sound confident while being wrong. Require:
- Human review before publishing
- Fact-checking for stats, legal/medical claims, and funding info
- A “sources required” rule for anything factual
6) How do we handle bias, tone and safeguarding?
Set guardrails:
- No stereotyping of communities
- Avoid “deficit language” about beneficiaries
- Extra review for sensitive topics
7) What’s our transparency position?
Agree when you will disclose AI use. Examples:
- “This article was drafted with AI assistance and reviewed by our team.”
- If AI is used in fundraising personalisation, consider clear disclosure.
8) Who owns AI risk and governance?
Assign:
- Operational owner (e.g., Ops Manager / Digital Lead)
- Trustee lead (e.g., trustee with digital, risk, or safeguarding remit)
9) What training do staff and volunteers need?
Keep it simple:
- 30-minute induction module
- A one-page “AI do’s and don’ts”
- Annual refresher
10) How will we review this policy?
AI changes quickly. Set:
- Review every 6–12 months
- Immediate review after any incident
A simple AI policy template structure (copy/paste)
Use this as headings in a 2–4 page document:
- Purpose (why we use AI and what we’re protecting)
- Scope (staff, volunteers, contractors)
- Approved tools (and approval process)
- Approved use cases
- Prohibited use cases
- Data handling rules (UK GDPR, confidentiality, “never paste” list)
- Quality and accuracy (human review, fact-checking)
- Safeguarding and bias (extra controls)
- Transparency and comms (when we disclose)
- Roles and responsibilities (staff owner + trustee oversight)
- Training
- Review cycle and incident process
Practical next step: do a 60-minute “AI risk mini-audit”
In one hour, you can get to “good enough”:
- List every AI tool currently being used (including free accounts)
- Categorise each use: low/medium/high risk
- Turn off anything high risk until reviewed
- Agree your “never paste” list
- Assign an owner and set a review date
When you might need external help
If you’re a small charity, the hardest part is usually not writing the policy; it’s putting the basics in place (secure email, access control, backups, website security, and sensible processes).
If you want friendly, jargon-free support getting your digital foundations sorted (website care, security basics, email setup, and practical training for trustees and volunteers), Third Sector Studios can help: https://thirdsectorstudios.org.uk/
FAQ
Do UK charities need an AI policy?
There isn’t one single law that says “you must have an AI policy”, but trustees are expected to manage risk responsibly. If your charity uses AI tools, a short policy is a practical way to show oversight, protect data, and set clear boundaries.
Can we use ChatGPT with beneficiary information?
In most cases, you should not paste identifiable beneficiary information into general-purpose AI tools unless you have a clear legal basis, appropriate safeguards, and you understand where the data goes. Start with a “never paste” rule for personal and safeguarding data.
What’s the biggest AI risk for charities?
Common risks include accidental data sharing, misinformation in public comms, reputational damage, and unclear accountability. Most of these can be reduced with basic rules, training, and human review.
Sources and further reading
- Information Commissioner’s Office (ICO): Guidance on AI and data protection: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/
- National Cyber Security Centre (NCSC): Advice for small organisations (includes charities): https://www.ncsc.gov.uk/section/advice-guidance/small-medium-sized-organisations
- Third Sector / NCSC cyber security hub: https://www.thirdsector.co.uk/ncsc