AI governance for charities

Make the policy usable in everyday work.

AI governance for charities means deciding who can use AI, for which tasks, with which information and under whose oversight. A policy is useful when a staff member can apply it to a real decision: whether to upload a document, approve a draft or stop a workflow.

AIHI helps charity teams connect readiness, training and practical safeguards. The starting checklist below is an operating framework to adapt to your organisation; it is not a certification or a substitute for context-specific legal and data-protection advice.

Give every use case an owner.

Keep a register of approved AI uses. For each entry, record the purpose, process owner, tool, users, information involved, output, human review point and review date. Note who can approve a change and who receives incident reports.

Trustees and senior leaders need a clear view of material risks, costs and outcomes. They do not need a transcript of every prompt. A concise board update can show which pilots are running, what evidence supports continuation and which issues require a decision.

Set boundaries around information.

Classify information before choosing a workflow. Public campaign copy, internal planning, donor records and sensitive beneficiary information need different handling. An organisation account alone does not establish that a tool is suitable for every category.

For the proposed use, check access permissions, provider terms, retention, training use, hosting arrangements and deletion options. Minimise the information provided and test whether the job can be done with synthetic, aggregated or redacted material.

Use the ICO’s AI guidance alongside your organisation’s data-protection assessment. A charity’s context and the particular processing determine what further assessment and controls are required.

Decide what needs human approval.

• External communications: check factual claims, tone, programme details and the evidence behind any impact figure.
• Donor care: define identity checks, escalation routes and who may change a record.
• Programme reporting: retain source evidence and flag contradictions or missing information.
• Recruitment or beneficiary-related decisions: assess the consequences carefully and retain accountable review and routes to challenge errors.
• Faith-sensitive questions: use approved information and refer matters requiring interpretation to designated qualified people.

The reviewer needs enough time, competence and access to sources to assess the output. A mandatory click without meaningful checking is not an effective control.

Use a practical pilot approval checklist.

Before a pilot starts, establish its scope and a named owner. Document the baseline, permitted data, test cases, staff training and the fallback process. Set a review date and decide what would trigger a pause.

Include realistic failure cases in testing: unsupported claims, confidential information in a prompt, missing documents, conflicting records and a request outside the intended task. Record what happened and who accepted any remaining limitations.

At the review, compare time saved after checking and rework, quality, incidents, cost and staff experience. Expand only when the evidence and operating controls justify it.

Train by role and review when things change.

A trustee needs to understand oversight and risk. A donor-care adviser needs to practise checking answers and handling escalations. An administrator needs to understand permissions and retention. Role-specific exercises help a team apply the same policy consistently.

Review the use case when a tool, data source, integration or intended purpose changes. Maintain a simple route for staff to report uncertainty or mistakes without hiding them. The Charity Commission’s discussion of charities and AI is a useful UK sector starting point.

Explore AIHI readiness and training, Learn with AIHI, or the تقييم الجاهزية للذكاء الاصطناعي. Talk to AIHI about turning your policy into a working pilot.