AI for Charities UK: Uses and a Compliance Checklist

What AI can do for a small UK charity, and where to stop

Your chair has asked what the charity is doing about AI. Two staff already paste emails into a chatbot. Nobody has written a policy, and nobody has time to.

We'll follow one illustrative charity through this guide: a regional organisation with about 12 staff, a small fundraising team and a helpline that supports local people. It is invented, but the pressures are common.

Plenty of charities are in the same position. In the 2026 Charity Digital Skills Report, 79% of respondents were exploring, using or strategically using AI, though 41% were still only exploring. Only 18% had a formal AI policy. The main barriers were skills (56%), data privacy and security (43%) and accuracy (40%).

Charity office desk with an open laptop, a helpline headset and a tall stack of printed emails beside a mug of tea — For many small charities, the pressure to adopt AI lands on desks that are already full.

Three terms cover most of what you will meet. A generative assistant, such as a chatbot, produces text or summaries when you prompt it. Automation follows fixed, pre-set steps and is not necessarily AI. An AI agent takes actions toward a goal with more autonomy, so it needs closer oversight.

AI saves the most time on bounded back-office work: drafting, summarising and tidying. It is a poor fit for answering helpline queries or deciding what support someone gets. That boundary is a practical judgment, not a rule from a regulator.

The guide covers where AI helps, then gives one checklist per regulator: UK GDPR for personal data, the Charity Commission for trustee duties, and the Fundraising Regulator for appeals and donors. Later sections turn them into a short policy and a 90-day plan.

Where AI helps in fundraising, writing, data and services

Our regional charity can start with work that involves no personal data and move toward riskier uses only after the checklists in the next sections.

Use case	Benefit	Data risk
Trust research, bid first drafts	Saves desk research hours	Low, if only public information goes in
Newsletters, summaries, policy drafts	Faster drafting	Low
Cleaning spreadsheets, feedback themes	Saves manual tidying and coding	Medium to high
Segmenting appeals	Better targeting	High, personal data
Triage, translation, case note summaries	Time saved for caseworkers	High, may include special category data

Fundraising. Drafting a bid from the charity's own published material is a sound first use. Segmentation is where the money is claimed: Dataro reports The Leprosy Mission used AI donor predictions to cut mailing costs by £22,000, though that is a supplier's own figure.

Writing. Newsletters, policy drafts and summaries of long reports are the best starting point. Staff must check every fact before anything goes out.

Data. A peer-reviewed study on Tearfund datasets found substantial agreement between GPT-4o and human coders on categorising feedback, but poor results judging evidence of impact. Use it to sort themes, and have a person validate them.

Services. Hospice UK tested Copilot on email replies, meeting recaps and action lists. A chatbot that answers from verified website content and hands over to a human is safer than one improvising advice.

Tool types include general assistants such as ChatGPT, Claude and Copilot, features built into your CRM or Microsoft 365, and transcription tools. Read the current data terms before adopting any of them. The AI agents we've rated are a place to compare options.

Avoid free consumer tools for anything personal. Personal ChatGPT and Claude plans have no processor contract, and OpenAI's personal workspaces share data for model training by default. Beneficiary case notes do not go in.

Take a caseworker at our regional charity who wants an AI tool to summarise helpline notes. Each point below applies to that request. A data protection officer or adviser should review the answers before anything goes live.

Identify the data. Identifiable case notes are personal data, and the charity stays responsible for processing a supplier does on its behalf. Notes often mention health, ethnicity or religion, and inferences about those categories can count too.
Record a lawful basis. Document one for the summarising purpose. Special category data also needs an Article 9 condition.
Update privacy information. Tell people the purpose, retention and recipients, at the relevant time.
Minimise. Strip names and details the summary does not need, and have the caseworker check every summary before relying on it.
Run a DPIA. Article 35(1) requires one before processing likely to be high risk. The ICO's list names innovative technologies including AI. Skipping a required one risks a fine of up to £8.7 million or 2% of global turnover. Our DPIA templates are a starting point.
Check the supplier. Article 28 requires a contract with any processor that offers sufficient guarantees and follows documented instructions. Personal Claude plans may train on chats unless users opt out, so use a business plan.
Check transfers. A restricted transfer can arise when an organisation outside the UK gets access to data, including remote access. Ask where the provider processes data.
Limit automated decisions. The Data (Use and Access) Act 2025 replaced Article 22 with Articles 22A to 22D from 5 February 2026. Solely automated significant decisions still need safeguards: information, representations, human intervention and a way to contest. Summaries should inform a caseworker, never decide who gets help.
Handle rights. Rights can apply to inputs and outputs, so summaries must be findable. A DUAA complaints duty has applied since 19 June 2026, requiring a complaints route, acknowledgement within 30 days and a prompt response.

What trustees need to do about AI under Charity Commission guidance

The Commission has published no AI rulebook. Its April 2024 blog on charities and AI applies existing duties: weigh AI's benefits and risks against the charity's purposes, consider whether you have the skills and whether an internal policy would help, and keep human oversight. It also cautions trustees against relying on AI-generated material alone for critical decisions or delegating trustee decisions to AI.

The underlying duties come from The Essential Trustee: act in the charity's best interests, manage resources responsibly, and use reasonable care and skill. Risk management does not mean avoiding all risk, but the scrutiny should match what the decision affects. A tool that drafts newsletters needs less than one that touches beneficiary records.

Trustee checklist:

Approve the approach, after being sufficiently informed to explain and justify it.
Record the decision and the reasons in the minutes.
Name one person accountable for AI use.
Add AI entries to the risk register and review them periodically.
Know when to report. A serious incident is one that results in or risks significant harm to people, loss of assets, or harm to the charity's work or reputation. A significant data breach may qualify, but not every breach must go to the Commission.

For our regional charity, the trustee question is not whether the caseworker's summary tool works. It is whether the board has seen the DPIA, agreed the risk, and named who answers if a summary leaks.

Fundraising Regulator rules for AI-assisted appeals

The Fundraising Regulator has specific guidance on AI in fundraising, covering generative and predictive tools and updated on 8 December 2025. Charities and trustees stay accountable for AI outputs and for work done by third parties. Disclosure should be proportionate to the risk of misleading donors, so there is no duty to label every AI-assisted sentence.

Take our regional charity's winter appeal letter. If AI drafts it, the Code's standards on honesty, respect and avoiding undue pressure still apply. A composite "Sarah" presented as a real client, or a synthetic photo passed off as a beneficiary, is a misleading claim.

Consent comes next. The soft opt-in does not automatically cover every contact list, and live and automated calls follow separate rules. A charitable-purposes soft opt-in for email took effect on 5 February 2026, with conditions including direct collection of details and an opt-out. Scoring donors for giving capacity is profiling of personal data, so it needs a lawful basis and transparency. Any agent that sends messages on its own, as agentic AI can, needs the same preference checks.

Fundraising team checklist:

A person checks every fact, quote and image before the appeal goes out.
Synthetic images are never presented as real people.
Suppression and preference lists are applied before sending.
Wealth screening and scoring are documented and covered in the privacy notice.
Agencies and suppliers are assessed and monitored.
Personalisation stays within what donors would expect.

Red lines, human checks and an incident plan for sensitive data

The risks are concrete. In 2025 a staff member uploaded personal information about 2,031 people, including health details, to ChatGPT at an Australian reconstruction agency. In Victoria, a child-protection worker's ChatGPT-drafted court report contained inaccurate material and disclosed personal information. Social workers also described AI summaries inventing suicidal ideation a client never expressed.

Donor confidence is at stake too. In one survey, 38% of UK adults found AI deciding who receives charity support unacceptable, against 33% acceptable.

Safeguards that fit a small charity:

Red lines: no names, case notes, health, ethnicity or immigration details, or safeguarding records go into any tool not on the approved list. The Fundraising Regulator also advises against putting non-public information into open-access AI.
Anonymisation: removing names alone may not make data anonymous.
Human review: a person checks anything public or affecting a beneficiary. No support decision rests on AI output alone.
Incident plan: staff know who to tell the same day, because a reportable breach must reach the ICO within 72 hours.

A hypothetical case: a helpline caseworker pastes a client's notes into a free chatbot to save time. The summary adds a detail the client never gave, and the notes now sit outside the charity's control. The red line stops the paste. If it slips through, review catches the invented detail, and the incident plan starts the 72-hour clock.

A two-page AI policy your staff will read

A 12-person charity needs two or three pages, not a governance manual. Name one policy owner, list the tools staff already use, and tie AI risks to your existing data protection, safeguarding and risk processes. Few charities have done the groundwork: the 2026 Charity Digital Skills Report found 6% had started preparing data for responsible AI use and 7% reviewed AI use and risks at board meetings.

Use these headings: purpose and scope, approved tools, permitted and prohibited uses, data rules, human review, transparency to donors and beneficiaries, accountability and incident reporting, and training and review date.

Trustees should approve the policy and record that decision. For fundraising, the Fundraising Regulator recommends having a policy before using AI and publishing it accessibly.

Sample lines for the regional charity:

Free and personal AI accounts are not approved for any personal or confidential data. Case notes, names and safeguarding records never go into an AI tool. A named staff member checks every public item and any output affecting a beneficiary.

Free starting points are available from Charity Excellence, Torchbox and Peter Brady. Adapt each to your own tools and services before adopting it.

What AI costs and where charities can find discounts

Prices below were checked on 25 October 2026 and change often, so confirm current figures, UK eligibility and renewal costs with each provider before budgeting.

Tier	Example	Cost	Training on your data
Free	Claude Free	£0	Personal plans may train unless you opt out
Personal paid	Claude Pro	£18 a month	Same, opt-out needed
Business	ChatGPT Business, Claude Team	Nonprofit seats from $8 a user a month	Not used for training by default

Business plans also come with a data processing agreement, which matters for personal data.

Check what you already own first. Eligible nonprofits can get Google Workspace with Gemini at no charge, and the Charity Digital Exchange catalogue moved to TechSoup UK on 1 July 2025.

To estimate return, have two staff time one routine task, such as a newsletter draft, for four weeks, including review time. Multiply minutes saved by hourly cost, then subtract the licence. Reliable averages for hours saved per person don't exist yet, so use your own numbers.

A 90-day plan and master checklist

Month 1: ask staff what AI they already use, then pick one pilot, such as drafting the newsletter from public information.

Month 2: run the three checks, adopt a one-page policy, train users, and start the pilot with human review.

Month 3: measure time saved, then report to trustees.

Master checklist: - UK GDPR: no personal data in the pilot, DPIA decision recorded, privacy notice checked. - Charity Commission: trustees approve the approach and own the risk; the guidance covers England and Wales. - Fundraising Regulator: policy agreed, skills in place, pilot first, outputs checked.

Free help: Charity Excellence courses, NetHope's course, and Zoe Amar's trustee checklist.