AI use policy for a charity

A charity's staff and volunteers use AI tools to write appeals, draft grant applications, summarise case notes and answer enquiries, on data about beneficiaries that is often the most sensitive a small organisation holds, under the oversight of trustees who are legally responsible and often unaware. The policy gives the trustees a governance position, keeps beneficiaries' data out of tools that should not see it, deals with generated appeals and grant applications, reaches the volunteers on their own devices, and provides the supplier terms. I draft both (the AI use policy and the contract provisions that accompany it) for the business for £995 fixed in five working days.

Who this is for

Registered charities, community interest companies, charitable incorporated organisations and not-for-profits in England and Wales, and the trustees who have been asked by a funder or an auditor what the charity's position on AI is.

What matters in a charity's AI use policy

Trustees, governance and the duty to think about it

Trustees must act in the charity's best interests, manage its resources responsibly and avoid exposing it to undue risk, under the Charities Act 2011 and the Charity Commission's guidance, and the Commission has said that trustees should consider the opportunities and risks of AI for their charity; the policy is drafted for adoption by the board, with a short trustee-level statement (what the charity uses AI for, the risks it has identified, who is responsible, how it is reviewed) and the operational policy beneath it for staff and volunteers, so that the minute recording the board's adoption is the evidence a funder or the Commission would ask for.

Beneficiaries, their data and the tools that must not see it

personal data entered into an AI tool is processing under the UK GDPR that needs a lawful basis, a notice to the individuals, a data processing agreement under Article 28 with the provider and, where the tool is used on people in ways that affect them, an impact assessment under Article 35, and a charity's beneficiary data (health, disability, immigration status, financial hardship, criminal records, religion, the circumstances that brought the person to the charity) is special category data under Article 9 or criminal records data under Article 10 needing a condition and the appropriate policy document under Schedule 1 to the Data Protection Act 2018; the policy keeps beneficiaries' identifiable data out of general-purpose and consumer tools entirely, permits case management tools' own AI features only under the tool's data processing terms with training excluded, requires the impact assessment before any tool is used on beneficiaries, and prohibits tools from deciding who receives a service, which for beneficiaries' special category data Article 22 of the UK GDPR as amended by the Data (Use and Access) Act 2025 restricts more tightly than for other data.

Fundraising, donors and the generated appeal

A generated appeal, case study or donor letter must comply with the Fundraising Regulator's Code of Fundraising Practice (truthful, not misleading, respectful of beneficiaries, with real stories used only with consent), must not invent a beneficiary or embellish a real one, must not generate images of beneficiaries or of suffering, and must be reviewed by a person before it goes out; donor data entered into tools for segmentation or wealth screening is the profiling the Information Commissioner has fined charities for when undisclosed, and the policy requires the privacy notice to describe it and the basis to exist; the electronic marketing rules under regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 apply to generated email appeals as to any other, with the soft opt-in extended to charities by the Data (Use and Access) Act 2025 on commencement.

Grant applications, reports and the funder that asks

Funders and statutory commissioners increasingly ask applicants whether and how AI was used in an application, some prohibit it and some welcome it, and a generated application that misstates the charity's activities or invents outcomes is a false statement to a funder; the policy permits tools for drafting and editing applications and reports with every factual statement checked against the charity's records, requires the funder's own rules to be checked and followed, requires disclosure where the funder asks, prohibits generated outcome data and generated beneficiary testimony, and requires the person signing the application to have read and owned it; trade secrets, confidential information and clients' data stay out of any tool whose provider may train on or retain the input, a line the Trade Secrets (Enforcement, etc.) Regulations 2018 (which protect only secrets kept by reasonable steps) and the business's confidentiality obligations both require, and a charity's confidential information includes its beneficiaries' stories, its funders' terms and its unpublished plans.

Volunteers, staff and the accounts the charity does not control

A charity's work is done by volunteers on personal devices and personal accounts, and a volunteer pasting a beneficiary's case notes into a free tool is the breach the charity will have to report; the policy applies to volunteers through the volunteer agreement and induction (the policy in plain terms, the approved tools, the prohibition on consumer tools for beneficiary and donor data, the duty to report), provides business accounts where the charity can afford them and limits what may be done without them where it cannot; staff are bound through contracts and the handbook, trustees through the code of conduct, and the policy names the person volunteers ask.

The contract provisions that go with the policy

The contract provisions drafted with the policy go into the charity's supplier agreements with tool and case management providers (beneficiary data, training excluded, retention, the data processing agreement, the location of processing, the provider's liability), its volunteer agreements and staff contracts (the policy incorporated), its agreements with fundraising agencies and consultants, and its service agreements with commissioners where they ask for the charity's AI position; the policy is reviewed by the board annually, and the trustee statement is published where the charity chooses to show funders that it has thought about it.

What it costs

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Do our trustees need to have a position on AI?

Yes: the Charity Commission expects trustees to consider the opportunities and risks for their charity, and a funder or auditor may ask. The policy includes a trustee-level statement for the board to adopt and minute, with the operational policy beneath it.

Can our caseworkers use AI to summarise case notes?

Only in the case management tool's own features under its data processing terms with training excluded, after an impact assessment, and never in a general-purpose or consumer tool. Beneficiaries' data is special category data and the policy keeps it where it is protected.

Can we use AI to write our fundraising appeals?

For drafting, with a person reviewing every appeal against the Code of Fundraising Practice before it goes out: truthful, real stories with consent, no invented beneficiaries, no generated images of suffering. Donor segmentation with tools needs the notice and the basis the regulator has fined charities for lacking.

Related guidance and services

• AI contracts and AI use policies, £995, the service this page describes
• Data protection agreements and privacy terms, £795
• Employment contracts and handbooks, £595
• Privacy notice for a charity
• AI use policy for a board of directors

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.