AI Use Policy Template for UK Charities (Free 2-Page)

AI Use Policy Template for UK Charities (Free, 2-Page)

A free, board-ready AI use policy template for UK charities — covering data handling, human-in-the-loop, audit trail, tool rules, and funder disclosure. Two pages, designed to fit on a board agenda.

Last reviewed: 02/07/2026
Written by Ivan Siyanko, Founder & CEO, CharityIQ.

TL;DR
75% of UK charities now use AI; only 12% have a written AI use policy. The 2025 Charity Governance Code refresh added AI to the trustee agenda. The ICO’s updated AI guidance sets the data protection bar. Free 2-page template below covers 5 sections.

Why your charity needs one in 2026

1. Regulatory. The ICO’s updated AI guidance requires DPIAs to show “less risky alternatives” were considered. 2. Sector standard. The 2025 Charity Governance Code refresh explicitly addressed AI risks. 3. Funder due diligence. UK funders increasingly ask whether AI was used in applications. We covered this in ChatGPT for UK Charities.

What good AI policy contains

Five sections in the best ones: 1. Scope and principles. 2. Data handling rules. 3. Human-in-the-loop expectations. 4. Tool-specific rules. 5. Disclosure and audit.

The template — copy and customise

[CHARITY NAME] — AI Use Policy
Adopted: [date] · Approved by: [Board of Trustees]
Review date: [+12 months]

1. SCOPE AND PRINCIPLES
This policy covers all use of generative AI and other AI tools by staff, trustees, volunteers, and contractors of [charity name] in connection with charity work.

Our principles:
- AI assists; humans approve. Final responsibility remains with the human reviewer.
- Cite sources. AI-generated statistics, quotes, references must be verifiable.
- Protect beneficiary, donor, and staff data.
- Be transparent. Funders, regulators, beneficiaries who ask receive an honest answer.
- Improve, don't replace. AI frees up time for work requiring human judgement; not a substitute.

2. DATA HANDLING RULES
NEVER enter into AI tools not explicitly approved for that data category:
- Identifiable beneficiary data (names, addresses, case notes, health, immigration status)
- Identifiable donor data (giving history, contact details, financial status)
- Staff personal data (HR records, salaries, performance, health)
- Trustee personal data
- Confidential third-party information (funders, partners)

Anonymised, aggregated data may be used in any approved tool.
Public information may be used freely.

3. HUMAN-IN-THE-LOOP EXPECTATIONS
No AI output is published, filed, or submitted without human review.
Review requires: every claim read, statistics verified against source, tone reflects [charity name] voice, output complies with other policies.

High-stakes outputs need additional approvals:
- Grant applications over £20,000: trustee approval
- Trustees' Annual Report: full board approval
- Public statements: CEO approval
- Beneficiary case studies: explicit consent on file

4. TOOL-SPECIFIC RULES
Permitted for general use (no personal data):
- ChatGPT, Claude.ai, Microsoft Copilot, Google Gemini

Permitted for charity-specific work involving our data:
- [Approved sector tool, e.g., CharityIQ]

Prohibited:
- Any free AI tool for processing personal data
- Any tool not on this list, without prior CEO approval

Restricted (case-by-case approval):
- AI for HR decisions or recruitment screening
- AI for safeguarding triage or risk assessment
- AI for financial decisions over £5,000

5. DISCLOSURE AND AUDIT
Funder disclosure: if asked whether AI was used, answer honestly and specifically.

Internal audit trail: for grant applications, compliance documents, impact reports, maintain a record of: tool used, sources cited, reviewer, approval date.

Reviewed annually by Trustees and on request by external auditors.

If AI use results in inaccurate information being submitted, notify the affected party and correct within 5 working days.

POLICY OWNER: [name and role]
NEXT REVIEW: [date]

From CharityIQ. CharityIQ’s audit trail is automatic — every prompt, source, and human approval logged by default. See it in action →

Customising for your charity

1. Approved tools list — most charity-specific section. Audit which tools are actually in use. 2. Approval thresholds — calibrate to your scale. 3. Data handling rules — tighten if you process special category data. 4. Disclosure expectations — build in major funder requirements. 5. Policy owner — pick one person, usually CEO for small charities.

How to get trustee approval

Step 1: 15-minute briefing at one board meeting (awareness, no decision). Step 2: Circulate draft for written comments (2 weeks). Step 3: 20-minute decision at next meeting. Total: ~8 weeks elapsed, ~1 hour trustee time each.

Common policy mistakes

1. Too long — stick to 2 pages. 2. Vague approval thresholds. 3. No tool list. 4. Missing disclosure clause. 5. No review date. 6. No owner.

Adjacent policies

The AI policy slots in alongside: privacy notice (GDPR checklist), safeguarding policy, information security policy.

FAQ

Q: Do small charities need an AI policy? If anyone uses AI for charity work, yes. Q: Can we adopt this template as-is? Yes, but customisation adds value. Q: Trustees Act 2011 link? Adopting the policy helps evidence “reasonable care, skill, and diligence” (see trustee duties post). Q: CharityIQ audit trail enough? For CharityIQ-drafted outputs, yes. For ChatGPT, you’ll need supplementary records.

What to do next

1. Audit current AI use — list every tool, who uses it, for what. 2. Customise the template. 3. Schedule trustee briefing for next board meeting.

AI policy + audit trail, automated.
Start a free 14-day CharityIQ trial. Join Waitlist →

Written by Ivan Siyanko, founder of CharityIQ.

Sources: ICO AI guidance · Charity Governance Code 2025 · Charity Digital Skills Report 2025