Are there rules about charities using AI?

England and Wales: This page sets out the position in full. Scotland: the same — data protection is reserved and applies identically, and OSCR, searched directly for this guide, publishes no AI guidance to charities of its own. Northern Ireland: the same — data protection is reserved in the same way, and CCNI’s guidance, read in full, links to cyber security resources but sets no requirement for an AI-use policy.

The complete regulatory record is three items

Everything a UK regulator has said on charities and AI comes to three items. They are the same across the UK. They are what the trustees need before writing a charity AI policy.

The data rules are the ones that bind. So if you have not yet written your data protection policy, do that first.

1. One Charity Commission blog post, 2 April 2024. When this guide checked on 7 August 2026, it was still the only item in the Commission’s blog category on AI. The post says: “We don’t currently anticipate producing specific new guidance on the use of AI, preferring — as for cryptocurrency — to encourage trustees to apply our existing guidance to new technologies as they emerge.”
2. The ICO‘s “Guidance on AI and data protection”. It explains how existing UK GDPR principles apply to AI. It says of itself that it “was updated on 15 March 2023”. It also carries a live warning: “Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change.”
3. SI 2026/425, in force since 12 May 2026. It requires the Information Commissioner to write an AI code of practice. It is not the code. More on this in the section on the statutory AI code.

That is all. No charity-specific statute. The NCSC has a topic page on AI with nothing aimed at charities.

So the UK has no charity-specific AI requirement. The Commission has said in terms that it does not plan to create one. This is a decision the trustees make, not a rule they follow.

Required but not yet written: the statutory AI code

This is the easiest point on the page to get wrong.

The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 — SI 2026/425 — came into force on 12 May 2026. It was made under new powers the Data (Use and Access) Act 2025 inserted into the Data Protection Act 2018.

Its regulation 2 requires the Information Commissioner to prepare a code of practice. The code must cover good practice in developing and using AI, and in automated decision-making. The code must also address children’s personal data.

The Regulations contain no AI rules of their own. They are a duty on the Commissioner to write a future code. Someone may tell you “there are statutory AI regulations now”. If so, they are right about the title and wrong about the effect. A charity has nothing in them to comply with.

The code itself is required but not yet written. This guide last checked on 8 September 2026. It had not been published. The ICO’s own plan describes it as something it “will develop”, with no publication date. Earlier commentary expected it in summer 2026. That date has passed.

An absence like this can end at any time. Diarise a check every quarter. When the code appears, read it and revisit your position.

What does bind: ordinary data protection

No AI rule does not mean no rules. The law that already applies to your data applies to it inside an AI tool too.

• Session notes, case notes and records about people are personal data. Where they touch health, they are special category data, which needs its own condition. Your data map and your lawful basis decide whether any tool may see them, not the tool’s marketing.
• Security follows the data. UK GDPR Article 32 says the charity must have security appropriate to the risk. Pasting personal data into a tool you have not checked is a security decision. The step to assess your cyber security baseline is where you check it.
• Drafting from non-personal material engages none of this. Using a tool to draft a grant application from your own published figures and project plans raises no data protection question.

The ICO’s existing guidance applies these same principles to AI. It is under review. So treat its detail as provisional.

If something does go wrong, do not expect a lighter touch for being a charity. The ICO published its public sector approach on 11 November 2025. It says of charities and social enterprises: “These organisations do not fall within the scope of the public sector approach.”

Past cuts to charity fines came through the ordinary fining guidance, open to any organisation. They were not a charity discount.

What the annual return does not ask

You may have read that the charity annual return now asks whether you use AI tools. It does not. This guide read the Commission’s full 2025 and 2026 question guide end to end. There is no AI question and no cyber security question in it. The claim came from an AI-generated summary of a source this guide does not use.

The questions the return does ask are set out in what the annual return actually asks.

The return’s governance section does ask which of a list of named policies you have. AI is not on the list. This is the Commission’s return. OSCR and CCNI run their own. Neither regulator publishes AI guidance to charities.

The EU AI Act: commentary, not a UK position

Some legal commentary argues that the EU AI Act could reach a UK charity whose AI outputs affect people in the EU. That is sector legal commentary. The EU AI Act is not UK law, and no UK regulator has addressed the point.

It may matter to you, for example because you work with people in the EU. If so, take advice on your own facts rather than rely on a summary.

Write your charity AI policy

No regulator requires one. So the deliverable is short: a written position, a page at most. It should record:

1. Which tools the charity allows, by name.
2. For what — drafting, summarising, translation, and so on.
3. No personal data in unapproved tools. Say which tools, if any, are approved for personal data, and why.
4. A named human check on anything produced with AI before it is sent out or published.
5. A quarterly re-check, diarised, for the statutory code.

Have the trustees adopt it and minute the date. Then tell staff and volunteers. The volunteer who has already started using a chatbot is the person the position is for.

Next: choose and set up your core digital tools. Any AI tool you approve here goes on that list. Then claim charity discounts and donated software for the tools on it.

Common mistake: “there are statutory AI regulations now”

An instrument with “Artificial Intelligence” in its title is in force. But SI 2026/425 contains no substantive AI rules. It requires the Information Commissioner to prepare a code of practice. That is a duty to write a future code, not the code. As at 8 September 2026 no code had been published. Check again every quarter.

Common mistake: “the Charity Commission requires an AI policy”

Sector content fills the space the regulator left empty. The Commission’s complete record is one blog post. It says the Commission does not “currently anticipate producing specific new guidance on the use of AI”. It prefers trustees to apply existing guidance. No charity-specific requirement exists. This is a decision you make, not a rule you follow.

Common mistake: believing the annual return asks whether the charity uses AI

The same kind of AI-generated summary that invented a cyber question invented this one. The full question guide contains no AI question. That is the Commission’s return for England and Wales. OSCR and CCNI were both checked for AI guidance of their own. Neither publishes any.

Common mistake: stating that the EU AI Act applies to UK charities

Legal commentary on its reach is repeated as if it were a regulator’s position. It is not UK law. No UK regulator source addresses the point. Treat it as commentary, with its status stated.

Worked example

Tollgate Youth CIO’s employee wants to use a generative AI tool for two jobs. One is drafting grant applications. The other is tidying up session notes about individual young people.

No rule applies. So the position is the trustees’ own. The ICO’s AI guidance applies ordinary UK GDPR principles. It is under review. The statutory code had not appeared when the trustees looked.

The trustees split the two jobs. Grant drafting from the CIO’s own non-personal material raises no data protection question. So they allow it with one named tool.

Session notes are different. They are personal data about young people, and special category data where they touch health. The data map and lawful basis at steps 1 and 2, and the security duty at step 10, decide whether any tool may see them. Until those answer yes for a specific tool, the notes stay out.

The outcome is a short written position adopted by trustees. It covers which tools, for what, no personal data in unapproved tools, and a named human check on anything sent out. A quarterly re-check is diarised against the code’s publication.