What should a charity AI policy include?

A charity AI policy should include five core elements: which tools are permitted and prohibited, what data must never be entered into AI tools, who is responsible for oversight, how outputs are reviewed before use, and a schedule for reviewing the policy itself.

1. Permitted and prohibited tools

Name the specific tools staff may use (for example ChatGPT Enterprise or Microsoft Copilot) and the tools they must not use. Generic statements like "staff may use AI tools" are not enough. Funders and trustees will ask which tools, and your safeguarding lead needs to know.

2. Data handling rules

State clearly what data must never be entered into a public AI tool: safeguarding records, personal data, medical information, confidential donor data and anything covered by GDPR or your data sharing agreements. Use examples so staff can recognise what to avoid.

3. Staff responsibilities

Name who is responsible for AI oversight (usually a senior leader or designated AI lead), who can approve new tools, and what every staff member is responsible for when using AI in their daily work.

4. Output review

AI outputs should be reviewed by a person before they are used externally, whether in donor communications, reports, social media or public-facing materials. The policy should state who reviews, what they check for, and what happens when an output is not fit for purpose.

5. Review schedule

AI tools and risks change quickly. A policy written today will need updating within six months. Include a review date and name the person responsible for triggering the review.

How to get a charity AI policy quickly

SAO Consultancy provides a tailored AI Governance Pack for £750, delivered in under a week. It includes the policy, a risk register with likelihood and impact scoring, and staff guidance in plain English, ready for trustee and funder review.