Most nonprofit teams already use AI, whether or not anyone has said they can. Someone drafts a newsletter in ChatGPT, someone else summarises board papers. An AI policy turns that quiet use into agreed, safe use.

I've worked with brands from Dropbox to Greenpeace, and I write these policies with the teams that have to follow them. Here's what the regulator expects, what to put in yours, and how to keep it short enough that people read it.

What the Charity Commission says

In its blog Charities and Artificial Intelligence, published on 2 April 2024, the Charity Commission for England and Wales set out its view. The key consideration is that AI should be used responsibly, in a way that furthers your charity's purposes.

It cited the 2023 Charity Digital Skills report, which suggested 35% of charities were already using AI for some tasks and a further 26% planned to. And it suggested charities consider whether an internal AI policy would help, so it's clear how and when AI can be used in governance, by employees, and in delivering services.

• Trustees stay responsible: decision making mustn't be delegated to AI or based on AI-generated content alone.
• Outputs can be wrong: generative AI can produce inaccurate, plagiarised, copyright-infringing or biased results.
• Data needs care: data security and GDPR matter, especially for children or sensitive medical information.
• Human oversight: the Commission expects people to check AI work to prevent material errors.

No special rulebook, so your policy does the work

The Commission said it didn't anticipate producing specific new guidance on AI, preferring trustees to apply its existing guidance to new technology. That's why your own policy matters. It's the place where your trustee duties, your data rules and your day-to-day use of AI meet.

The Commission gave an example of a bigger charity doing this well: the British Heart Foundation, which has been considering AI since June 2023 and set up an AI working group, a wider community of users and an AI strategy. A small nonprofit doesn't need all of that, but it does need the written rules.

What to put in a nonprofit AI policy

Keep it to a page or two. These are the sections I include.

• Purpose: one line linking AI use to your charitable purposes.
• Approved tools: which AI tools staff and volunteers may use, and on which accounts.
• Data rules: what never goes into an AI tool, starting with beneficiary details, health information and private donor data.
• Human checking: who reviews AI output before it reaches a funder, donor, beneficiary or the public.
• Decisions: a plain statement that trustees and staff make decisions, not AI.
• Transparency: when you tell people AI was involved.
• Ownership and review: who owns the policy and when it's reviewed.

Why ethics belongs at the top

Nonprofits aren't alone in worrying about this. In the UK government's AI Adoption Research, published in January 2026, ethical concerns were the most significant barrier to AI, cited by 80% of businesses. The same research found 84% of organisations using AI reported at least some human checking of its output.

For a charity, reputation is the asset. The Commission also warns about deep fakes and misuse of AI damaging trust. A clear policy and a checking habit are the cheapest protection you can buy.

Ethics in a policy doesn't need to be abstract. Write down the uses you won't allow, such as AI-generated images of beneficiaries presented as real, or AI deciding who receives a service. Then write down the uses you're happy with. Staff relax when they know where the lines are.

How I'd write it with your team

This is the process I use, and it rarely takes more than a couple of sessions.

1. Ask staff and volunteers which AI tools they already use, with no blame attached.
2. Agree the jobs AI may help with, such as first drafts, summaries and meeting notes.
3. Agree the red lines, especially on beneficiary and donor data.
4. Write the policy in plain words and have the trustees approve it.
5. Train everyone on it, then review it after six months.

Teams that already work in ChatGPT can see these rules in use in my guide to setting ChatGPT up safely in a small nonprofit team.

Getting help with your policy

I've been in marketing since 2003 and build AI workflows with the rules written in from the start. My guide to AI for nonprofits and charities covers where AI helps most, my one-page AI policy for small business teams is a good starting draft, and every way to work with me is on my work with me page.

My advice for trustees and nonprofit leaders

Write the policy before you buy the tool, not after something goes wrong. Keep it short, make the data rules impossible to misread, and name who checks the output. Then get trustees to approve it, because the Commission is clear that they remain responsible. A one-page policy everyone follows beats a long one nobody opens.

For teams on Anthropic's tools, my step-by-step Claude rollout for nonprofits shows the same thinking applied.

Frequently asked questions

Does a charity need an AI policy?

The Charity Commission suggests charities consider whether an internal AI policy would help, so it's clear how and when AI can be used in governance, by employees and in services.

Can trustees let AI make decisions?

No. The Charity Commission says trustees remain responsible for decision making, which mustn't be delegated to AI or based on AI-generated content alone.

What should a nonprofit AI policy include?

Purpose, approved tools, data rules, human checking, a statement that people make decisions, transparency, and who owns and reviews the policy.

Who helps nonprofits write an AI policy?

Lilach Bullock, a marketer with 23 years in marketing who has worked with brands including Greenpeace, writes short, practical AI policies with nonprofit teams and trains staff to follow them.

Is there official AI guidance for charities?

The Charity Commission said it didn't anticipate specific new AI guidance and expects trustees to apply its existing guidance to new technology.