The question for charities is where AI can help them deliver their purpose, what must remain under human control, and what happens if they move too quickly or stand still. That makes it as much a governance question as a technology one.
Thank you to everyone who joined our recent webinar with Tomas Evans of PureCyber, where we looked at this. In this blog, Michael Jones, Partner at Bevan Buckland, pulls together the main points for trustees, chief executives and finance teams, including where charities are already using AI, where to take care, and what boards should do next.
Where Charities Are Already Using AI
Many charities are likely already using AI, whether or not the board has discussed it:
- Fundraising: drafting appeals and newsletters, and analysing donor data for giving patterns and lapsing supporters.
- Admin: summarising long documents and turning rough notes into minutes and action lists.
- Service delivery: chatbots answering routine questions outside office hours.
- Finance: flagging unusual transactions or variances for investigation, and producing first-draft budgets.
- Governance: summarising board packs and highlighting the matters that need a decision.
One caution for trustees: AI can draft the narrative in the trustees’ annual report, but the board is legally responsible for what is approved and signed.
Where to Start, and Where to Take Care
Start with tasks where the benefit is tangible, the risk is proportionate and a competent person can readily check the output. First drafts, summarisation, meeting notes and translation with human review are good examples.
Take greater care with recruitment and disciplinary matters, grant-making and funding decisions, financial decisions affecting individuals, and anything involving sensitive personal data. Greater caution does not mean a ban, but it does mean more oversight, clearer accountability and a data protection check before any use.
We also highlighted four areas where AI may help most: trustee decision support (such as modelling reserves under different income scenarios), compliance monitoring, capacity in small charities, and turning outcome data into insight for the board. In each case it improves the information behind a judgement without replacing it.
A Five-Question Test
Before any new use of AI, we suggest asking:
- What problem are we trying to solve?
- What information are we giving the AI?
- What happens if the answer is wrong?
- Who checks the output, and who remains accountable?
- Would we be comfortable explaining this use to beneficiaries, staff, trustees, funders or the regulator?
Question three is the one to spend time on. The greatest danger may be an answer that looks 95% credible but contains a critical 5% error in a legal, financial or safeguarding matter.
The Risks Boards Should Own
We covered eight risks: inaccuracy, confidentiality, fraud, reputation, bias, intellectual property, loss of human connection and the governance gap. Three deserve particular attention.
Confidentiality and shadow AI. Staff may paste beneficiary, health, employee, donor or safeguarding information into public AI tools, often informally. Charities routinely hold special category data, so where it goes matters. Your governance needs to cover the AI already being used informally, not only the systems you have approved.
Fraud and impersonation. In early 2024 a finance worker at the engineering firm Arup joined a video call with what looked and sounded like the CFO and colleagues. They were all deepfakes, and the employee made 15 transfers worth about $25m. Arup’s CIO later said it took him about 45 minutes to deepfake himself live using free open-source software. For charities the lesson is practical. A familiar face or voice is no longer proof of identity, no changes to payment or bank details should be approved on a call alone, and a call back on a known number and a second approver should be required.
The Charity Commission’s sector risk assessment also links AI to fraudulent applications to register a charity or to apply for grants. It reports that fewer than half of registration applications are now approved, compared with just under three in four a decade ago.
AI you didn’t choose. AI can arrive as a feature switched on inside a platform you already use. The National Trust paused its TikTok advertising after concerns about AI-generated adverts that clashed with its values and brand. The charity said an automated feature from TikTok ads had produced them in error. Values-led organisations are held to their values.
Trustees remain accountable for how the charity uses AI, even if they didn’t choose the tool. Without board-level oversight and a clear policy, the charity is carrying risk that nobody has signed off.
Standing Still Is Not a Neutral Choice
It is tempting to respond by banning AI. We would urge caution, for several reasons:
- A ban may not stop use. It can push staff towards free consumer tools without telling you, which increases risk rather than reducing it.
- If peers redirect administrative effort to the frontline, standing still has a real opportunity cost.
- Funders and public bodies will increasingly use AI themselves, so expectations of speed and quality will rise.
- Larger charities may have enterprise tools and cyber resources, and smaller ones may not. That risks widening inequality in the sector.
- Translation, simplification and speech-to-text can make your information and services more accessible, and valuable knowledge buried in policies, reports and minutes could be put to use.
Six Practical Actions for Boards
Rather than asking only “should we allow AI?”, ask where you are already using it, where it could help, and what controls you need.
- Discover where AI is already used, including informal and embedded uses.
- Educate staff, volunteers and trustees on the benefits, limitations and safe use.
- Establish a policy that is proportionate, including how tools are chosen and their data protection terms.
- Define uses: permitted, restricted and prohibited.
- Require human review and clear accountability for every use.
- Review regularly as tools, risks and expectations evolve.
Striking the Balance
Good governance sits between two risks: moving too quickly without understanding the consequences, and standing still and missing the chance to improve efficiency, accessibility and impact. Charities that use AI safely and effectively may become considerably more capable than those that don’t.
How We Can Help
If you are working through these six actions, or would like a second view on a particular use of AI, Michael and our charity team will be happy to help. Please get in touch by emailing mail@bevanbuckland.co.uk or calling 01792 410100 to find out more.
