Mission Pointers

AI governance for charities: a checklist for trustees

A one-page AI governance checklist for charity trustees and CIC directors, with the questions your board should ask about how you use AI.

Mission Pointers · 4 October 2026 · 9 min read

In short

  • Most charities now use AI, but few boards discuss it, so it belongs on your agenda.
  • You don't need new rules. Your existing duties to act in your organisation's interests, manage risk and take reasonable care already apply.
  • Using AI with personal data may need a data protection impact assessment (DPIA).
  • Work through the 20-question checklist in a 30-minute board discussion, and name a lead trustee.
On this page
  1. Why AI is now a board-level issue
  2. The duties you already have
  3. Data protection and AI
  4. The Charity Governance Code
  5. The checklist
  6. How to use the checklist
  7. Free resources
  8. Sources

This guide is for charity trustees and community interest company (CIC) directors. You don't need to be technical. You just need to be able to ask good questions about how your organisation uses artificial intelligence (AI).

It explains why AI is now a board-level issue, which of your existing duties apply, and what regulators have said. It ends with a one-page checklist you can print, take to your next board meeting and tick off.

Why AI is now a board-level issue

AI is no longer something charities are just thinking about. The Charity Digital Skills Report 2026, based on 807 survey responses, found that 79% of charities are using AI tools in some way.

Governance hasn't kept up. The same report found that 51% of charities have no AI policy, rising to 62% of small charities. Only 7% have started reviewing AI use and risks regularly at board meetings.

The Charity Commission has noticed. Its Charity Sector Risk Assessment 2026 says AI can help charities improve efficiency, accessibility and impact. It also says trustees remain responsible for making sure the right safeguards, oversight and risk management are in place.

In practice, staff and volunteers may already be using free AI tools to draft emails, write bids or summarise meetings. If the board doesn't know, it can't manage the risks.

The duties you already have

Charity trustees

The Charity Commission's guidance The essential trustee (CC3) sets out six main duties. Three of them apply directly to AI:

Your duty (CC3)What it means for AI
Act in your charity's best interestsUse AI only where it helps the charity carry out its purposes
Manage your charity's resources responsiblyDon't expose the charity's assets, beneficiaries or reputation to undue risk
Act with reasonable care and skillUse your skills and experience, and take advice when you need it

CC3 applies in England and Wales. In Scotland, the charity regulator OSCR says trustees must act in the interests of the charity and act with care and diligence. In Northern Ireland, the Charity Commission for Northern Ireland's "Running your charity" guides explain trustees' duties.

What the Charity Commission has said about AI

The Commission set out its approach in a 2024 blog post, Charities and artificial intelligence. It said it didn't expect to produce specific new guidance on AI. Instead, it encourages trustees to apply existing guidance to new technology. The main points were:

  • AI should be used responsibly, in a way that furthers your charity's purposes.
  • Consider whether an internal AI policy would help, so it's clear how and when AI can be used.
  • Generative AI can produce inaccurate, plagiarised, copyright-infringing or biased results.
  • Trustees remain responsible for decisions. Relying only on AI-generated advice for a critical decision, without reasonable checks, may mean trustees aren't meeting their duties.
  • The Commission expects human oversight to prevent material errors.
  • Take extra care if you work with children or hold sensitive data such as medical information.

CIC directors

CIC directors have the same general duties as any other company director under the Companies Act 2006 (sections 171 to 177). Two matter most here:

  • Section 172: promote the success of the company. Where a company's purposes include more than benefiting its members, as a CIC's do, this becomes a duty to achieve those purposes.
  • Section 174: exercise reasonable care, skill and diligence. This is judged against what a reasonably diligent person in your role would know and do, and against your own knowledge and experience.

The CIC Regulator's guidance says a CIC must keep meeting the "community interest test" throughout its life. Each year, directors file a CIC report (form CIC34) showing how they've consulted stakeholders. The guidance says a CIC should have particular regard to the community it serves. So it's worth asking how your use of AI affects that community, and whether you've asked them.

We couldn't find any AI-specific guidance from the CIC Regulator.

Data protection and AI

The UK GDPR applies to any AI use involving personal data, such as beneficiary records, donor lists or staff information. The Information Commissioner's Office (ICO) has detailed guidance on AI and data protection.

Two points matter most for boards:

  • Accountability stays with you. The ICO says organisations can't delegate these issues to technical teams. Senior management is accountable for understanding and addressing them.
  • You may need a DPIA. A data protection impact assessment is required when processing is likely to result in a high risk to people's rights and freedoms. The ICO lists AI as an example of "innovative technology". A DPIA is required when innovative technology is combined with other risk factors, such as sensitive data or data about vulnerable people.

The ICO's AI guidance goes further. It says that in the vast majority of cases, using AI will involve processing likely to result in a high risk. If you decide a DPIA isn't needed, write down why.

The ICO says its guidance is under review following the Data (Use and Access) Act, so check for updates.

The Charity Governance Code

The Charity Governance Code was updated in 2025. It's voluntary, not a regulatory requirement, but many boards use it to check their governance.

The 2025 edition now addresses AI directly. Under its "Managing resources and risks" principle, it lists "a policy for the use of technology and AI tools" as suggested evidence of good governance. The same principle says the board should make sure the charity complies with data protection law, and review major and emerging risks regularly.

The checklist

Print this section and tick each question you can answer "yes". Every "no" is a prompt for an action, not a failure.

Strategy and opportunity

  • Do we know where AI is already being used in our organisation, including free tools used by staff and volunteers?
  • Have we discussed how AI could help us deliver our purposes, or get in the way?
  • Is our use of AI linked to our strategy, rather than happening ad hoc?
  • Do we have a written AI policy, or agreed guidance, saying what is and isn't allowed?

Risk and data

  • Is AI on our risk register, with someone responsible for it?
  • Have we set clear rules on what information must never be put into AI tools, such as personal or sensitive data?
  • Have we checked whether any of our AI use needs a DPIA, and recorded the decision?
  • Do we know how the AI tools we use store and use our data?

People and skills

  • Does the board understand AI well enough to ask good questions, or have a plan to build that understanding?
  • Have staff and volunteers had guidance or training on using AI safely?
  • Have we thought about how AI might change roles and workloads?

Transparency and ethics

  • Does a person always check AI-generated content before it's published, sent or relied on?
  • Are important decisions about people, money and governance made by people, not by AI alone?
  • Would we be comfortable explaining our use of AI to beneficiaries, donors and funders?
  • Have we considered the risks of bias, inaccuracy and copyright infringement?
  • Does our use of AI fit our values and, for CICs, the community we serve?

Oversight and review

  • Have we named a lead trustee or director for AI?
  • Does the board get regular updates on how AI is being used and any problems?
  • Do we know what to do if something goes wrong, such as personal data being put into the wrong tool?
  • Will we review our AI policy and this checklist at least once a year?

How to use the checklist

You can work through the checklist in a 30-minute board agenda item. Here's one way to do it:

  1. Before the meeting (one week ahead). Circulate the checklist. Ask your chief executive or a senior volunteer to note briefly where AI is already used.
  2. Set the scene (5 minutes). Explain why AI is on the agenda and remind the board of the duties above.
  3. Work through the five headings (20 minutes). Spend about four minutes on each. Tick what you can and note every "no" or "don't know".
  4. Agree actions (5 minutes). Pick two or three priorities, such as drafting an AI policy or checking whether you need a DPIA. Give each one an owner and a date.
  5. Record it. Minute the discussion and your decisions.

Name a lead trustee

Ask one trustee or director to lead on AI. They don't need to be an expert. Their role is to keep AI on the agenda, follow up actions and report back to the board.

The whole board stays responsible. The lead simply makes sure the work gets done.

Free resources

If you'd like an outside view on how your organisation uses AI, Mission Pointers offers support for organisations.

Sources

Next step

Want an outside view on how your organisation uses AI?

Support for your organisation

More guides