Most charities and membership bodies we speak to have the same position on AI: some people are using it, others are waiting to be told they may and the board has not yet discussed it. The policy is what moves all three, which is why it comes before any tool, and why it has to be written for the questions a board will ask.
The first rule is about the data you hold on people
A charity holds case records on the people it serves, while a membership body holds data on every member, often including what they paid, what they complained about and what they are studying. Because both sit under data protection law and both are the reason people trust you, neither should ever go into an AI tool on any account.
Write that as the first line of the policy, in one sentence, and make it the one sentence every person and every volunteer can repeat. Everything else in the document sets conditions on how AI may be used, so this line goes first, where a volunteer who reads only the opening will still find it.
The five questions the board will ask
Trustees and board members carry personal accountability, so their first questions are about exposure. Answer these in the policy and in the paper that goes with it, so the board has what it needs to make a decision.
- What data could reach an AI tool, and what stops it? The first rule answers the second half, while the tool register and the account rule answer the first.
- Who approved the tools in use, and against what test? One named role, four questions: where the data goes, what the account can reach, who supplies it and whether there is a reason to use it.
- What happens when it gets something wrong? Name the categories of work where a person reviews the output before it leaves. For a charity or membership body, that means anything to a beneficiary or a member, anything with a figure in it, anything that becomes a commitment and anything a funder or regulator will read as a statement from you.
- What does it cost, and what are we already paying? Most charities and membership bodies are already paying for AI on personal cards and expense claims without one number for it, and the policy's account rule is what brings that spend into view.
- Can we show this to a funder, an auditor or our regulator if asked? Only if the register, the approvals and the review date exist as documents, which is why the policy has to say what gets recorded and who keeps it.
Volunteers and personal accounts
Volunteers are where charity policies usually fail, because the policy is written for paid people and volunteers are on none of the systems it assumes: the payroll, the email directory or the induction. A volunteer with a personal ChatGPT account and a spreadsheet of donors is the most likely route for case data to leave, and nothing in that sentence is misconduct, since nobody told them otherwise.
So the policy covers everyone who touches your data, paid or not, and the account rule is practical: here is how to move what you are doing onto an account we control, and here is who to ask. If you are small, that may be one shared, administered account with a named owner, which is better than personal accounts nobody can see.
Where this sits in the route
For a charity or membership body, the policy is written in a half-day workshop with your leadership team, with the board's questions above as the agenda. It is the first output of Govern, and the eight things any AI policy has to settle are the structure it follows.
How the whole route plays out for you is on the sector pages for charities and membership bodies, including the candidates where the answer is a plain workflow. If you would rather see where you stand first, ten questions take about two minutes and send nothing anywhere.