Non-profits: capacity you could not afford, trust you cannot spend

A non-profit runs on the gap between what needs doing and who is available to do it. Tools that draft the grant application, summarise the consultation and write the newsletter land differently here than in a company: they are capacity the budget could never buy. The sector's own regulator for England and Wales, whose AI position this page reads, sees the same uses in practice: writing tools proving "helpful for fundraising materials, bid writing, speeches or drafting policies".

The same regulator also names the two things a non-profit risks that a company does not hold in the same way: trustee duty, and beneficiaries who did not choose to be data.

The trustee line is the only hard rule

The Charity Commission's position needs no translation: "Trustees remain responsible for decision making", and "it is vital this process is not delegated to AI or based on AI generated content alone". It gets concrete about what failing looks like: "trustees may not be complying with their duties if a charity relied solely on AI generated advice to make a critical decision about their charity without undertaking reasonable independent checks to confirm its accuracy".

That is automation bias written as a compliance finding. The board paper can be drafted by a model; the decision in the minutes cannot rest on one. And the regulator expects charities to "ensure that human oversight is in place to prevent material errors" — adding a reason specific to this sector: "the human touch is key to the way many charities operate and interact with their beneficiaries".

Beneficiary data is the asymmetry

A company's customer data problem is a non-profit's safeguarding problem. The Commission again: "Charities with beneficiaries who might be at higher risk, such as children, or who hold sensitive data like medical information, will need to be particularly mindful of the level of risk" — and, drily, "Some AI tools handle data in less secure ways than others".

The practical reading: case notes, safeguarding records and beneficiary stories sit at the strict end of what data may go in, and the person most likely to paste them is a volunteer with a personal account and the best intentions in the building. A one-page rule for everyone (what may go in, what never does, whose account) is worth more than a policy binder, and the Commission suggests exactly that: "consider if having an internal AI policy would be beneficial". The acceptable-use template scales down to a charity fine.

Where the capacity is real

The bid and the report. Grant applications and funder reports are structured, deadline-driven writing where a good draft from your own materials is most of the labour. The judgement about what the charity actually commits to stays human, because the funder holds you to the document.

The consultation and the casework summary. Condensing forty responses or a year of anonymised case notes into themes is the summarise-then-verify workflow, and a small team's only realistic route to doing it at all.

The donor letter, disclosed. Generated fundraising copy works until a donor feels deceived by it. The Commission's warning that models "confidently produce inaccurate, plagiarised, copyright infringing or biased results without any awareness that the results it has offered may be problematic" lands hardest here: a fabricated statistic in an appeal is a trust incident, not a typo. Disclosure is cheaper than discovery.

The volunteer multiplier. The same tools that help staff help volunteers — which means the one-page rule above has to reach people who were never onboarded, on devices the charity has never seen.

Much of the small-business page transfers directly: one shared account beats five personal ones, and plan choice for Claude, ChatGPT or Gemini is a budget line worth ten minutes.

What goes wrong

The safeguarding record in the chat. The most sensitive data the organisation holds, in the least governed tool it uses.

The board that approves the summary. AI-drafted paper, unread appendix, minuted decision — the exact shape the regulator described as a potential breach of duty.

The appeal with the invented number. Donor trust spends in one direction.

The grant application that promises what the model imagined. The funder audit arrives eighteen months later, against text nobody fact-checked.

Policy for staff, silence for volunteers. The people most likely to improvise are the ones the rule never reached.

How to check it worked

Run this check quarterly. Ask the last three people who joined — staff or volunteer — what the AI rule is; if they cannot say it in a sentence, it does not exist yet. Then take the last board decision that leaned on an AI-assisted paper and find the independent check in the record. The Commission's test is exactly that specific, and it is the one an inquiry would apply.