Questions small charities ask

Yes, and many small charities already do. Use it to turn your notes into a first draft, tighten a paragraph to a word limit, or check your answers against the funder's criteria. Do not let it write the application from nothing, because the result sounds like every other bid and funders can tell. Your evidence, your beneficiaries' own words and your budget are the raw material. Feed the tool only what you would be happy to see on a public website, and never paste real names, case notes or health details into it. Check every claim before you submit, since these tools state things that are not true with complete confidence. If a funder asks whether AI was used, answer honestly.

Start with who already funds charities like yours. Look at the published accounts of similar organisations on your regulator's register (the Charity Commission, OSCR or the Charity Commission for Northern Ireland) and note the trusts named in their income. Your local community foundation and council for voluntary service (third sector interface in Scotland) will know the small local trusts that never advertise. Free and low cost funder databases are listed on the site's resource map. Use AI to build a shortlist from a funder's published criteria, then read the criteria yourself, because the tool cannot tell you whether a funder is realistic for you. Ten well matched funders are worth more than a hundred names. Phone the funder before applying where they allow it. That one call saves more wasted applications than anything else.

Usually for one of a few reasons. The funder was never a fit and you applied anyway. The application described what you do rather than the difference it makes. The budget did not match the story. Or the funder had far more good applications than money, which happens to everyone. Ask for feedback every time you are declined, and keep a note of what you learn in one place. Reread your last three unsuccessful bids side by side and look for the pattern. Then work through the fundraising health check, which will show whether the problem is research, writing, evidence or simply volume. A polite reply to a decline also keeps the relationship alive for next time.

Give it less room to invent. Put your real facts in the prompt (what you did, how many people, what changed, what it cost) and tell the tool to use only what you have given it and to flag anything it is unsure about. Ask it to list every factual claim in its draft so you can check each one. Treat any statistic, quotation, legal reference or named organisation it adds as unverified until you have found the source yourself. Figures about your own work must come from your own records, not from the tool. Have a second person read the final draft, since the person who worked with the tool stops noticing its mistakes. Funders remember charities whose claims did not survive checking.

Ask for the real cost of the work, which always includes a fair share of rent, insurance, management and admin. This is called full cost recovery, and many funders expect to see it in a budget. The split between core and project funding is less real than it looks, because every project needs someone to pay the bills and keep the books. If a funder will only fund direct project costs, build the overhead into each line (a share of the manager's time, a share of the office) rather than leaving it out. Some funders offer unrestricted grants, and those are worth pursuing hard because they let you spend money where it is needed. A clear cost model also makes every future bid faster to write.

Start with businesses that already have a reason to care. Your trustees' employers, suppliers you pay, firms whose staff or customers use your services, and companies that have backed similar causes. Ask for something specific and small first, such as a prize, a venue, printing, or volunteers for a day. Money comes more easily once a relationship exists. Write to a named person, keep the letter to one page, and say exactly what you want and what they get in return. Be honest about what you can offer. A small charity cannot promise national publicity, but it can offer local goodwill, a story for their newsletter and a team day their staff will remember. Follow up by phone or in person within a fortnight.

This is a commercial participation arrangement. In England and Wales charity law requires a written agreement before it starts, setting out how much the charity receives, how it is worked out and how long the arrangement lasts. Any advertising must tell customers in clear terms how much of the price goes to the charity. Scottish charity law has similar requirements, and in Northern Ireland check the Charity Commission for Northern Ireland's current guidance. Beyond the law, ask whether the product and the company fit your charity's purpose and values, because trustees carry the reputational risk. Have the agreement reviewed by someone with legal knowledge. Pro bono legal help is listed in the resource map, and the Code of Fundraising Practice has a section on working with companies.

Yes, within limits. Looking up someone's public profile, company role or past giving can be lawful under legitimate interests, provided you have written down that assessment and are open about it. Your privacy notice must say that you research supporters and what you look at, and people have the right to object. The ICO has fined charities for wealth screening without telling donors, so this is a real risk. Record only facts that are relevant to making a sensible approach. Do not record anything about health, family difficulties or beliefs unless the person has told you themselves. If you use AI to help, give it a person's public role, not their name and address, and never ask it to profile someone. Record where each fact came from, and read the ICO's guidance for charities if unsure.

Not the list. Donor names, addresses, gift amounts and anything about why someone gives are personal data, and pasting them into a public AI tool usually means sending them to a company outside your control with no agreement in place. Instead, ask the tool to write the letter with placeholders such as [FIRST NAME], [GIFT PURPOSE] and [WHAT IT PAID FOR], then do the mail merge yourself in your own software. You get the same saved time without the risk. If your charity pays for a business tier of an AI tool with a proper data processing agreement, your acceptable use policy should say what may go in. A thank-you that sounds like you, posted within a week, matters more than a clever one.

Donors usually drift away when nobody thanks them properly or tells them what their gift did. So thank quickly and personally, then send an update within a few months that asks for nothing and shows what their money paid for. Make it easy to give monthly, because regular givers stay far longer than one-off givers. Keep a simple record of who gave, when, and how you thanked them, even if that record is a spreadsheet. Once a year, write to people who have stopped giving and tell them you noticed and what they made possible. Do not treat every donor the same. A long-standing small giver and a first-time large giver need different letters. Keeping a donor costs far less than finding a new one.

Often not, if money is the only measure. Work out the real cost first, including staff and volunteer hours, and set a target you would be happy with even if attendance is poor. Many small charity events make little after costs, and the best of them make their money through sponsorship and donations on the night rather than ticket sales. Events are worth running when they also do something else you need, such as introducing you to new supporters, thanking existing ones, or giving a local company a reason to get involved. If you do go ahead, decide who is responsible for money handling, insurance, licences and safeguarding before you book anything. A quiz night you can repeat every year will beat a gala you can only run once.

It depends on how you run it. In Great Britain a raffle is a lottery under the Gambling Act 2005. A raffle where tickets are sold only at the event and drawn there is usually an incidental lottery and needs no licence, though there are conditions on what you can spend on prizes and how the proceeds are used. If you sell tickets in advance or beyond the event, you will normally need to register as a small society lottery with your local authority, and larger lotteries need a Gambling Commission licence. Northern Ireland has its own lottery law, so check with your council there. Read the Gambling Commission's current guidance before you print tickets, keep a record of sales and prizes, and follow its rules on age limits.

Gift Aid lets you reclaim from HMRC the basic rate tax a UK taxpayer has already paid on their donation, at no cost to the donor. To claim, your charity must be recognised by HMRC, and each donor must have made a Gift Aid declaration confirming they pay enough tax to cover it. It applies to gifts from individuals only. A company takes its own tax relief on a donation, so never claim on company gifts. You claim online through HMRC's Charities Online service, and can go back to earlier years within HMRC's time limit, which is on gov.uk. Many small charities leave money unclaimed because nobody owns the task. Give it to one person, collect declarations at the point of giving and keep them safely. Our guide walks you through setting it up from nothing.

Yes, through the Gift Aid Small Donations Scheme, often called GASDS. It lets you claim a Gift Aid style top up on small cash and contactless donations without a declaration from each donor. There is a limit per donation and a cap on what you can claim in a year, both set by HMRC, so check the current figures on gov.uk before planning around them. You must also be making ordinary Gift Aid claims, and the amount you can claim under the scheme is linked to them. Keep records of where and when the cash was collected and banked. Sponsorship money is better claimed through ordinary Gift Aid with a declaration from each sponsor. Raffle tickets and payments for goods or event tickets qualify under neither scheme, because the giver receives something in return.

Registration is voluntary, but the Code of Fundraising Practice applies to every charity that fundraises in England, Wales and Northern Ireland whether registered or not. Registering lets you display the Fundraising Badge, which donors and some funders look for, and costs a small annual fee for smaller charities, with a levy for larger spenders. Check the current amounts on the regulator's website. In Scotland, fundraising complaints go to the Scottish Fundraising Adjudication Panel, and OSCR expects charities to follow the code. Whatever you decide about registration, read the code sections that cover how you actually raise money, and make sure trustees know that complaints about fundraising can reach the regulator. The fundraising compliance check shows which parts of the code apply to you.

Yes, with limits. Minutes are the legal record of what the board decided, so a person must own them. The safest route is for the secretary to type rough notes during the meeting, then ask the AI to tidy them into the minutes template. Strip out anything confidential first, especially names of people you support, staff performance and legal disputes. Be cautious about recording the meeting and feeding the audio to a transcription tool. Trustees need to know and agree, and the recording is then personal data sitting on someone else's server. Whatever the AI produces, the chair checks every decision and action against their own memory before the minutes go out. If a trustee later challenges a decision, saying the AI wrote it is no defence.

Less than people fear, but it has to be done on time. File the annual return and, if your income is above the current threshold on gov.uk, your accounts and trustees' annual report. Keep your register entry current, which means telling the Commission when trustees or contact details change. Hold the meetings your governing document requires, including an AGM if it says so. Charitable companies also file with Companies House. In Scotland, OSCR wants an annual return and accounts from every charity whatever its size, and the Charity Commission for Northern Ireland takes a similar approach. The Commission also expects the board to review its policies, keep a reserves policy and report anything that counts as a serious incident. Put the dates in a shared calendar with two named owners.

File it now, before anything else. Your entry on the public register is already marked as overdue, and funders, banks and commissioners look at that page. Once you file, the marker clears. For a first lapse the Commission's main response is the public flag and a reminder. Persistent failure is a different matter. The Commission treats repeated late filing as evidence of poor governance, has run inquiries into charities that default more than once, and persistent failure to file is an offence under the Charities Act 2011, though prosecution is rare. Minute the lapse, record why it happened and set up a calendar reminder with two named people responsible, so the board can show it has fixed the cause. OSCR and the Charity Commission for Northern Ireland also mark late filers on their public registers.

Your governing document sets the minimum, and it is often three. The Charity Commission also recommends at least three, so that no one person can control decisions and the board can still meet if someone steps back. Drop below your minimum and the board may lose the power to act, so check your constitution before anyone resigns. Recruitment is hard for every small charity, but the usual mistake is advertising only to friends of current trustees. Write a role description that is honest about the time involved, use the free trustee matching services in the resource map, and approach people with a specific skill you lack rather than making a general plea. Offer a conversation and a meeting as an observer before anyone commits. A skills matrix shows you who you are really looking for.

The law does not require one for a charity your size, and only larger charities must describe their approach to risk in the trustees' annual report. Have one anyway, because it is the quickest way to show funders and the Commission that the board is paying attention, and because the exercise surfaces what people have been quietly worrying about. Keep it to a single page. List the eight or ten things that would really hurt you, such as losing your main funder, a safeguarding failure, the one person who understands the finances leaving, a data breach or a cyber attack. For each, note likelihood, impact, what you already do and who owns it. Review it twice a year at a board meeting. If it runs to five pages nobody will read it.

Possibly, if you do it properly. Trustees cannot be paid for being trustees, and paying one, or their firm, for services is allowed only under conditions. In England and Wales the Charities Act 2011 permits it if your governing document does not forbid it, there is a written agreement, the amount is reasonable, the board decides it is in the charity's best interests, and only a minority of trustees are paid. Scotland and Northern Ireland have similar rules under their own Acts. The treasurer declares the interest and leaves the room for the discussion and the vote. Minute it and disclose the payment in your accounts. If the treasurer is also doing the books, who is checking the treasurer? Get a second quote to show the price was fair, and read your regulator's guidance on paying trustees before agreeing anything.

Yes, and knowing each other is exactly why. In a small charity the conflicts are personal rather than corporate. A trustee's partner applies for the part time job, you rent the chair's church hall, a trustee's daughter uses the service. None of those is wrong. What goes wrong is nobody saying it out loud or writing it down. The policy needs to do four things. Everyone completes a declaration of interests when they join and updates it yearly. Conflicts are a standing item at the start of every meeting. A conflicted trustee leaves the room for the discussion and the vote. The minutes record all of it. The Charity Commission requires trustees to identify and manage conflicts, and funders often ask to see the register. Adopt the template at your next meeting.

Fewer than the templates suggest, but more than none. A privacy notice is a legal requirement under UK GDPR if you hold anyone's personal data, and you do. A written health and safety policy becomes compulsory once you employ a certain number of staff, so check the current figure on the HSE website. Beyond those, very little is strictly law for a charity your size. What matters is what the Charity Commission expects and what funders and commissioners will ask to see. That means safeguarding, conflicts of interest, financial controls, reserves, complaints and expenses, and an acceptable use policy for AI. Do not adopt twenty policies in one go. A short policy the board has read and follows beats a long one nobody can find. Review them on a rolling cycle, two or three a meeting.

In England and Wales the Charity Commission expects trustees to report serious incidents promptly, and not reporting can count against you later. Serious means significant harm to people who come into contact with the charity, significant loss of money or property including fraud, a data breach affecting many people, or anything likely to damage the charity's reputation badly. The test is significance. A missing petty cash tin is not a serious incident. A safeguarding allegation against a volunteer is. You report through the Commission's online form, and you can report first and add detail later. Reporting is not an admission of failure. In Scotland OSCR calls these notifiable events, and the Charity Commission for Northern Ireland has its own process. Keep a log of every incident, including those you decide not to report, with your reasons.

The board's, and the Charity Commission says so plainly. Trustees are responsible for safeguarding everyone the charity deals with, including staff and volunteers, not only children and adults at risk. Staff run it day to day, but the board has to know it is working. Three changes fix most of the gap. Name a trustee as safeguarding lead so someone asks the questions. Make safeguarding a standing agenda item, even when there is nothing to report. Ask the staff lead for a short written report twice a year on training, criminal record checks where they apply, incidents and lessons. Trustees need to know the policy exists, who the designated lead is, how a concern is raised, and that it would reach the board. If you cannot answer those tonight, that is your first agenda item.

Only if your governing document allows it, so read that first. Many model constitutions permit written resolutions, but some require every trustee to agree rather than a majority, and older documents say nothing, in which case do not rely on it. Where it is allowed, treat the email thread as a formal vote. State the exact wording, ask each trustee to reply yes or no, give a deadline, and have the secretary record the result and date in the next minutes. WhatsApp is poor for this because messages disappear, people miss them and chat mixes with decisions. Use it to arrange things, not to decide them. For anything significant a short video meeting is better. Check whether your governing document allows virtual attendance. Many do, and the Commission has guidance if yours does not.

Yes, provided you treat the output as a first draft and not the finished policy. Start from the Tributary templates rather than a blank prompt, then ask the AI to adapt the wording to your size, your activities and your regulator. Tell it which nation you are registered in, because safeguarding, filing and trustee rules differ in Scotland and Northern Ireland. Ask it to flag anything it is unsure about rather than fill the gap. Never paste a real incident, complaint or name to illustrate a point. Then the hard part. A trustee reads the whole draft, checks any legal claim against the regulator's own guidance, and the board adopts it in a minuted decision. A policy nobody has read is worse than no policy, because you will be held to it.

It is a risk, and funders and the Commission will see it as one, however honest the founder is. The board exists to hold the people running the charity to account. When one person chairs the board, manages the work and controls the money, nobody is doing that. Financial controls fail because one person can both authorise and make a payment. Decisions go unchallenged because trustees defer to whoever knows most. And if the founder is paid in any way, the arrangement may breach the governing document. You do not have to push the founder out. Separate the roles. Elect a different chair, decide whether the founder is a trustee or an employee after checking what your constitution allows, and require two people to approve every payment. Founders usually feel relieved rather than sidelined.

A week ahead as a rule, and never the night before. Trustees who read the pack on the way to the meeting cannot make a considered decision, and the Commission's test for a sound decision includes being adequately informed. Keep the pack short enough to read in an hour. Include the agenda with each item marked for decision, discussion or information, the last minutes and action list with progress, a one page finance report showing actual against budget and the cash position, a safeguarding and incidents line, any changes to the risk register, and a short paper for each decision stating the recommendation and the alternatives considered. Put the papers in agenda order, with information only items at the back. Use the same template every time, and let AI tidy the prose once the numbers are right.

If anyone in your charity uses ChatGPT, Copilot or a similar tool for work, then yes, and someone almost certainly does. Without one you have shadow AI, where staff and volunteers decide for themselves what is safe to paste into a tool. The board signs it off, because the risks are governance risks. Data protection, confidentiality about the people you support, reputation and the accuracy of anything sent in the charity's name all sit with trustees. Trustees do not have to write it. The manager or a volunteer drafts it from the template, the board discusses it once, adopts it in a minuted decision and reviews it yearly. Keep it to two pages. It should name the approved tools, what must never be entered, who checks AI output before use, and what to do when something goes wrong.

Start with what you know. List your committed costs (salaries, rent, insurance, software) and the income you can rely on, such as confirmed grants and regular donors. That is your core budget, and the board needs to see whether it balances on its own. Then add likely and hopeful income as separate lines rather than mixing it in, and attach to each the spending it would pay for. If a bid fails, you remove that pair and the core budget still stands. Agree with trustees in advance what happens if income falls short, for example which costs pause first. Review the budget against actuals every quarter and change it when the facts change. A budget is a plan, not a prediction, so a revised one is a sign of good management.

There is no right number. Reserves are the unrestricted funds you could spend tomorrow, so they exclude restricted grants, money the board has set aside for a purpose and the value of buildings or equipment. Work out what you would need if your main income stopped. How many months of core costs would it take to find new funding or wind down properly, paying staff notice and honouring commitments? That is your target, expressed as a range. Your policy should say why you hold reserves, what the target is, where you stand against it and what you will do if you are above or below. Trustees review it every year and summarise it in the trustees' annual report. A policy that amounts to holding whatever is left over will not satisfy a funder or the regulator.

For most small charities in England and Wales an independent examination is enough. Whether you need one at all, or an audit instead, depends on your gross income and assets. The thresholds change, so check the current figures on the Charity Commission's site before your year end. Your governing document can demand more than the law does, so read it. Funders sometimes ask for audited accounts in their grant conditions, which is worth negotiating before you sign. In Scotland and Northern Ireland every registered charity needs some form of external scrutiny however small its income, with an audit required above a threshold set by OSCR or the Charity Commission for Northern Ireland. An examination is cheaper and less intrusive than an audit, but it still needs a competent and genuinely independent person.

It depends on the kind of accounts you prepare. If you produce receipts and payments accounts, the examiner needs the ability and practical experience to do the job properly but does not have to hold a professional qualification. If you prepare accruals accounts above the threshold set by your regulator, they must belong to one of the professional bodies the Charity Commission lists. In every case they must be independent, which rules out trustees, staff, anyone involved in running the charity, and their spouses, partners, close relatives, business partners or employees. A trustee's friend is not automatically barred, but ask yourself whether they could tell the board something it did not want to hear. If not, find someone else. Local accountancy firms and volunteer matching services often provide examiners free or at low cost.

Receipts and payments accounts record money as it arrives and leaves, with a simple statement of what you own and owe at the year end. They are simpler to prepare and open to unincorporated charities and CIOs below an income threshold set by the regulator. Accruals accounts match income and spending to the period they belong to, so a grant received in March for work in April is shown as deferred, and an unpaid invoice appears as a creditor. They follow the Charities SORP and are compulsory for charitable companies and for any charity above the threshold. Accruals accounts give a truer picture but take more skill. If you expect to grow, or funders keep asking for a balance sheet, moving to accruals a year early is easier than being forced to switch.

Build a rolling twelve month cashflow forecast showing when each payment will actually land rather than when it was promised. Most gaps are visible months ahead once you lay it out, which gives you time to act. Ask funders to pay in advance or in quarterly instalments, which many will do if asked at award stage. Chase late payers early, and invoice commissioners the day a milestone is met. Time large outgoings, such as insurance renewals, away from your thin months. Hold a reserve for this purpose, and agree with trustees in advance when you may draw on it. Do not borrow from restricted funds without the funder's written agreement. If a gap is unavoidable, talk to your bank about an overdraft before you need it, not after a payment bounces.

Yes, for the thinking and the structure, but not for the arithmetic. An AI tool is good at drafting a budget template, suggesting cost lines you have forgotten, writing the formulas for a spreadsheet, explaining what a variance means and turning your figures into a plain English note for trustees. It is unreliable at adding up and will present a wrong total with complete confidence, so the spreadsheet stays the source of truth and every number gets checked by a person. Never paste bank statements, payroll by name, donor names or anything that identifies someone you support. Use categories and round figures, for example "[CHARITY NAME] has income of [AMOUNT] from three grants and spends [AMOUNT] on two part-time staff". Treat the output as a draft from a bright volunteer who has never seen your accounts.

Enough that no single person can move money unseen, including the treasurer. Two people authorise every payment above a small limit you set, with your bank's dual approval switched on rather than a paper rule nobody checks. Whoever keeps the books is not the only person who sees the bank statement, so a trustee checks the reconciliation each month. Expenses are approved by someone other than the claimant. Changes to supplier bank details are confirmed by phone on a number you already hold. Cash is counted by two people and banked promptly. Write this down in a short financial controls policy, agree it at a board meeting and review it yearly. Controls are not about distrust. They protect honest people from suspicion when something goes wrong, and fraud is easiest to miss where one person handles everything.

Assume it is not until you have checked. Impersonating a chair or supplier by email is a common fraud against charities, and the pattern is always urgency, secrecy and a request to skip your normal process. Do not reply to the email or ring any number in it. Phone the chair on the number you already have, or speak to them in person. Look closely at the sending address, as a fake often differs by one character. Your financial controls policy should state that no payment is ever made on the strength of an email alone, however senior the sender, so staff feel able to refuse. If money has gone, tell your bank at once, report it to Action Fraud, or Police Scotland if you are in Scotland, and make a serious incident report to your charity regulator.

Sometimes, within limits. Nobody may be paid simply for being a trustee without a clear power in your governing document or the regulator's authority. Expenses are different and should always be reimbursed. Paying a trustee for goods or services is allowed in England and Wales under the Charities Act 2011 if your governing document does not forbid it, the arrangement is in writing, the amount is reasonable, only a minority of trustees are paid, and the board decides it is in the charity's best interests with the conflicted trustee out of the room and the vote. Scotland has its own conditions under the Charities and Trustee Investment (Scotland) Act 2005 and Northern Ireland under the Charities Act (Northern Ireland) 2008, so check your regulator's guidance. Minute the decision, record it in the conflicts register and disclose it in your accounts.

You do not get to choose. Employment status is a matter of fact, and HMRC judges it on how the work is actually done, not on what the contract says or the worker prefers. Someone who works the hours you set, uses your equipment, cannot send a substitute and works only for you is almost certainly a worker or employee, with PAYE, National Insurance, holiday pay and pension auto-enrolment to follow. A genuinely self-employed person runs their own business, invoices you, decides how the work is done and has other clients. Run each role through HMRC's Check Employment Status for Tax tool and keep the result. Get it wrong and the charity, not the worker, is liable for the unpaid tax and National Insurance plus penalties. If the result is borderline, take advice. Payroll is usually the safer choice.

Only if your taxable turnover goes over the registration threshold, which you should check on gov.uk because it changes. Being a charity is no exemption in itself. What matters is the kind of income you have. Grants and donations with nothing given in return are outside the scope of VAT and do not count. Many charitable activities are exempt, such as welfare services, education and qualifying fundraising events, and exempt income does not count either. Trading income, such as shop sales or paid-for consultancy, and some fee-based contracts do count. Add up your taxable income over any rolling twelve months and compare it with the threshold. Many small charities never get near it. If you do, or you sell mainly to VAT registered bodies, take advice, since voluntary registration can sometimes save money.

Generally no, unless you are VAT registered, and even then only on costs that relate to your taxable activities. A charity funded by grants and donations is not making taxable supplies, so it cannot register and cannot reclaim, and VAT becomes a real cost to budget for. What you can use are the reliefs. Certain purchases are zero-rated for charities, including most advertising, some aids for disabled people and some building work for charitable use, and fuel and power for non-business use are charged at the reduced rate. You usually need to give the supplier a written declaration that you qualify, so ask before you buy rather than after. The rules are detailed and the lists change, so check HMRC's charity VAT guidance on gov.uk or ask an adviser who knows the sector.

In England and Wales every registered charity completes the Charity Commission's online annual return, with more detail asked for as income rises. Above an income threshold you also file your accounts and trustees' annual report. CIOs file accounts whatever their income, and charitable companies file with Companies House as well. The deadline runs from your financial year end and is on the Commission's site. In Scotland every charity sends OSCR an annual return with accounts and trustees' report, on a shorter deadline. In Northern Ireland the Charity Commission for Northern Ireland asks for an annual monitoring return with accounts. Late filing is shown publicly on your register entry, where funders look. Put the deadline in the board calendar and book the independent examiner before the year end, so the accounts are not waiting on them.

Not without the funder's written agreement. Restricted money was given for a purpose, and holding it for that purpose is a legal duty, not a courtesy. Spending it elsewhere, even temporarily and with every intention of putting it back, is a breach of trust that an examiner will report. The honest route is to ask. Funders are often willing to vary a grant, extend a deadline or allow a share of overheads if you explain early and in writing, and far less willing once the money has gone. Stop the problem at bid stage. Build your full costs into every application, including a fair share of rent, management and finance time, so that each project pays its way and your unrestricted income is not quietly subsidising restricted work. That is what full cost recovery means.

You can, but treat it as a point of contact with the public rather than a web page. Some of the people typing into it will be children, adults at risk or people in crisis, so your safeguarding duty applies in full. Keep it to practical questions such as opening hours, eligibility and how to reach a person, and stop it giving advice. Label it clearly as automated, make the human route obvious on every screen, and build in a response for distress that gives emergency and crisis contacts. Test it with the hardest questions you can think of before launch, and have someone read the logs every week. If it collects anything personal, your privacy notice must say so and you will probably need a data protection impact assessment first. Start small, and switch it off if it misbehaves.

Start with the people you want to help and the people already doing similar work nearby, and talk to a handful of each before you write anything. Ask what they tried, what got in the way and what a good result would look like to them. Map the steps a person would take from first hearing about you to leaving the service, and look for the points where they might drop out. Then run a small version for a few weeks and fix what breaks. AI is useful for turning your notes into a plan, drafting interview questions and summarising what you heard, as long as names and personal details stay out of it. Decide how you will know it worked before you begin, so measurement is built in rather than added later.

For a first draft, yes, and it does the plain English part well. Easy read is a specific format with short sentences, one idea per line and pictures that carry meaning, and it should be checked by people with a learning disability before you print it. Machine translation of a leaflet is usually understandable, but idiom, tone and anything safety critical such as medication, emergencies or legal rights need a fluent speaker to check. Give the tool the audience, the reading level and the format you want, paste in your own leaflet text, which holds no personal data, and ask for a version you can test with readers. Keep the original alongside it, and leave out anything that will go out of date quickly.

No. Eligibility for a check depends on the role, not on the fact of volunteering. A volunteer who regularly works unsupervised with children or adults at risk is likely to be in regulated activity and needs the enhanced check with the relevant barred list. Someone serving tea at a public coffee morning with staff present usually does not, and asking for a check you are not entitled to is itself a problem. Write down each role, the contact it involves and the check that follows from it, using the DBS eligibility guidance on gov.uk. In Scotland the equivalent is the PVG scheme run by Disclosure Scotland, and in Northern Ireland it is AccessNI. Checks are one part of safer recruitment, alongside references, an interview and an induction, and no check replaces supervision.

It is common and it is risky, so set a rule rather than leaving it to each person. The problems are practical. Client numbers end up in a personal contacts list, messages sit on a device you do not control, boundaries blur when someone messages at midnight, and when the volunteer leaves, the conversation history leaves with them. If you can, give front line volunteers a charity number through an app that keeps work messages separate and lets a coordinator see the conversations. If personal phones are the only option, agree in writing what can be sent and when, and that nothing is kept once the contact ends. Put the rule in your volunteer policy and your privacy notice, and cover it at induction rather than after a complaint.

Yes, if you tell them how. Volunteers are already using these tools at home, so saying nothing is a policy of its own. Give them the same acceptable use rules as staff, on one page they will read. The core of it is that nothing about a person you support goes into an AI tool, no names, no circumstances, no photos, and that anything the tool produces is checked by a human before it is used. Name the tools you are happy with and the sort of tasks they suit, such as drafting a rota message or tidying a newsletter paragraph. Make it easy to ask when unsure. A volunteer who is confident about the rules will tell you about a mistake, which is exactly what you need.

Write down what you were told as soon as you can, in the volunteer's words and with the time, and keep your own opinion out of it. Do not start questioning the person or investigating. Pass it to your designated safeguarding lead the same day, or to the trustee who covers safeguarding if the lead is unavailable. The lead decides whether to refer to the local authority's adult or children's social care team and whether the police are needed. If someone is in immediate danger, call 999 first and tell the lead afterwards. Thank the volunteer and tell them what happens next, because people stop reporting when they hear nothing back. Your trustees then need to decide whether this is a serious incident to report to your charity regulator.

It can give you a first draft and a structure, and that is a fair use of it. What it cannot do is know who your designated safeguarding lead is, how referrals work in your local authority area, what your services involve or what your trustees have decided. A policy that reads well but describes a charity that does not exist will fail the first time somebody needs it. So start from this site template or an AI draft, then go through it line by line with the person who would use it when something goes wrong. Check it against the Charity Commission's safeguarding guidance (OSCR and the Charity Commission for Northern Ireland publish their own), add your local referral routes and contacts, and have the board adopt it with a review date. Then train people on it.

Yes. Personal data has gone to a third party with no agreement in place, and if the note mentioned health, disability or anything else in the special categories, the risk is higher. Treat it as you would a lost file. Record what was shared, when and with which tool, and have the volunteer delete the conversation and turn off chat history if the tool allows it. Your data protection lead then assesses how likely harm is. Some breaches must be reported to the ICO within a short fixed window, so check the current deadline on the ICO's site today rather than next week, and consider whether the person affected should be told. Deal with the volunteer kindly, because the next person who slips needs to feel able to say so. Then fix whatever let it happen.

Outputs are what you did. Forty sessions, two hundred food parcels, twelve people trained. Outcomes are what changed for people because you did it. Someone is less isolated, has kept their tenancy, feels able to manage their debt. Funders ask for both, but outputs alone rarely win a second grant, because they prove activity rather than difference. Pick two or three outcomes your service can honestly claim to influence, decide how you will see them (a simple question asked at the start and again at the end is often enough) and collect them the same way every time. Do not promise outcomes that depend on things beyond your control, such as the local housing market. A funder would rather have a modest result you can evidence than a grand one you cannot.

Be honest about it and start now. Add a short set of questions for everyone who joins from this point on, and ask the same questions when they leave. For the people already with you, a looking back question works well, for example asking them to rate how things were when they first came and how they are today. Pair that with a handful of anonymised case studies and the records you do hold, such as attendance and what people came for. Tell the funder what you are putting in place and when the first results will arrive. Most funders of small charities have seen this many times and would rather back a charity that is fixing it than one that quietly made the numbers up.

Yes, and it is one of the better uses for a small team, as long as the forms are anonymised first. Remove names, then read the free text for anything that identifies a person, which in a small service can be as little as a street or a condition. Paste the comments in and ask the tool to group them into themes, count how often each appears and pull out a few representative quotes. Check the themes against the raw forms yourself, because models sometimes smooth over the awkward comment that matters most. Keep the ratings in a spreadsheet so you can see change over time. The result is half a page you can take to trustees and funders that you would not otherwise have had time to write.

Not with real details in a public tool. A case note is personal data and often special category data, and typing it into a free chatbot sends it to a company you have no agreement with. What you can safely do is use AI to build a case note template with the headings your service needs, to draft guidance for volunteers on what a good note looks like, and to tidy the wording of notes where every identifying detail has been replaced by placeholders such as [PERSON] and [AREA]. If you want AI inside your actual records, that means a tool with a contract that says your data is not used for training and tells you where it is stored, plus a data protection impact assessment before you start. Until then, the note stays in your own system.

A spreadsheet is fine while it is small, one person updates it, and it lives in a password protected account with backups rather than on somebody's laptop. It stops being fine when several people edit it, when you cannot tell who changed what, when sensitive notes sit next to contact details everyone can see, or when every funder report means a weekend of counting rows. Those are the signs to move. Many case management systems have free or discounted plans for charities, and the resource map shows where to look. Before you choose one, write down what you need to record, who needs to see which parts and which reports you must produce. Clean the spreadsheet before you import it, or you will pay for software to hold the same mess.

There is no single legal period for most charity case records, so you need a retention schedule that says what you keep, for how long and why. Some fields have expectations, for example records about children are often kept until well into adulthood, and insurers or commissioners may set their own terms, so check your contracts and the guidance for your sector. When the period ends, delete securely and record that you did. People have the right to see what you hold about them. Respond within the statutory time limit (check the current one on the ICO's site), give them a copy in plain language, and remove information about other people before you hand it over. Good notes are written knowing the person might read them one day.

Yes, provided a person who knows the charity edits every line before it goes live. Give the tool your current page, who it is for and what you want a visitor to do next, then ask for a plainer, shorter version. Use placeholders such as [CHARITY NAME] and [TOWN] rather than pasting anything about the people you support. Check every claim and every figure yourself, because the tool will happily invent a founding date or a statistic. If the result reads like every other charity website, ask for something more specific and cut the adjectives. The "A website copy refresh in an afternoon" recipe takes you through a whole site in an afternoon, and the website and search toolkit has prompts for each type of page.

Start with what visitors need, not with a rebuild. Most people arrive wanting one of four things. What you do, how to get help, how to give and how to contact you. If those pages can be found and are current, the site is doing its job. Fix the content first, then decide whether the platform needs replacing. If nobody can log in, track down who holds the domain and hosting accounts and get the details to a trustee or the manager before anything else, because losing a domain is far worse than an ugly site. Free or discounted website platforms for charities exist. The Software and Pro bono resource categories show where to look. Run the "Digital and Cyber Check" as well, because an unmaintained site is often an unpatched one.

No. A small charity with nobody to run it is better off with no account than a dead one, because a page last updated years ago tells visitors you may have closed. Ask where the people you want to reach actually spend their time. Local community groups on Facebook still work well for many place-based charities. LinkedIn suits those looking for corporate support or professional volunteers. Pick one channel, post something useful most weeks and reply to comments. That beats five channels run badly. If you do go ahead, adopt a social media policy first so staff and volunteers know who posts, who approves and what happens when something goes wrong. The "A month of social media in an hour" recipe keeps the time cost honest.

It can draft them, and that is a sensible use of it. Give the tool a month of what you want to say (an event, a thank you, a service change, a volunteer ask) and ask for a post on each in your tone, with placeholders such as [EVENT DATE] where the details go. Then a person edits, checks the facts and adds a real photo. Two cautions. Never paste in anything about an individual you support, even a first name, and never let a tool post automatically without someone reading it first. Generic AI copy is easy to spot, so cut the hashtags and the hype and keep the detail only you know. Your followers want to hear from you, not from a template.

Local journalists are short of time and want stories they can run with little work, so give them one. A clear subject line, a release of about a page, a quote from a named person, a good photo with the names of everyone in it and their permission, and a number someone will answer. Timing matters. An anniversary, a new service, a volunteer award or a local angle on a national story all give a reason to run it now. Send it to a named reporter rather than a general inbox, and follow up once. Over time they will come to you for comment. The press-release-in-30-minutes recipe gives you the structure, and AI can tidy your draft as long as every fact in it is yours.

Nothing on the spot. Take their name, outlet, deadline and the exact question, say you will come back to them, and do so before the deadline. Tell the chair straight away and agree one spokesperson. Your statement should be short and true. Say what you can confirm, what you are doing about it and that you take it seriously. Never speculate about individuals or share anything confidential about a person you support or employ. If the complaint touches safeguarding, finances or personal data, your duty to report to the charity regulator or the ICO comes first and your statement must not get ahead of that. The crisis communications toolkit covers holding statements, and asking an AI tool to read your draft back as a sceptical reporter will show you where you sound defensive.

A newsletter is the one channel you own. Nobody's algorithm decides who sees it. For most small charities a short email every month or two is about right, and the honest test is whether you have something worth saying. A story and one clear way to help is enough. Keep it to a few hundred words and send it when it is ready rather than to a rigid date. Under PECR you usually need consent to email individuals with marketing, plus a working unsubscribe link in every send and a "Privacy notice for a small charity" that says you do this. The ICO's direct marketing guidance explains the rules and the narrow exception for existing supporters. Free tiers of mainstream email tools cover most small lists. The newsletter-in-20-minutes recipe shows how AI turns your notes into a draft without touching anyone's personal data.

No. A supporter list is personal data, and pasting it into a general AI tool hands it to a third party with no agreement in place and, on some free tiers, possibly for training. Do the personalisation the other way round. Ask the tool for a template with placeholders such as [FIRST NAME], [LAST GIFT] and [PROJECT], then let your email tool or spreadsheet fill them from your own records. The same rule covers volunteers, service users and staff. If you are tempted because the list is a mess, clean it first using the "Data hygiene before AI" guide, and check what your "Privacy notice for a small charity" says you do with supporter data. This is exactly the sort of quiet habit an AI acceptable use policy should rule out before it starts.

Ask first, properly. Explain where the story will appear, for how long, who will see it and that they can withdraw at any time, then record their answer. Consent given under pressure or out of gratitude is not real consent, so give people time and a way to say no that costs them nothing. Change names and identifying details unless they want to be named, and let them read the final version. Never use a story about a child or an adult at risk without your safeguarding lead's agreement. Be careful with photos, which identify people even when the words do not. The brand and storytelling toolkit goes into consent and dignity, and the "A case study from case notes, safely" recipe shows how to draft with AI from an anonymised summary rather than the notes.

Not the notes themselves. Case notes hold names, health details, addresses and often information about other people, and none of that should leave your systems for a general AI tool. The safe route is a short anonymised summary written by a person. Remove names, places, dates, ages and anything else that would let a neighbour recognise who it is, then give the tool that summary with placeholders such as [PARTICIPANT] and ask for a draft. Check the result for details that have crept back in. Even then you still need the person's consent to tell their story at all. The "A case study from case notes, safely" recipe sets out the steps, and lesson 2.2 explains why the distinction matters in law as well as in conscience.

Usually not. Deleting a fair complaint looks like hiding, and screenshots travel. Reply once, publicly and calmly. Thank them, say you want to put it right and offer to continue by direct message or phone, then follow through. Hide or delete only what your social media policy says you will, such as abuse, discrimination, spam or anything that identifies a service user, and put that rule in a pinned post so it is visible before you need it. Do not argue and do not leave a volunteer to handle it alone. If the comment points to a real failing or a safeguarding concern, treat it as a complaint under your complaints policy and tell the chair. AI can help you draft a measured reply, but a person decides whether to send it.

You can, and for some charities it solves a real problem, because people in crisis should not have to be photographed to prove you exist. Be open about it. A caption such as 'illustration' or 'image created with AI' protects trust. Never generate a picture that resembles a real identifiable person, never present an AI image as a real beneficiary or a real event, and watch for stereotypes about the people you serve, which these tools produce by default unless you steer them. Check the tool's terms on commercial use before an image goes on a leaflet. Often the better answer is photos of your staff, your volunteers, your building and your work in progress, taken with consent, or a free stock library made for charities.

In practice, yes. The Equality Act 2010 requires anyone providing services to the public to make reasonable adjustments for disabled people, and that covers a charity's website and documents. In Northern Ireland the Disability Discrimination Act 1995 does the same job. The stricter public sector accessibility regulations apply to public bodies rather than to most charities, unless a public contract requires them. Whatever the legal line, a site that screen readers cannot use shuts out some of the very people you exist to serve. The basics are cheap. Headings in the right order, alt text on images, text that is not a picture of text, strong colour contrast, links that say where they go and forms that work from the keyboard. Free checking tools show the worst problems in minutes, and the "Accessibility and plain English" toolkit takes you through the fixes.

AI gets you to a usable first draft and no further on its own. Ask the tool to rewrite a page in short sentences, one idea each, with everyday words and a short glossary, then have someone from the audience it is for read it back to you. Easy read done properly is tested with people with learning disabilities, so where the material matters (rights, consent, safety) you still need that step. Machine translation is fine for a notice about opening hours and not fine for a safeguarding leaflet or anything a person will rely on. Have a fluent speaker check tone and sense, because a literal translation can be wrong or insulting. Never put a named person's details into the tool to be translated. The "Easy read and translation with AI" guide gives the prompts and the checks.

Plain English means a reader understands a sentence the first time, without reading it twice or looking anything up. In practice that is short sentences, everyday words, the active voice, saying who does what, and dropping the jargon your sector uses without noticing (service users, outcomes, pathways, stakeholders). AI is genuinely good at this. Paste your own text, never anything about an individual, and ask for a version a twelve-year-old would follow, then ask what it left out, because the tool sometimes drops a meaning that mattered. Read the result aloud. Where it still sounds like a report, say what you mean in the words you would use across a table and start again. Plain English is not talking down to people. It is respect for the reader's time, and it widens who can use your services.

More than the salary, and trustees should see the full figure before they vote. Add employer National Insurance, employer pension contributions under automatic enrolment, holiday and sickness cover, employers' liability insurance, payroll software or a payroll bureau, recruitment, equipment, training and the time of whoever manages the person. The total is usually well above the salary, but the exact amount depends on current rates, so look those up on gov.uk and The Pensions Regulator's site rather than relying on a figure someone remembers. Then ask the harder question. If the grant that funds the post ends, what does the charity owe the person, and which reserves cover it? The true cost prompt in the hiring kit builds the table and a one page paper for the board.

Several things, so start when you decide to recruit rather than when you make an offer. Check the person's right to work in the UK and keep the evidence. Register as an employer with HMRC and set up payroll so PAYE runs from the first payday. Arrange employers' liability insurance. Choose a workplace pension scheme, because automatic enrolment duties begin the day your first employee starts. Give a written statement of employment particulars by their first day (Acas publishes a free template) and a staff privacy notice. Check whether the role is eligible for a DBS check, or the equivalent through Disclosure Scotland or AccessNI. In Northern Ireland check the Labour Relations Agency, as rules differ in places. The hiring kit's employer set up checklist orders all of this with the official source for each item.

Sometimes, but the label does not decide it. Status depends on how the work is actually arranged. If you set the hours, direct the work day to day, supply the equipment and the person cannot send someone else in their place, they are probably a worker or an employee whatever the contract says, and you could owe PAYE, holiday pay and pension contributions later. A genuine freelancer runs their own business, works for other clients and invoices you for defined pieces of work. HMRC's Check Employment Status for Tax tool on gov.uk gives a view you can keep on file. Freelancers suit bookkeeping, design or a fixed project. A role that needs someone present every week and holding relationships is usually a job. The hiring kit's role shaper prompt tells you plainly which you are describing.

Only with authority, and only through an open process. Read your governing document first. Many forbid paying trustees or people connected to them, such as a spouse or close relative, and where yours does not permit it you need the Charity Commission's consent before the appointment. OSCR and the Charity Commission for Northern Ireland have their own rules and should be asked directly. The usual route is that the trustee stands down before applying, takes no part in designing the role, setting the pay or choosing the candidate, and the post is advertised openly and filled on merit against a person specification. Minute the conflict of interest and the decision in full, because the regulator and funders will ask. Even when it is done properly, think about how it looks to donors and to the other candidates.

You have automatic enrolment duties from the day your first employee starts, even with one member of staff. Whether that particular person must be enrolled depends on their age and earnings, and the thresholds change, so check them on The Pensions Regulator's site rather than assuming. Someone below the thresholds can still ask to join, and in some cases you must contribute if they do. You need a scheme in place before the start date. NEST was set up by government to accept any employer and is one option, and most payroll providers connect to several schemes. You must also complete a declaration of compliance with The Pensions Regulator by its deadline and re-enrol staff who opted out at the intervals it sets. Put the employer contribution into the full cost of the post before trustees approve it.

No, not without turning them into workers. You can and should repay actual out of pocket costs such as travel, lunch on a full day or materials they bought, against receipts, and your expenses policy should say how. Anything beyond that, such as a round sum each week, a set amount per shift or payment in kind, risks creating a contract. The person could then be entitled to the minimum wage, holiday pay and other employment rights, the payment may count as earnings for tax, and it can affect any benefits they receive. If you want to recognise volunteers, tell them what their work led to and offer them training. If you genuinely need someone to commit set hours in return for money, that is a job, and the hiring kit is the place to start.

Only if the role is eligible, and it is unlawful to ask for a check the role does not qualify for. Eligibility depends on what the person does, how often and with whom. Regular unsupervised work with children or with adults at risk usually qualifies for an enhanced check. Serving tea at a community lunch or running the social media account usually does not. In England and Wales checks go through the Disclosure and Barring Service, in Scotland through Disclosure Scotland's PVG scheme and in Northern Ireland through AccessNI, each with its own rules. The DBS does not charge its fee for eligible volunteers, though an umbrella body may charge for handling the application, so check the current position on gov.uk. A check is one part of safe recruitment. Interviews, references and supervision matter as much.

Yes to an agreement, no to a contract. The difference matters. A volunteer agreement sets out what the volunteer can expect from you (induction, support, expenses, insurance and a named contact) and what you hope for from them, and either side can end it at any time. Written as a contract, with obligations, set hours and anything that looks like payment in return for work, it can create employment rights. Avoid words like must and required. Say hope and expect instead. Do not hand volunteers the staff policies wholesale. Keep a volunteer policy of their own and make clear that nobody is bound to attend. NCVO publishes guidance on keeping the volunteer relationship distinct from employment. The volunteer policy template and the welcome letter template give you both documents in a form a trustee board can approve.

Yes, for some tasks and under rules you have written down. Sort volunteer tasks into plain words and admin, work about people where names must be left out, and work that should never go near an AI tool, such as case notes and safeguarding concerns. Give volunteers three rules. Nothing that could identify a person the charity supports, a donor or a colleague goes into the tool. They use the charity's approved tool and account, not a personal app. A person checks every output before it is used. Nobody is required to use AI, because volunteers are not bound the way staff are, so the paper route must still work. Run a short show and tell, not a course, and review after a month. The guide on bringing volunteers along with AI takes you through it.

Fewer than a large employer, but the few matter. Every employee's written statement must say where to find your disciplinary and grievance procedures, so those come first and should follow the Acas Code of Practice. You need a health and safety policy, and whether it must be written depends on headcount, so check HSE's site. Staff need a privacy notice telling them how you handle their data. Beyond that, sickness absence, annual leave, flexible working and whistleblowing procedures save awkwardness later, and funders often ask to see equality and safeguarding policies. Acas offers free templates. Keep each under two pages, have someone who knows employment law check it, record when trustees adopted it and keep volunteers in a separate volunteer policy. Northern Ireland has its own code through the Labour Relations Agency.

A job description, yes. Give the tool the role summary, hours, pay and reporting line, ask for duties and a person specification, then read it for anything that quietly excludes people, such as a degree the work does not need. Compare it with Acas and Equality and Human Rights Commission guidance. A disciplinary or outcome letter carries legal weight and needs more care. Use AI for the shape only. Describe the role and the facts, never the person's name, health information or home circumstances, and write [CHECK CURRENT GUIDANCE] wherever a timescale or a right applies. Have someone who knows employment law read it, and speak to Acas first if a protected characteristic could be involved. Staff have data protection rights too, so treat their details like those of the people you support.

Treat it as the board's problem, because it is. Trustees are the employer and owe a duty of care, and HSE treats work related stress as a health and safety matter. Start with the chair holding a supportive one to one about workload and support, not diagnosis. Then audit the workload, listing everything the role carries and the hours, and decide as a board what stops, what moves to a trustee or volunteer and what gets paid for. Write a cover plan so the person can take leave with the phone off. Ask whether the charity can fund supervision, or whether your insurance includes an employee assistance scheme. Agree the changes in writing and review them after a month. The wellbeing and burnout kit has the audit, the one to one and the cover plan.

Informally first, in facts, and early. Write down what you can evidence, such as missed deadlines, rather than your view of the person, then hold a private conversation that states them, asks what is going on, agrees what good looks like and offers support. Confirm the agreement in a short note within a day or two. Most problems end there. If not, the Acas Code of Practice sets out what a fair formal process requires, and you must follow your own procedure. Before paying for advice, call the free Acas helpline (the Labour Relations Agency in Northern Ireland) and check whether your charity's insurance includes an employment law helpline. If a protected characteristic such as disability or pregnancy might be involved, get advice before the conversation, not after. The HR conversations kit has the plan and the letters.

No single law lists it, but several duties add up to a minimum. Health and safety law requires the information and training people need to work safely, which means an induction covering the building, equipment, fire and first aid, and anything specific to the work such as food hygiene or lone working. If you work with children or adults at risk, the regulator and funders expect safeguarding training for everyone in contact with them, refreshed regularly. The ICO expects anyone who handles personal data to know the basics of data protection. Add your AI acceptable use rules to the same induction, so what not to type into a tool is learned on day one. Record who was trained and when. Local safeguarding partnerships, volunteer centres, the ICO and the National Cyber Security Centre offer much of it free.

Keep it short and local. Most of what people need to know fits in an hour and needs no trainer. Decide your rules first, using the acceptable use policy template and the first AI policy guide. Then run a 45 minute show and tell at a meeting people already attend. Spend ten minutes on why and the rules, twenty on two real tasks done live, including one vague prompt so everyone watches the tool make something up, ten on trying a prompt in pairs and five on what happens next. Follow up with the course lesson on training staff and a review a month later. Pair a confident user with a wary one rather than making the keen volunteer the lead. The course is free to members and can be worked through in team meetings.

Yes, and plenty of small charities do, but treat it as a drafting assistant rather than the author. It is good at turning your rough notes into a clear first draft, tightening a word count, and spotting where you have not answered the question the funder asked. It is poor at knowing your charity. Everything that makes a bid win, the need, the evidence, the budget and the voice, has to come from you. Never paste in names or details of the people you support. Describe them in general terms instead. Check every figure and every claim before you submit, because the tool will happily invent a statistic. Many funders accept AI help with drafting and some ask you to declare it, so read each funder's guidance notes.

For writing, summarising and tidying up, the four are closer in quality than their marketing suggests, so the choice turns on three practical things. First, where your charity already lives. Copilot sits inside Microsoft 365 and Gemini inside Google Workspace, and a tool inside accounts you already pay for is simpler to manage. Second, what the provider does with your data, which you can only learn from the settings and the business terms, not the home page. Third, whether you can switch off training on your conversations. Pick one tool for one named job, trial it for a month with no personal data, and write down what you found. Avoid letting five people each use a different free app on their own phones. That is how data goes missing.

Often yes, but only when it is the version that comes with your organisation's Microsoft 365 account and people sign in with a work login. That version runs under your organisation's business terms, which normally say that your prompts are not used to train the public model. Read them rather than assuming. The free Copilot a volunteer opens in a browser at home is a consumer product with consumer terms. The same split applies to Gemini with Google Workspace and to ChatGPT, where the team and enterprise plans carry different terms from the free app. So the safer question is which account, rather than which brand. Check the admin settings, confirm what is switched on, and remember that having the tool inside Microsoft does not make case notes safe to paste.

Safe means two things, nothing that identifies a living person and nothing you would mind a stranger reading. So the text of a funder's guidance, your own draft newsletter, a published annual report, a policy from another charity, totals from your monitoring spreadsheet and your rough notes for a trustee paper are all fine. Not fine are names, addresses, phone numbers, dates of birth, case notes, health or disability details, safeguarding concerns, anything about a child, staff HR matters, donor records, bank details and passwords. The grey area is a story about a real person with the name changed. Changing the name is not anonymising. If someone who knew them could still work out who it is, keep it out. When in doubt, describe the situation in general terms and let the tool draft from that.

Not in a general chat tool, and not by pasting the notes in. Case notes usually contain special category data, and putting them into a consumer AI product means handing them to a company that is not your processor and may store them overseas. That is likely a personal data breach, possibly a reportable one, and the people you support never agreed to it. Two routes work. You can type a summary with no identifying detail, let the tool tidy the English, then add the names back inside your own system. Or you can buy a case management product with AI built in, where the supplier is your processor under a written contract and you have done a data protection impact assessment first. For anything touching safeguarding, read the briefing before you start.

Yes, and it is the cheapest protection you will write. The point is not paperwork for a regulator. It is that without one, each person decides for themselves what to paste into which tool, and the first you hear of a problem is when a funder, a parent or the ICO raises it. A policy for a small charity fits on one or two pages. It names the tools you allow, says what may and may not go into them, tells people to check everything before it goes out, and names who to ask. You can draft it from the template in an afternoon, take it to the next board meeting, and review it once a year. Volunteers need to see it as much as staff do.

It is common enough to have a name, shadow AI, and it is a problem only if you leave it unmanaged. People reach for these tools because they are overstretched and the tool helps, so the first conversation is a question, not a telling off. Ask what they use it for and what they have put into it. If it is drafting emails from their own notes, you have found a useful pilot. If it is pasting in beneficiary details, you have a possible data breach to assess, and you need to know which account, whether the history can be deleted, and whether training was switched on. Then bring the practice into the open. Agree the tools, set up an organisation account whose settings you control, and write it into the acceptable use policy.

For trying things out, the free versions are fine, provided nothing personal goes in. The paid plans buy you three things that matter to a charity. Better settings, usually including the ability to turn off training on your conversations and to keep chat history under an organisation login rather than a personal one. Higher limits, so the tool does not stop working halfway through a long document. And, on the business tiers, terms written for organisations, with a contract you can point to. Prices change often, so check the providers' own pages rather than a figure someone remembers. Before you pay, look for charity pricing, because several providers offer discounts to registered charities through their own schemes or through sector software programmes. One paid seat for the person who uses it most is usually the sensible first step.

Measure it, because the feeling of speed is unreliable. Before you start, pick one task and time how long it takes now, three or four instances, written down. Then run the same task with the tool for a month and time it again, including the checking, because a draft that takes ten minutes and an hour to correct has saved nothing. Count the cost of the subscription and any time spent learning. What you will usually find is that writing-heavy admin saves real hours, anything needing judgement saves less, and the saving only turns into money if those hours go somewhere useful. Report the result to trustees in plain terms, hours saved a month against pounds spent, and what the hours were used for. If it did not save time, stop paying. That is also a result.

Assume it is not until you have checked. These tools produce text that sounds right, but they will invent a statistic, a quotation, a funder's deadline or a section of law with complete confidence. The error rate falls when you give the tool the source material yourself and ask it to work only from that, rather than asking it what it knows. So paste in the funder's guidance and ask for a summary, instead of asking what the funder wants. For anything you will publish or submit, check every number against its original source, confirm every named organisation exists and does what the draft says, and read any legal point against gov.uk, the Charity Commission or the ICO. Treat a confident answer with no source as a lead to follow, not a fact.

Use it to understand, never to decide. An AI tool is good at explaining what a trustee's duties are in plain words, or what a term in your governing document means. It is unreliable on anything specific. It may describe the law for England and Wales when you are in Scotland under OSCR or in Northern Ireland, quote a threshold that changed, or merge two different rules into one. Thresholds for audit and independent examination move, so always take the current figure from the regulator's own site. For any decision with legal or financial weight, read the regulator's guidance yourself, and where money or risk is significant, take proper advice. A useful habit is to ask the tool for the questions you should put to an adviser rather than the answers.

Less than they fear, and more than nothing. Trustees do not need to understand how the technology works. They need to be satisfied that the charity's use of it is lawful, proportionate and under control, which is the same duty they carry for the bank account. That comes down to four decisions. Whether the charity may use AI tools, and for what. Which tools, under which accounts. What must never go into them. And who reports back, how often, and what happens when something goes wrong. One short briefing and one meeting is usually enough to settle those, and the acceptable use policy records the answers. The trustees who get into trouble are the ones who never asked, then discovered staff had been using it for months with no policy to point to.

There is no general legal duty to declare that a document was drafted with AI help, in the same way nobody declares a spellchecker. But three cases are different. Some funders ask directly in their guidance or application form, and if they ask, answer honestly, because being found out later is far worse than a declaration. If AI makes decisions about people with no person reviewing them, such as sorting hardship applications, data protection law gives those people extra rights and your privacy notice must say so. And if an image, a case study or a quotation is generated rather than real, say so, because supporters assume charity stories are true. For your own drafting, a line in your AI policy saying how you use it, published on your website, answers the question before anyone asks.

Say the true thing, which is that a charity with a handful of paid staff is not going to automate anyone away, because the work that matters is relationships and judgement, and no tool does those. What AI changes is the hours spent on the writing and admin around that work. Then prove it by how you introduce it. Let staff choose the first task, not management. Give them time to learn in working hours. Never time how fast someone works with the tool and use it against them. And make a clear statement, in writing, about what the saved time is for, which should be the parts of the job they went into the sector to do. If the worry persists, listen, because it may be telling you something about workload rather than about AI.

Treat it as a possible personal data breach and deal with it the same day. Find out what went in, from which account, and whether that account lets the provider train on conversations. Delete the conversation and, where the tool allows it, the stored history. Write down what happened, when, who was affected and what the data could reveal about them. First names and email addresses for a newsletter is low risk. Names tied to health conditions, addresses or safeguarding concerns is not. Where there is a likely risk to people's rights, you must report to the ICO within its deadline, which is short, so use the ICO's self-assessment tool at once and tell the people affected if the risk is high. Log it even if you do not report, fix the cause, and update your policy and training.