The Fundraising Regulator’s AI Guidance: What Charities Need to Know

AI is now the topic we most often get questions on from charities, and rarely as an ambition. More often it is a worry: staff are already using it, trustees are not sure they should be, and nobody is certain where the line is. The Fundraising Regulator’s guidance on using AI in fundraising, last updated in December 2025, is a good place to start. It is short, sensible, and once you look past the fundraising framing, largely a data protection document. Here are the highlights.

Before you start

You are accountable for what the AI produces

Whatever an AI tool generates, you remain responsible for it, including anything produced by third-party fundraisers on your behalf. The guidance flags the two familiar failure modes, hallucinations and bias, and expects you to have checked the output before it goes anywhere near a donor. It also expects a risk assessment, proportionate to what you plan to do, before you use the tool at all. For anything involving personal data, that assessment and a DPIA are close cousins, and often the same exercise.

Trustees, not just the fundraising team

Decisions about whether and how to use AI should go to the board, with ongoing oversight after that. The guidance warns against AI understanding sitting with one or two trustees. If your board has one person who gets it and six who nod, that is the problem being described.

Getting ready

Write a policy and publish it

Agree an AI policy before any tool is used, and publish it on your website so donors can see when you will and will not use AI. The regulator singles out three situations where this matters most: AI-generated images, sound or video that could be mistaken for real; tools that use personal data; and chatbots. That trio maps closely onto the transparency obligations the EU AI Act imposed in August, which we covered in our AI round-up.

Know where your data goes

Know how the tool will use, store and share what you put into it, and how it interacts with your other systems. Your privacy notice should explain how AI is used to process personal data. The regulator points charities to the ICO’s AI guidance for the detail. That is the right signpost: this is a UK GDPR question wearing a fundraising hat.

In use

A human checks it first

Have a process for a person to check the accuracy, fairness and legality of AI-generated content before it is used. Where there is no human in the loop, such as a chatbot, monitor and audit it instead. Keep records of the checks, because if a complaint arrives those records are how you justify what you did.

Keep non-public information out of public tools

Do not feed information that is not already public into publicly available AI, as training material or as a prompt. For a charity that means donor records, case studies, beneficiary details and anything from the CRM. It is the same warning the Solicitors Regulation Authority gave law firms in August, for the same reason: once it is in a public tool, you have disclosed it.

Where the UK GDPR comes in

Three points in the guidance are data protection obligations in their own right. If AI takes significant decisions about individual donors without meaningful human involvement, Articles 22A to 22D of the UK GDPR, which replaced the old Article 22 in February, require four safeguards: telling the person, letting them make representations, offering human intervention, and letting them contest the outcome. Where special category data feeds the decision, the old near-prohibition still applies. That is the legal reason behind the regulator’s insistence on human oversight. If the tool touches personal data, a DPIA is likely to be required, since the ICO lists innovative technology as a trigger. And charities routinely hold special category data about beneficiaries, which needs an Article 9 condition before it goes near any system, AI or otherwise. The Fundraising Regulator tells you what good practice looks like. The UK GDPR tells you what is required.

How Griffin House Consultancy Can Help

Many of the organisations we work with are charities and not-for-profits, and AI is now the question we are asked about most. We help find out what tools are actually in use, write AI and data protection policies that trustees can sign off and staff can follow, run DPIAs, and train teams on where the line sits. Our earlier piece on the privacy risks of AI is a useful companion to this one. Get in touch with us at Griffin House Consultancy, or call us on 01673 885533.

Author: Mike Martin LLM

Mike is an information rights law specialist and one of the founding Directors of the Griffin House Consultancy, a leading specialist data protection and information governance consultancy firm that supports hundreds of clients annually with their training, consulting and auditing requirements.