← All lessons / Responsible AI / Lesson 08 of 12
Interactive lesson
AI in your organisation: safe, legal and genuinely useful.
Most AI risk in a charity or research team isn't in the technology. It's in everyday choices: what gets pasted in, who checks the output, and who decides. Learn to spot the risky cases and write a policy your team will actually follow.
- About 15 minutes
- Beginner friendly
- No account required
- Not legal advice
- Identify data risks and who could be affected by an AI use.
- Draft a practical policy with approved uses and named responsibilities.
Three questions before any AI use
A volunteer pastes case notes into a free chatbot. A manager forwards an AI summary without checking the figures. A panel lets a scoring tool reject applicants. None of these needed advanced technology to go wrong. Each one fails one of three simple questions.
What goes in?
Is there personal or sensitive data? Is this tool approved to receive it?
Who is affected?
Could the output change something for a real person: their support, funding or reputation?
Who is accountable?
Which person checks the output and owns the decision?
Interactive
Traffic-light the request
Six real-world requests from a fictional charity. For each one, decide: go ahead, go ahead with safeguards, or stop and check first. Then compare your answer with ours.
Interactive
Build your AI policy
A short policy people read beats a long one nobody opens. Fill this in and a one-page draft builds as you go. It stays in your browser; nothing is sent.
Your draft policy
A starting point for discussion with your trustees, not a legal document.
Key ideas to take away
- Most AI risk is in everyday use. What gets pasted in, and whether anyone checks what comes out, matter more than which model you choose.
- Check the tool before the task. Where is the data stored, how long is it kept, and is it used to train the provider's models? Free consumer tools and business accounts often answer these differently.
- People decide about people. UK law adds safeguards when a significant decision about someone is made without meaningful human involvement, and is stricter still with health data. Use AI to help reviewers, not replace them.
- Assess high-risk uses first. A data protection impact assessment (DPIA) checks how using personal data could harm people or affect their rights, and how to reduce those risks. It is required before processing likely to create high risks. Health data, vulnerable people and new automated processing are reasons to assess that risk carefully.
- Write it down and keep it short. A one-page policy, an approved-tools list and a named person to ask prevent most problems.
Check your understanding
4 quick questions. Try as often as you like. Your progress stays on this device; answers clear when you reload.
Want to go deeper?Law, governance and supplier checks. Optional.
Data protection principles, applied to AI
| Principle | What it means for AI |
|---|---|
| Lawfulness and transparency | Have a lawful basis, and tell people in your privacy notice that AI is used and how. |
| Purpose limitation | Data collected to deliver a service can't simply be reused to train or test a model. |
| Data minimisation | Send the tool the least data that does the job. Remove names and identifiers where you can. |
| Accuracy | AI output about a person is still personal data. Wrong summaries must be corrected. |
| Security | Use accounts with proper access controls; know who at the provider can see your data. |
Questions to ask an AI supplier
- Is our data used to train or improve your models? Can we switch that off?
- Where is it stored and processed, and for how long?
- Will you sign a data processing agreement?
- Can we delete our data, and export it if we leave?
Automated decisions
Since the Data (Use and Access) Act 2025, UK law sets out safeguards for significant decisions made solely by automated means: telling the person, letting them make representations, offering human intervention and letting them contest the decision. Using special category data, such as health information, in these decisions is restricted further.
If you work with EU partners
The EU AI Act sorts AI systems by risk. Most charity uses, such as drafting or summarising, are low risk, but chatbots must make clear people are talking to AI, and uses such as deciding access to essential services or jobs face strict rules. Timelines have been changing, so check the current position if your work reaches EU users.
Continue exploring
Official guidance worth bookmarking. These are independent of Code With Impact.
- Guidance
Guidance on AI and data protection (opens in a new tab)
Information Commissioner's Office
The UK regulator's guidance on applying data protection law to AI.
- Guidance
Data protection impact assessments (opens in a new tab)
Information Commissioner's Office
When you need a DPIA, what goes in it, and a template to start from.
- Article
Charities and artificial intelligence (opens in a new tab)
Charity Commission
What trustees should consider, including an internal AI policy and keeping decisions with people.
Sources for this lesson
The scenarios, policy builder and examples are original Code With Impact material; the charity is fictional. This lesson summarises the law in plain English and is not legal advice.
- Information Commissioner's Office, Guidance on AI and data protection.
- Charity Commission, “Charities and artificial intelligence” (April 2024).
- Data (Use and Access) Act 2025, section 80, on automated decision-making.