An AI policy template for nonprofits and NGOs in Ireland, the UK and the EU

If people in your organisation use AI for their work, an AI policy tells them which tools they may use, what must never go into them, who checks what AI produces, and when to tell others that AI was involved. For a nonprofit or NGO it can fit on one page. This guide sets out what the policy should cover, gives you a template to copy, and explains the rules behind it: the EU AI Act and the GDPR in Ireland and the rest of the EU, and data protection law and the charity regulators in the UK. It is practical guidance, not legal advice.

Why an AI policy, and why now

AI tools are easy to start using. Without a policy, each person decides alone which account to use, what to paste in, and whether to tell a supporter that a letter was drafted with AI. A policy makes those decisions once, for everyone, and gives you something to train people on and to show when asked.

Neither the EU AI Act nor the GDPR requires a document called an “AI policy”, but several rules are easier to meet with one:

• AI literacy. Article 4 of the EU AI Act, which has applied since 2 February 2025, requires organisations that use AI systems to take measures to support the AI literacy of their staff and of others who use AI on their behalf. Clear rules are the obvious thing to train on. Our guide to AI literacy training under Article 4 covers the training and a record to keep.
• Data protection. The GDPR expects “appropriate data protection policies” where proportionate (Article 24), and what staff paste into an AI tool can include personal data.
• Transparency. Since 2 August 2026, the AI Act’s transparency rules (Article 50) have applied, including to organisations that use AI to create some kinds of content they publish.
• Governance. In England and Wales, the Charity Commission has encouraged trustees to consider whether “having an internal AI policy would be beneficial”, and the voluntary Charity Governance Code (2025 edition), which draws on the Commission’s guidance, lists “a policy for the use of technology and AI tools” among its suggested evidence of good governance.
• Fundraising. In England, Wales and Northern Ireland, the Fundraising Regulator’s guidance says to “develop and agree an AI policy before using any AI tools to support your fundraising”, and recommends publishing it.

What the policy should cover

A useful AI policy answers eight questions. The template below puts them into words.

1. Who does it cover? Everyone who uses AI tools for you, volunteers and trustees included. Article 4 of the AI Act reaches “other persons dealing with the operation and use of AI systems on their behalf”, not only staff.
2. Which tools are approved, and for what? Prefer work accounts, where you can control the settings and agree the contract terms. Before approving a tool, Ireland’s Data Protection Commission advises that you “understand what personal data it uses, how it uses it, where the personal data goes”, and whether it is “retained by the provider of the AI product or re-used in any way”. A provider that processes personal data on your behalf needs a contract with you (GDPR Article 28).
3. What never goes in? The details of the people you support, special category data such as health information (GDPR Article 9), donor and staff records, passwords and anything confidential, except in tools approved for that purpose, after a data protection impact assessment where one is required (Article 35).
4. Who checks what AI produces? The person who uses it, every time. For fundraising, the Fundraising Regulator asks for “a process for a person to check the accuracy, fairness and legality of any content generated by AI before using it”.
5. When do we tell people that AI was involved? At least whenever the law requires it (see the EU section below), and whenever a funder’s rules require it.
6. What needs approval first, and what is off-limits? Anything that informs decisions about people. Under the EU GDPR, people have the right not to be subject to a decision “based solely on automated processing” that has legal or similarly significant effects on them, with limited exceptions (Article 22); the UK has a parallel rule, rewritten by the Data (Use and Access) Act 2025 from 5 February 2026. Off-limits is anything the AI Act prohibits, such as emotion recognition at work (banned since 2 February 2025), except where the system is intended for medical or safety reasons under Article 5(1)(f).
7. How do people learn the rules? An introduction for each role, a refresher when the tools or the policy change, and a record of who was trained.
8. What if something goes wrong, and who owns the policy? Treat personal data put into an unapproved tool as a possible data breach. Under the GDPR and the UK GDPR, a breach must be reported to the regulator without undue delay and, where feasible, not later than 72 hours after you become aware of it, unless it is unlikely to result in a risk to people’s rights and freedoms (Article 33), and the people affected must be told if the risk to them is high (Article 34). Name an owner for the policy, have your board approve it, and set a review date.

An AI policy template to copy

Copy this into a document, replace the words in square brackets and delete what doesn’t apply. Keep the policy to a page, and put examples from your own work in a separate staff guide.

[Organisation] AI policy. Approved by [the board] on [date]. Owner: [name or role]. Next review: [month and year].

1. Purpose. We use AI tools to save time on [drafting, summarising, translating and admin], so that more of our time goes to [our mission]. We use them safely, lawfully and in line with our values.
2. Who it covers. Everyone who uses AI tools for [Organisation]: staff, volunteers, trustees, interns and contractors, on our devices or their own.
3. Approved tools. We use only the tools on our approved list, through [Organisation] accounts: [tool, account, approved tasks]. [Owner] checks each tool’s terms, data settings and contract before adding it. Ask [owner] before using any other AI tool for work.
4. What never goes into AI tools. Names, contact details or case details of the people we support; health information and other special category data; donor, supporter, staff and volunteer records; passwords and bank details; anything confidential from partners or funders. The only exceptions are tools approved for that purpose, after a data protection impact assessment where one is required.
5. A person checks the output. AI can be wrong, biased or out of date, however confident it sounds. Whoever uses it checks facts, figures, names, quotes and tone before anything is sent, published or acted on, and is responsible for the result.
6. People decide about people. AI never makes a decision about a person on its own, such as who gets a service, a job, a grant or a volunteering role.
7. Being open about AI. We tell people when they are dealing with an AI system rather than a person, and we label realistic AI-generated or altered images, audio and video. AI-assisted text that we publish to inform the public is reviewed in substance and fact-checked by [role] after any AI changes, under [Organisation]’s editorial responsibility, or we label it as AI-generated. We publish a summary of this policy on our website, and we follow our funders’ rules on AI.
8. Approval first. Screening job or volunteer applications; monitoring staff or volunteers; assessing people’s needs or eligibility; working with case notes; putting a chatbot or AI agent in front of the public; connecting an AI tool to our systems or data. [Owner] approves these in writing, with a data protection impact assessment where one is required.
9. Not allowed. Using AI to infer the emotions of staff or volunteers from their faces, voices or other biometric data, except where the system is intended for medical or safety reasons; creating realistic images, audio or video of real people without their consent; any use that breaks the law or this policy.
10. Training. Everyone completes the introduction for their role before using AI tools for us, and a refresher when we add a tool or change this policy. [Owner] keeps the training record.
11. If something goes wrong. Tell [owner] straight away if personal or confidential information went into a tool not approved for it, if AI output led to a complaint or harm, or if you are unsure. We handle possible data breaches under our data protection procedure.
12. Review. [Owner] reviews this policy at least once a year, and whenever we add a tool or the rules change.

Writing it with your staff, not for them

Write the policy with the people it covers:

• Start with what people already do. Ask, without blame, which AI tools people use for work and for what. The answers show which tools to check first.
• Draft with a small group: someone from your services, someone from fundraising or communications, someone who looks after staff or volunteers, and whoever handles data protection.
• Use your own examples. A one-page staff guide with “fine”, “ask first” and “never” examples from your own work gives people something concrete to apply.
• Take it to the board. In England and Wales, the Charity Commission says trustees “remain responsible for ensuring that appropriate safeguards, oversight and risk management are in place”.
• Train on it. Run a short session for each role, and tell people when the approved list changes.

A hypothetical example: caseworkers at a youth charity want to use an AI tool to tidy up their case notes. Under the template, that needs approval first. The notes may include health information about young people, so the data protection lead checks whether a data protection impact assessment is required and, if it is, completes it first. The tool then runs under a work account with a processor contract, and the caseworkers are trained before they start.

For how the policy fits into wider AI governance, see why civil society needs its own AI safety playbook.

Ireland and the rest of the EU: the AI Act and the GDPR

The AI Act applies in stages, and the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, moved some of the dates. These are the ones that matter for a nonprofit using everyday AI tools:

• 2 February 2025: AI literacy (Article 4) and the first prohibitions (Article 5), including emotion recognition at work except for medical or safety reasons (Article 5(1)(f)).
• 2 August 2026: the transparency rules (Article 50), and supervision and enforcement by national authorities.
• 2 December 2026: new prohibitions on AI that generates realistic intimate images of identifiable people without their explicit consent, or child sexual abuse material. For organisations that use AI, the ban covers using a system for that purpose.
• 2 December 2027: the rules for the high-risk uses listed in Annex III, which include recruitment and managing staff, admission to and assessment in education and vocational training, and some decisions on access to essential services and benefits. Organisations that use such systems must, among other things, assign human oversight to people with “the necessary competence, training and authority”, and inform workers’ representatives and affected workers before using one at work (Article 26). Public bodies and private organisations that provide public services must, in most cases, also assess the impact on fundamental rights first (Article 27).

The transparency rules shape the “being open” part of the template. If you use AI to create deep fakes, you must disclose them: AI-generated or manipulated images, audio or video that resemble real people, places or events and would falsely appear authentic. The Commission’s guidelines on Article 50 say this can include a realistic image of a person who could plausibly exist, even an invented one. AI-generated or manipulated text that you publish to inform the public on matters of public interest, such as public health, environmental protection or fundamental rights, must be disclosed too, unless it has had human review or editorial control and a person or organisation holds editorial responsibility for it. The guidelines make fact-checking a minimum part of that review, say the mere existence of an editorial policy is not enough, and treat text that AI changes after sign-off as AI-generated again. A chatbot must let people know they are dealing with AI, unless that is obvious; that is its provider’s duty (Article 50(1)), and if you had one built and run it under your own name, the provider may be you.

The AI Act does not affect the GDPR (Article 2(7)), which keeps applying to personal data that goes into AI tools or comes out of them. Ireland’s Data Protection Commission, in its guidance on AI, large language models and data protection, says an organisation using an AI product that relies on personal data “could be a data controller and if so a formal risk assessment should be considered”, and warns against relying on AI outputs “without critical human analysis or intervention”. In Ireland, existing regulators supervise the AI Act, coordinated by the AI Office of Ireland: among them, the Data Protection Commission for certain prohibited practices and high-risk uses, and the Workplace Relations Commission for AI in the labour market. At the time of writing, we found no guidance on AI as such from Ireland’s Charities Regulator, so start from its Charities Governance Code and its guidance for trustees. Elsewhere in the EU, check which authorities your government has designated.

One change is still only a proposal. The Commission’s separate Digital Omnibus proposal (COM(2025) 837), published on 19 November 2025, would amend the GDPR, but on 8 November 2026 the European Parliament’s Legislative Observatory listed it as “Awaiting committee decision”. Write your policy to the GDPR as it stands.

The UK: data protection law and the charity regulators

The EU AI Act can reach UK organisations when the output of an AI system they provide or use is used in the EU (Article 2(1)), for example AI-generated content they publish for audiences in the EU, which can matter for NGOs that work on EU projects. Within the UK, start with data protection law and what the charity regulators expect.

• Automated decisions. From 5 February 2026, the Data (Use and Access) Act 2025 replaced the UK GDPR’s article on automated decision-making. A significant decision about a person, taken with no meaningful human involvement, needs safeguards: information about it, a chance to make representations, human intervention and a way to contest it. Such decisions based on special category data are allowed only in narrow cases.
• The ICO, the UK’s data protection regulator, publishes guidance on AI and data protection, which it says is under review because of the 2025 Act. Under the same Act, the Information Commission replaced the Information Commissioner on 30 September 2026.
• The Charity Commission for England and Wales said in April 2024 that it did not expect to write specific guidance on AI, and that decision-making should not be “delegated to AI or based on AI generated content alone”. Its Charity Sector Risk Assessment 2026 points to the same blog post.
• The Fundraising Regulator, which covers England, Wales and Northern Ireland, asks charities to agree an AI policy before using AI tools for fundraising, and recommends publishing it. It says trustees are “ultimately accountable” for their charity’s AI use for fundraising, and that “the greater the risk of misleading donors, the more transparent you should be”.

In Scotland and Northern Ireland, check what your own charity regulator has published.

Where to start

1. Ask your team which AI tools they use for work, and for what.
2. Copy the template and fill in the brackets with a small group.
3. Check each tool before it goes on the approved list.
4. Take the policy to your board, then share it with a one-page staff guide.
5. Train each role on it, and keep a record.
6. Put the review date in the diary.

If you’d like help, our Your Own AI Starter includes an AI use policy written with your team, with a one-page staff guide, and our four-week pilot for Irish nonprofits, EU-project partners and funders, and Community Magazine users starts with an audit and an AI policy. Our AI consulting covers AI policy and governance too, and you can see all our services. None of these is legal advice: we write a practical policy and flag legal questions for your adviser or data protection officer. Or book an intro call: a 30-minute, no-obligation conversation with us about where your team’s time goes and whether we can help.

Frequently asked questions