Consultation: The Charity Digital Code of Practice: Large Charities

Click here for the small charity Code

We are inviting charity leaders to suggest changes to the latest iteration of the Charity Digital Code of Practice (Code), purposely created for large charities. 

The Code for large charities is presented here in full, but you can use the contents below to navigate to your areas of expertise or interest. Please click the Give Feedback buttons to provide suggestions.

Background to the Code of Practice

We define digital as the application of the culture, processes, business models, and technologies of the internet-era. Since the first iteration of the Charity Digital Code of Practice (Code), digital has continued to change how we live and work. More than 5.5 billion people worldwide use the internet, with 5.2 billion using social media. Digital skills help charities to increase their reach, impact, efficiency, and sustainability. Digital has become essential for charities to remain relevant and fulfill their purpose.

Artificial intelligence (AI), in particular, is changing the societies in which charities operate and dictating how organisations communicate, fundraise, and provide services. As a subset of digital, AI refers to systems that mimic human thought to solve complex tasks. Generative AI has become exceptionally popular in recent years, but other forms of AI, such as machine learning, extractive AI, and automation, also provide significant benefits to charities. Indeed, AI has already revolutionised the very nature of work, providing huge opportunities across the economy. By 2030, according to PwC, AI could add up to $16 trillion (£12.6 trillion) to the global economy through productivity enhancement, stimulated demand, and small-scale automation. Charities, like every sector, need to tap into that potential.

The Code aims to help charities of all sizes, budgets, or causes progress with digital by offering a consistent framework to shape and develop digital ways of working. It is not a regulatory requirement, so it focuses on principles and best practice advice. Given the rapid pace of change in emerging tech, particularly AI, the Code must be aspirational. Emerging tech offers charities of all sizes the opportunity to innovate to drive social change. These technologies, if adopted without the right checks and balances, may increase inequality and create new social harms. Charities have an important role to play by modelling how to adopt digital responsibly, ethically, and inclusively. This will help charities use tech to tackle bigger social challenges and play a more influential role in fighting for social justice.

We hope that charities will use the Code as a practical tool to identify what they are doing well in digital, identifying any gaps they need to address. Digital is rapidly evolving. Organisations who deploy digital successfully will constantly test, learn from, and improve strategies, tactics, and the technologies they use. It is envisaged that organisations will review their progress against the Code at consistent intervals, ensuring it is part of their continuous improvement. The Code is ambitious and offers a positive challenge to charities, but it also provides best practice you can adopt with limited resources.

Thank you to the Co-op Foundation and Lloyds Banking Group for funding the initial development of the Code. Thank you to all the organisations on the steering group and the charities, individuals, and bodies working in the sector who have advised us. We are especially grateful to The Clothworkers’ Company, The WCIT Charity, and Resource for London who have funded the 2025 update of the Code.

Give feedback

Evolution of the Code

The Code was the first of its kind in the UK. It initially aimed to address the digital skills gap that existed in many charities, which prevented them from fully benefitting from digital. The Code proved particularly useful soon after, with the arrival of the pandemic. The Code helped charity leaders to navigate social distancing restrictions, the growth in remote working, the emergence of digital service delivery, and a general period of digital acceleration. It proved instrumental during the sector’s shift to digital and continued to serve charities in the following years.

But digital, as mentioned above, moves rapidly. Since the first iteration, we’ve witnessed a shift towards remote work, cloud computing, and digital payment processing. We’ve watched the rise of blockchain, cryptocurrencies, and decentralised finance. NFTs have been and gone. Legacy social media platforms have become more hostile, more controversial, and tackling misinformation has taken on new importance. We’ve seen a focus on cybersecurity alongside a boom in privacy regulations. We’ve welcomed an emphasis on green tech, accessibility, and digital inclusion. And, most unexpectedly, after decades as a niche technology, AI arrived in force and provided charities with huge opportunities.

To be effective, the Code must evolve as digital evolves. The changes to the second iteration ensure the Code is fit-for-purpose. We’ve defined the different forms of AI and introduced AI across all principles to help charities mitigate risks and seize opportunities. The introduction of a new principle, Data, serves to highlight how charities can adopt a data-driven approach and protect the data of beneficiaries and stakeholders. We’ve introduced advice on procurement and boosted parts on cyber security. We’ve improved the glossary, extended advice on accessibility and inclusion, and so much more.

We hope the second iteration of the Code prepares charities for digital in 2025 and beyond.

Scope of the Code

The Code is intended as an overview of the key areas that charities need to be aware of in digital. It therefore focuses on the how and why, not the more granular what, when, and where. In the resources section, however, we have put together plenty of content to help charities.

Who is the Code for?

The Code is for charities registered in the United Kingdom. Other organisations, such as small community groups that may not be registered charities, could find it useful. The Code’s principles and best practice guidance have been designed to apply to charities of all sizes. We have developed a version for small charities, which we define as being those with an annual income of £1 million or under, and one for larger charities (those who generate over £1 million of income a year).

Give feedback

How to use the Code

The Code should be used as part of how charities benchmark their progress in digital and to inform key decisions in this area. As such, we recommend that organisations use it regularly. Some charities may wish to make digital a standing item at board and leadership meetings, whether separately or part of other points on the agenda, and if appropriate for their size of organisation.

The Code is separated into key principles, each broken down by an explanation of why it matters, what success looks like, and the best practice that is needed to achieve it.

In the Code, we have used ‘must’ and ‘should’ to indicate what we see as the minimum standard of good practice and ‘could’ to indicate enhanced best practice.

While we consider AI to be a subset of digital, the rapid advancements and new challenges associated with AI often justify special mention in the Code. This does not imply that the principles outlined are exclusive to AI or that when AI is not explicitly mentioned the principles outlined do not apply to it. 

We’ve assumed that charities will comply with any legal obligations related to their use of digital, such as data protection legislation and the UK General Data Protection Regulation (GDPR). And, if working with third parties, we’ve assumed compliance with the legal obligations of their jurisdiction.

The Code should be read in conjunction with other codes and best practice guides, including the following:

• The Charity Governance Code.
• The section on digital media in the Fundraising Code of Practice.
• Cyber Essentials.
• The Charity Commission’s digital guidelines for trustees.
• CAST’s digital service design standards.
• Voluntary Sector Digital Maturity Matrix.
• Principles for Digital Development (for NGOs)

We have also assumed familiarity with the charity’s strategy, vision, and mission.

If any commercial organisations are looking to develop a product to support the Code, you will need to contact the steering group.

Give feedback

Steering group

The Code 2025 update has been developed by a steering group of organisations across the sector, comprising:

• Association of Chief Executives of Voluntary Organisations (ACEVO)
• CAST (The Centre for Acceleration of Social Technology)
• The Charity Commission
• Charity Finance Group (CFG)
• Charity Digital
• Microsoft
• WCVA (Wales Council for Voluntary Action)
• The group’s role is to develop, promote, review, maintain, and champion the Code.

Zoe Amar serves as the Code’s independent chair.

Give feedback

Principles of the Code

Digital is a broad area, so we have identified eight principles to shape areas of focus for the Code. These show how digital touches much of what charities do and how it will need to be considered accordingly.

1 . Leadership

Charity leaders must drive digital as a way of helping their charities remain relevant and sustainable. Digital has grown and become embedded in the sector to the point that it needs to be seen as a key element of strategy and governance. Leaders and trustees should take responsibility for defining how digital will help them achieve their charity’s purpose. They should identify how digital and particularly AI could change the society in which their charity operates and how their charity should adapt to meet the evolving needs of beneficiaries and other stakeholders.

2. User led

Charities should make the needs and behaviours of beneficiaries and other stakeholders the starting point for everything they do digitally, ensuring charitable objectives align with needs. This includes taking an equitable approach to respond to the digital needs of those from marginalised communities.

3. Culture

Charities’ values, behaviours, and ways of working should create the right environment for digital success.

4. Strategy

Charities’ strategies should be ambitious about how they can use digital to achieve their vision and mission while being pragmatic about what should be prioritised depending on their resources.

5. Data

All charities should understand the potential of data. They should use data to maximise the value of digital while simultaneously protecting the information of their stakeholders, employees, volunteers, and beneficiaries. Data should be treated as a strategic asset.

6. Skills

Charities should aim for digital and AI skills to be represented at all levels of the organisation. Digital success depends on the confidence, motivation, and attitude of the people who run, work, and volunteer for charities. Soft skills, such as questioning, persuading, and influencing, are equally important to technical skills.

7. Risk and ethics

Charities need to determine and manage any risks involved in digital and AI. Charities will need to consider how some digital issues, including responsible AI adoption, fit with organisational values and ethics. These are broad areas that may include anything from the use of data in partnerships to understanding how adopting AI will impact marginalised communities to deciding which social platforms to prioritise.

8. Adaptability

Charities will need to adapt to survive and thrive as digital and AI create significant changes to society.

Leadership

Principle

Charity leaders must drive digital as a way of helping their charities remain relevant and sustainable. Digital has grown and become embedded in our everyday lives and the charity sector to the point that it needs to be seen as a key element of strategy and governance. Leaders and trustees should take responsibility for defining how digital will help them achieve their charity’s purpose. They should identify how digital and particularly AI could change the society in which their charity operates and how their charity should adapt to meet the evolving needs of beneficiaries and other stakeholders.

Why this matters

Digital and AI should be part of every charity leader’s skillset to help their organisation achieve its vision and increase its impact. Emerging technologies such as AI are developing rapidly, and charity leaders must take an ambitious, forward-thinking approach to how they might adopt them appropriately.

What success looks like

Charity leaders and trustees are able to identify specific ambitions and a clear vision for how digital and AI can help their organisations achieve their charitable purpose and goals, thereby increasing impact. They are also able to execute these plans with confidence.

Best practice for large charities

Governance

• Charity leadership teams and boards take responsibility for owning and driving the vision and strategy for digital and AI adoption and growth, rather than delegating it entirely to other staff (e.g. digital teams), suppliers, or volunteers. This will require the leadership team and boards to further develop their digital and AI skills.
• CEOs and trustees must play a critical role in initiating and spearheading these changes and challenging their charities to be more ambitious about how they use digital and AI responsibly to increase its impact. 
• CEOs need to practice awareness around the international integration of technology and data flows across their charities, and the supranational and international regulations currently governing the application of tech, such as the EU Artificial Intelligence Act and the EU Cyber Security Act.
• Digital and AI issues need to be considered regularly at board and leadership team meetings. Executive teams and trustees must be confident that they have the requisite skills to make informed, data-driven decisions about how digital can help achieve their charity’s objectives.
• Trustees should support and enable senior staff to feel confident in taking a more innovative approach to digital, such as experimenting with emerging tech and piloting ideas for new products and services, including partnering with other organisations in and outside the charity sector.
• Trustees are ultimately responsible for ensuring that the relevant strategies, policies (e.g. social media, AI, and IT policies), and procedures for digital are in place, and that everyone is clear on the authority they must act.
• Boards should review how digital and AI can help make the functions, administration, and key principles of governance more effective (e.g. using digital channels to make decisions, provided it doesn’t remove the need for trustees to consider them properly).
• Digital and AI skills should be represented on all charity boards, with the aim of every trustee, whether new or already in post, developing a working knowledge of how digital and AI can increase their charity’s impact.
• Leaders need to understand what level of investment in digital is required to achieve their charity’s objectives, what this will deliver, and how to evaluate it, ensuring it represents value for money. They should consider what is appropriate to invest in products and services as well as improving capacity (e.g. digital skills training) and infrastructure (e.g. good systems that improve productivity and efficiency).
• Leaders need to make a positive, evidence-based business case for digital investment, showing how charities will specifically benefit and how they will overcome any potential roadblocks and opposition.
• Leaders should define long-term user needs in procurement to ensure tech is scalable and flexible, capable of meeting future demands and not simply the needs of the moment.
• Leaders should ensure that procured tech effectively integrates with their wider tech eco-system, accounting for integration within the procurement process.
• Leaders can create procurement roadmaps to outline the steps, timelines, and resources necessary to ensure the process proves efficient. Roadmaps are particularly useful in terms of tech integration. Leaders should seek roadmaps from vendors and consider their capacity to influence such roadmaps.
• The impact of new and emerging technologies on users, and how this could change their behaviour in the mid-term, should also be considered, particularly around the implementation of AI. Leaders should consider responsible application, and institute policies that encourage experimentation and safeguard against potential risk.
• Trustees and leaders need to be able to evaluate how charities can adopt AI responsibly to ensure it remains consistent with their ethics and values, does not perpetuate inequalities, and consideration is given to the impact on the environment. These factors must also be considered when partnering with organisations to develop products, services, and other initiatives. If appropriate, trustees and leaders should consider developing decision-making criteria or a framework to evaluate these decisions.
• Leaders should identify a level of risk the charity is willing to take in the pursuit of its objectives. The implementation of digital demands a certain degree of risk and charity leaders should ensure associated risks align with a charity’s overall risk appetite.
• As charities further adopt digital and AI, trustees and leadership teams should take ownership of increasing cyber security risks and put in place proportionate measures to protect their funds, data, supporters, and reputation.
• Digital experts on staff teams at large charities could consider offering their skills to be trustees of other charities, capacity permitting.

Leading by example

• Leaders and boards do not need to be digital experts, but all should commit to leading by example, growing their own skills, championing digital, understanding trends and best practice, understanding digital opportunities and risks for their charities, and how their organisation benchmarks against others. They should motivate colleagues to do the same. Large charities with a devolved structure should ensure leaders at regional or local level have the confidence, skills, and mindset to lead digital change.

Skills

• Where leaders have identified digital skills gaps, they should attempt to close them through training, recruiting staff or volunteers, or other means of support (e.g. non-executive roles on digital steering groups or advisory boards). This could include periodically reviewing job descriptions so that digital and AI are appropriately reflected as part of the roles and responsibilities.
• Leaders should consider how to ensure their boards and charities can attract and retain people with good levels of digital skills. This may involve thinking creatively about the recruitment process or offering short-term, high impact opportunities to staff or volunteers.
• Charity leaders should ensure appropriate upskilling in emerging tech. AI will have an impact on the future of many charities, providing opportunities for streamlining processes, improving service delivery, creating new income streams, and so on. Charities should focus on generative AI skills in the short-term, with employees aiming to understand how generative AI models work, the personalisation of outputs, basics of prompt engineering, optimisation through feedback, and so on. Upskilling should include elements of safeguarding, ensuring that charities reap the rewards of emerging tech while mitigating core risks.
• While generative AI can offer many benefits to charities, leaders should explore the potential other forms of AI offer. Extractive AI and predictive AI can both help improve the way you use data for decision-making, for example, and automation with AI can free up time by automating the tedious and repetitive tasks. Charities should look at their current tools, many of which depend on AI, and experiment to see how they can make improvements. 
• Leaders should consider the broad spectrum of AI and find the best ways to apply forms of AI to particular use cases. Free tools are available to use for each form of AI. Experiment with your various use cases and focus on the application of AI for specific tasks.
• Leaders and boards need to invest in developing the right mindset, such as being open to new ideas (e.g. learning from peers and regularly reviewing best digital practice from comparable organisations in other sectors) and adapting to new ways of working and communicating digital offers (e.g. reviewing how ways of working can bring in established digital approaches, such as working in multidisciplinary teams, delivering iteratively, incorporating AI tools, and embedding collaborative and asynchronous ways of working through platforms such as Teams, Slack, and social media platforms). 

User led

Principle

Charities should make the needs and behaviours of beneficiaries and other stakeholders the starting point for everything they do digitally, ensuring charitable objectives align with needs. This includes taking an equitable approach to responding to the digital needs of those from marginalised communities.

Why this matters

Building the charity’s strategy, services, and functions around how beneficiaries, supporters, donors, and other stakeholders use digital will make them more likely to engage, positioning the organisation as relevant and increasing impact.

What success looks like

Stakeholders’ needs, including those of beneficiaries from marginalised communities, will be factored into all digital activities from the outset, from user research to product development, with key assumptions tested against data. Learnings will then be factored into continuously improving digital services and other work and used to inform wider questions about the charity’s strategic direction. The digital needs of marginalised groups will be a key element of user research, product development, and supplier procurement. 

Best practice for large charities

Understanding audiences

• Insights and data about what the charity’s beneficiaries, supporters, and other stakeholders, want and need should inform all planning for digital activities. Donors and potential donors should also be included.
• Where capacity and resources permit, charities could observe users’ behaviour in the context they are trying to help them, encouraging them to share insights and asking how they would like services delivered.
• Charities should aim to map the user journeys of typical beneficiaries, supporters, and other stakeholders and use the insights gained to inform their planning, service delivery, and product development. The digital needs of staff (including accessibility) should also be considered when planning internally focused digital activities, e.g. a new intranet.
• Digital tools and the accompanying behaviours are evolving rapidly. Learning how each charity’s audience is using digital tools needs to be part of the organisation’s continuous learning and planning.
• Charities must assess user needs when procuring tech. They should establish clear specifications and conduct effective vendor research, ensuring the offering of the vendor aligns with needs. Charities should take account of the total cost of ownership (TCO), including cost of maintenance, training, upgrades, and hidden costs. 

Digital inclusion

• Charities should aim to follow the basic principles of digital inclusion, i.e. based on an understanding of the digital skills of beneficiaries, supporters, and other stakeholders, their ability to access the internet, and any specific assistive technology needed. Beneficiaries and donors who are not online should be offered alternatives where appropriate.
• Charities may wish to lobby for improvements to digital platforms, such as increasing accessibility for their beneficiaries, or on ethical issues, where relevant and appropriate.

Accessibility

• The needs of users who are digitally excluded must be considered including those individuals in vulnerable circumstances. Every effort should be made to ensure that digital services meet accessibility requirements and that the World Wide Web Consortium guidance is taken into account. Offline channels should be offered where appropriate.
• Charity leaders must ensure, when commissioning digital services, that accessibility is a contractual requirement. Contracts should specify compliance with the Web Content Accessibility Guidelines (WCAG) to hold suppliers accountable for delivering accessible solutions.
• Charity leaders must recognise that accessibility benefits everyone. Organisations must embed accessibility into planning, design, development, and content creation processes. Retrofitting accessibility is costly and less effective, whereas considering accessibility from the start leads to better, more inclusive outcomes.
• Charities should schedule regular accessibility audits to ensure compliance and improvement.  Engaging third-party experts for audits and external reviews ensures an objective assessment and helps maintain high standards.
• Charity leaders should recognise accessibility as an ongoing commitment. Accessibility is not a one-time project but a continuous process of improvement. Training teams, engaging with disabled people for feedback, and keeping up with evolving best practices are crucial to maintaining inclusive services.

 Development and iteration

• Charities should respond to users’ changing needs, behaviours, and expectations by factoring data and other insights into improving their activities. This will entail making modifications (which may be small and simple) to products, services, strategy, key messages, fundraising, and other areas of work, creating a cycle of testing, learning, and improving.

Culture

Principle

Charities’ values, behaviours, and ways of working should create the right environment for digital success.

Why this matters

The right culture will develop the confidence and motivation of staff and volunteers in digital and AI. It will shape their behaviour by fostering innovation, increasing collaboration, creating momentum, breaking down siloes, empowering people, including those from marginalised communities, to share new ideas, using data to improve decision-making, and increasing transparency.

What success looks like

The people who volunteer or work for charities will be in a better position to collaborate, innovate, and learn additional skills, developing the right mindset for change and innovation, and contributing to how the organisation can achieve its goals through digital and AI. They will focus outwards as much as inwards, horizon scanning, connecting with peers at other organisations, reviewing trends, and understanding how beneficiaries and supporters (including those from marginalised communities) use digital and AI, and how this might change these groups’ expectations of how they interact with charities.

Best practice for large charities

Motivation

• Leaders will need to identify and create the motivation for change and innovation. This must include creating a vision for how digital could help their charity, communicating how they use digital tools to achieve its goals and improve its sustainability, and celebrating and recognising success.
• Staff and volunteers should encourage each other to understand how beneficiaries, supporters, and other stakeholders use digital and how this is changing their behaviour.
• Leaders will need to develop the right mindset for digital and AI among staff and volunteers, such as being open to trying new ideas and encouraging peer learning and collaboration.
• Charity leaders should champion ‘cyber awareness’, ensuring that all staff are aware of the risks of cyber attacks. Incorporating cyber awareness in your charity is the most important step in the prevention of cyber attacks. It affords your staff the necessary knowledge to mitigate many of the risks.

Behaviour change

• Leaders of charities who frequently use digital will need to map and identify the current hallmarks of their culture, understanding the extent of change required to respond to further digital and AI disruption and the actions that would increase this.
• Staff and volunteers should be encouraged to be open about any skills gaps the organisation has in digital and be empowered and supported to progress their personal development.
• Leaders should encourage a culture of safe experimentation and iterative learning based on testing rapid prototypes with users. This includes developing products, services, and the use of emerging tech such as AI. That might mean creating an AI policy that encourages use while outlining core risks and their appropriate management, such as the dissemination of information, introduction of bias, and privacy violations. And creating space for staff and volunteers to share learnings about skills and use cases.
• Charities may also wish to consider how their ways of working and organisational structures can support digital. This might include creating a more flattened structure, where appropriate; developing cross-team working and matrix management; and looking at how to partner collaboratively with suppliers and other partner organisations to increase their capacity.

Ownership

• While strategic initiatives and products should have specific owners within each charity, digital needs to be involved in everyone’s role, from trustees to volunteers. How this is achieved will depend on each charity’s aims and individual roles and responsibilities.

Test, learn, and improve

• Charities need to be open to challenging their established ways of working. They should test assumptions about how beneficiaries, supporters, and other stakeholders use digital, learning from data and improving what they offer as a result.
• To do this successfully, charity staff and volunteers should be encouraged to be curious, share, and try out new ideas and to fail effectively, doing things differently as a result of learning from what works and what doesn’t.
• Risks involved in innovation should be managed – for example, by piloting new products or services with small groups before rolling them out more widely. This is key to digital and responsible AI adoption.

Collaboration

• Charity staff and volunteers should take advantage of the opportunities digital offers to collaborate, using online tools or different ways of working, such as an agile approach, and look to normalise cross-functional working using agile principles.
• Charities could work with organisations both in and outside the sector on mutually beneficial digital initiatives, e.g. a charity working on a pro-bono partnership with a tech company to develop a digital product that could help their beneficiaries. When selecting partners charities should consider how the partner’s culture aligns with theirs.
• Where appropriate and compliant, charities could consider sharing digital assets – such as knowledge, data, code, application programming interfaces (APIs) – with other charities or stakeholders who share the same goals and values. They should encourage the reuse of these assets and insights where applicable (e.g. by asking other charities who have more experience with digital and AI to share what they’ve learned).

Strategy

Principle

Charities’ strategies should be ambitious about how they can use digital to achieve their vision and mission whilst being pragmatic about what should be prioritised depending on their resources.

Why this matters

Charities need a clear vision, purpose, and well-defined approach for how they use digital and AI, all of which will create the motivation for change. By understanding users’ digital needs and how to meet them in a way that is aligned with the charity’s goals, they will be able to improve their organisation’s relevance and sustainability in a rapidly changing world.

What success looks like

Charities will be clear about their strategic direction in digital and AI, enabling them to invest time and other resources more effectively. They will be confident about the role digital and AI play in their value proposition and how this is differentiated from other organisations in the same field, putting the charity in a stronger position for the future.

Best practice for large charities

Organisational strategy

• Charities’ strategies should include the use digital, data, and AI to achieve their charitable purposes, aims, and objectives. Ideally, this will be part of the overall organisational strategy but may be a standalone digital strategy until the leadership team have developed their digital experience and skills. In either case, digital and AI should be embedded in the charity’s goals and ways of working, not an add-on, and should include plans to scale its use further.
• The strategy should have a clear owner who is a leader within the charity and who should have the mandate for change. Roles and responsibilities for delivering the strategy should be identified (ideally at a senior level) and the appropriate accountabilities created.
• Charities should use digital tools that support their vision and mission and increase impact, understanding where digital approaches are and are not the best way to achieve these aims.
• Data on how beneficiaries, supporters, and other stakeholders use digital should be factored into the creation of the strategy and assumptions should be tested where required. Horizon scanning and scenario planning should be used to map how emerging technologies, including generative AI, could change the environment that charities operate in.
• If the charity is large enough to have strategies and plans for different functions (e.g. a fundraising strategy), digital and AI approaches should be included in these.
• To increase the chances of success, the plans to deliver the strategy should be practical, iterative, adaptable, manageable, and carefully monitored. The strategy should reference how the charity plans to use emerging tech, ensuring that employees feel empowered to learn, use, and experiment with new technologies.
• The appropriate level of resources will need to be allocated to the plan and the budget monitored. Leaders will also need to ensure time and money are set aside for digital innovation, matching resources with overall strategic ambitions.

Impact

• Charities should consider ways in which digital and AI could potentially increase their impact, such as reaching and supporting more beneficiaries by using digital channels, new generative AI platforms, and new tools and approaches, where relevant. This should be measured by identifying clear measures of success and using the correct tools for evaluation.

Approach

• Charities should be ambitious and challenge themselves about what they wish to achieve with digital and AI, while being aware of what they can undertake based on capabilities and resources. Partnerships should be considered to increase innovation, impact and build capacity and capabilities.
• Charity leaders should identify and agree on how best to deal with barriers to achieving the strategy. These will be different for every organisation and could range from risk management to how legacy technology systems may be impeding progress.

Give feedback

Data

Principle

All charities should understand the potential of data. They should use data to maximise the value of digital whilst simultaneously protecting the information of their stakeholders, employees, volunteers, and beneficiaries. Data should be treated as a strategic asset.

Why this matters

Data helps charities to connect with supporters, maximise fundraising, improve service delivery, develop a long-term digital strategy, analyse risk, and streamline processes. But data poses risks, especially around privacy and ethics, so charities need to ensure they collect, process, and store data appropriately.

What success looks like

Charities will collect data fairly, transparently, and with the full consent of users. All decision-making will be data-driven and evidence-based. Data flow will be documented, consistent, and automated to the greatest extent possible. They will store data, ensuring constant compliance with all data privacy regulations. They will apply effective data analytics to boost campaigns, improve service delivery, and make data-driven decisions. They will use and combine data to solve their most important problems.

Best practice for large charities

Data collection

• Charities must comply with the latest regulations around the collection and storage of data, particularly with UK GDPR. Leaders should apply “legitimate interest” when appropriate and always ensure all data collection is fair and transparent.
• Charities should apply the Information Commissioner’s Office (ICO) three-part test for legitimate data collection. Assess the purpose of the data you’re collecting, whether the collection of data is necessary, and whether the data stands at odds with the individual’s interests.
• Charities should confirm consent practices and ensure they’re meeting the standards of UK GDPR. Consent requests should be separate from general terms and conditions, and charities should always use clear and straightforward language.
• Charities should always articulate and sustain the value of ‘opting-in’ for supporters to further their communications. ‘Opt-in’ options should be uniform across products and platforms to avoid confusion for the users, always providing an opt-out option that is easy to identify.
• Charities should give supporters as much flexibility as possible to manage their own permissions.

Data privacy and security

• Charities should only retain necessary information and regularly review and remove any data that no longer serves a specific purpose.
• Put in place robust security measures where possible, including encryption for data, limiting access to sensitive data, proper authentication mechanisms, and regular security audits.
• Leaders should create and distribute a clear data privacy policy that outlines how charities collect, store, process, and protect data. Regular data audits can also help to create robust data security practices and monitor any potential vulnerabilities or breaches.
• Charities and charity employees should practice caution when inputting data into generative AI models. Sensitive data should only be entered if the model does not use that data in an insecure manner (i.e. using it to inform future outputs that become generally or publicly available), violating privacy and undermining user trust.
• Train staff on data management. This ensures that everyone understands the importance of data security and proper handling procedures.
• Charities should regularly review the data held, clean up any outdated or unnecessary data, and ensure that data is backed up to prevent loss. Charities should keep an up-to-date map of their data stack to clarify where all data is held.
• The completion of Data Impact Assessments should be a matter of course across the charity.
• Where possible use a centralised database or databases such as customer relationship management (CRMs), volunteer management, and human resource management platforms to store and manage data. This helps in maintaining data integrity, security, and accessibility.

Data analytics

• Charities will likely hold existing data, such as donor, supporter, and attendee data. Leaders should work to understand where that data is held, how to access that data, and how to generate actionable information from that data.
• Leaders can review data, draw conclusions, and make data-driven conclusions. For example, leaders should encourage others to use data to pick the best platforms to invest in digital advertisement by exploring available data on demographics, target audiences, platform usages, potential conversion rates, and so much more. Data analytics therefore can ensure a greater return on investment (ROI) for digital advertisement. Charity leaders should always monitor ROI against their digital strategy.
• Leaders should encourage the use of predictive analytics to better identify trends, target potential donors, reach new audiences, and streamline future processes. Predictive data analytics provides a glimpse into the future, allowing larger charities to identify long-term opportunities and mitigate upcoming risks.
• Generative AI tools can be used to perform analytical tasks, but there are clear associated risks that charities need to understand, mitigate, and manage. Risks include, but are not limited to:
  • Data privacy and security (see above).
  • Bias and unfairness (see principle 7: Risk and ethics).
  • Transparency and explainability: AI models can produce “black box” outputs that make it hard to understand how conclusions were drawn. This can undermine trust and confidence.  
  • Dependence on AI: Over-reliance on AI tools can lead to misinformation, errors, and missed opportunities for critical and creative thinking. Maintaining human oversight remains vital.

Give feedback

Skills

Principle

Charities should aim for digital and AI skills to be represented at all levels of the organisation. Digital success depends on the confidence, motivation, and attitude of the people who run, work, and volunteer for charities. Technical and soft skills, such as questioning, persuading, and influencing, are equally important.

Why this matters

Everyone who works for a charity, from trustees to volunteers, staff, and partner organisations, all play a fundamental role in helping charities to harness the power of digital.

What success looks like

Leaders will understand the digital and AI skills of their teams. Gaps will be identified and a plan to close and continuously update them should be in place, helping the charity achieve its objectives and attracting, developing, and retaining people with good levels of digital skills.

Best practice for large charities

Skills audit

• Where they have the capacity to do so, charities should measure and map the digital and AI skills they have among their staff, volunteers, and trustees, identifying any gaps and what knowledge, experience, and resources are required to close them. Ideally, this could include both qualitative and quantitative data, such as interviews and gathering statistics (e.g. staff confidence with channels) through a survey. It may also include real-time data analysis where appropriate.
• The audit should include technical skills (for example, an understanding of generative AI platforms, digital fundraising, computing principles, and analytics) as well as soft skills that assist digital progress, such as collaborative working, innovation, persuading and influencing, coaching and mentoring, and should be applied to all levels of the organisation.
• Leaders should ensure employees have basic digital skills or support them to gain basic digital skills. Plenty of resources, often free, can help that skill acquisition.
• Charity leaders should champion ‘cyber awareness’, ensuring all staff are aware of the risks of cyber attacks. Incorporating cyber awareness in your charity is crucial for prevention, equipping your staff with the necessary knowledge to mitigate many of the risks. 

Recruitment

• Charities may need to think creatively about how they attract staff or volunteers with digital and AI skills (e.g. by developing partnerships with organisations who can source digital volunteers, technology companies, or universities).

Skills development

• Staff, volunteers, and trustees should aim to grow their digital and AI skills to help them make better decisions and exercise better oversight. Skills development should be part of leaders’ continuous learning, regularly evaluating progress and broadening their knowledge. This learning could be undertaken in several formal and informal ways, including face-to-face training, mentoring, online courses, advice from colleagues, and learning by doing, such as trying new digital tools.
• Charities should consider how digital skills development can contribute to the confidence, motivation, and satisfaction of staff, volunteers, and trustees, investing in mindset as well as skillset.
• Digital and AI skills should be developed in line with organisational strategy, such as improving impact, understanding beneficiaries’ needs and staff motivation, and increasing productivity and efficiency as well as agility.
• Where staff, trustees, and volunteers have high levels of digital skills, they should be challenged further, e.g. by involving them in developing innovative digital projects.
• Charities should remind employees that digital skills development is ongoing and evolving, emphasising the need to improve their skills as specific tech is changed and updated.
• Leaders should give employees the opportunity to develop skills in emerging tech, such as AI, which typically evolves at a faster pace during early iterations.
• Where specialist digital staff or trustees are recruited, charity leaders should be clear on the purpose of the appointment and how this can be supported by the rest of the organisation.

Skills sharing

• Staff, trustees, and volunteers with strong digital skills should share learnings and insights with colleagues and other charities.
• Charities should also consider opportunities to maximise digital skills sharing within organisations (e.g. through reverse mentoring or informal coaching).
• Charities could also consider creative approaches to sharing skills. For example, where they have identified a need for specialist digital skills, they could ask a tech company or a commercial business for volunteers or other forms of pro-bono advice.

Give feedback

Risk and ethics

Principle

Charities need to determine and manage any risks involved in digital and AI. Charities will need to consider how some digital issues, including responsible AI adoption, fit with organisational values and ethics. These are broad areas that may include anything from the use of data in partnerships to understanding how adopting AI will impact marginalised communities to deciding which social platforms to prioritise.

Why this matters

Charities need to assess any risks involved in their use of digital and AI and manage them. Ultimately, this will help them maintain public trust and confidence and handle any reputational issues, as well as safeguard the needs of their beneficiaries and their data. Digital technology is evolving rapidly and any organisations who use online tools will need to assess whether they are aligned with their charity’s principles and values.

What success looks like

Charities will be confident and experienced in identifying risks and mitigating them. Both established and emerging digital technologies offer opportunities to charities to improve sustainability, impact, and income. Charity leaders should manage this by ensuring that they have sufficient skills and knowledge to make informed decisions about ethical issues.

Best practice for large and small charities

Managing risk in digital

• Charity leaders and trustees should have the necessary skills and oversight of their charity’s digital activities to determine risk (e.g. when managing data or using social media to manage reputation). This should be aligned with the charity’s risk management policy and process. Any risks should be identified and assessed accordingly.
• When procuring, appropriate due diligence must be taken on suppliers, and legal and commercial advice sought on the terms and conditions of contracts. Any ongoing costs related to the agreement should be understood and evaluated.
• Charity leaders and trustees should periodically review their existing systems and processes, understanding what is in place, how they work together, whether they are obtaining value for money, and anticipating and evaluating any risks, such as the ability to keep services secure, up to date, and working as intended.
• When introducing any new digital technology new operational risks should be considered such as system failures or inaccuracies. Monitoring should be in place to mitigate these risks and plans put in place to ensure continuity in the event of any failures. Charities may require support from someone with good technical skills to help them evaluate risk. This could be a member of staff, a trustee, or a volunteer. Where risk is potentially significant, all possible actions to manage it should be evaluated and a plan put in place to deal with different scenarios.
• Charities should safeguard against risks associated with specific areas of digital. For example, people working in social media might be trained in the prevention of misinformation, privacy and security risks, how to handle personal attacks, and so on. Leaders could establish formal social media polities to address the specific risks.
• Risks should be reviewed, monitored and assessed periodically. Where relevant, they should be recorded on the risk register. Charities should also monitor risk around third parties, particularly regarding the use of AI, and ensure they practice ethical use of emerging tech.
• Charities should read this principle alongside the Charity Commission guidance on charities and risk management.

Cyber security

• Charities should have a board level awareness of the risks posed to their organisation from cyber attacks and a framework for how to act in the event of a cyber incident. The following steps, taken from Cyber Security: Small Charity Guide, will help any charity protect themselves from the most common cyber attacks:
  • Ensure you take regular backups of your important data.
  • Ensure you keep your devices, antivirus and software, including apps, up to date.
  • Ensure any smartphones and tablets are kept up to date and can be remotely wiped.
  • Avoid connecting to unknown Wi-Fi hotspots while away from home or the office.
  • Ensure all devices are password protected and staff know how to set secure passwords.
  • Help staff avoid phishing, ensuring they know how to report something that looks wrong.

Diversity

• Equality, diversity, and inclusion (EDI) enhances innovation, improves creativity, and offers unique perspectives to charities. Leaders should enact effective EDI policies and ensure they remain compliant with all relevant legislation, particularly the Equality Act 2010.
• Charity leaders should emphasise the importance of diversity when conducting user research, developing products, building digital teams, and procuring tech.
• We support the guidance on diversity set out in the Charity Governance Code. Charities should ensure that a diversity of backgrounds, life experiences, career paths and diversity of thinking are represented on their digital teams, digital platforms, and in user research.

Transparency

• Charities should publish how they use data on their websites, annual reports and other channels.
• Charities should be transparent about their use of AI, whether it be in the sourcing of digital assets produced by generative AI or decisions that are made with the assistance of AI.
• Charities should use digital channels to share their impact and to demonstrate their openness and accountability.
• Emerging technologies
• Charity leaders and staff should understand and plan for how new technologies could change how they work, from crowdfunding to automation, ensuring that they remain relevant to their audience.
• Charities should monitor ethical issues revealed by technological developments to assess whether these fit with their organisational values and what the implications of unintended consequences might be. They will need to understand the implications for their users and the charity’s work and any actions they may need to take as a result. The core risks that charities face include the following:
  • Data breaches on platforms.
  • Bias and misinformation in AI models.
  • Lack of ethical design in emerging tech.
  • Environmental impact of using large language models.
  • Potential breaches of copyright in generative AI.
  • Displacement or changes to human roles.
  • Legal and reputational risks

• Charity leaders should practice ethical and responsible adoption of emerging tech, particularly AI. That means ensuring values translate into the tools you use, conducting risk assessments, writing policies to bolster effective governance, ensuring accountability remains constantly in place, and regularly testing to monitor ongoing risk and make incremental changes as necessary.

Adaptability

Principle

Charities will need to adapt to survive and thrive as digital changes how everyone lives and works.

Why this matters

Organisations who do not consider how they adapt to the digital age will lose relevance and engagement. Users, stakeholders, and donors are increasingly online and expect the same from charities. Technological change is often quick and adapting to that change allows charities to spot opportunities and react to risk quickly.

What success looks like

Charities and their leaders take an agile approach, regularly reviewing the key trends in digital (and the accompanying opportunities and risks) and their data and insights about their audience so that they can continually fine tune and develop their digital activities. They can include insights in wider organisational strategy and planning where necessary.

Best practice for large charities

Improving current practices

• Charities should aim to make their platforms, systems and services accessible to users from as wide a range of devices and locations as is appropriate.
• Charities’ systems should work with each other internally and with external systems.
• Data should be captured through all interactions where appropriate, creating a single customer view that improves services along with stakeholders’ experiences.
• Digital teams should work in close partnership with those responsible for IT infrastructure. We see IT infrastructure as an enabler of digital.

Looking to the future

• Charities should review at consistent intervals how their use of digital benchmarks against relevant organisations working in a similar field, learning from the findings.
• Charities could aim to solve problems they identify by developing new ideas, products and services and testing them, using free and existing digital platforms if resources are limited.
• Charities should develop a “fail fast, fail forward” mentality where they pilot new ideas and learn from failure as well as success. Digital creates opportunities for innovating and testing relatively cheaply.
• Insights from users and wider digital trends should be applied to the charity’s work, creating a process of continuous improvement.
• Charities should consider the implications of emerging technology, such as virtual and augmented reality and the evolving digital payments landscape, for their business models.