Consultation: The Charity Digital Code of Practice: Small Charities

Click here for the large charity Code

We are inviting charity leaders to suggest changes to the latest iteration of the Charity Digital Code of Practice (Code), purposely created for large charities. 

The Code for large charities is presented here in full, but you can use the contents below to navigate to your areas of expertise or interest. Please click the Give Feedback buttons to provide suggestions.

Give feedback

Background to the Code of Practice

We define digital as the application of the culture, processes, business models, and technologies of the internet-era. Since the first iteration of the Charity Digital Code of Practice (Code), digital has continued to change how we live and work. More than 5.5 billion people worldwide use the internet, with 5.2 billion using social media. Digital skills help charities to increase their reach, impact, efficiency, and sustainability. Digital has become essential for charities to remain relevant and fulfill their purpose.

Artificial intelligence (AI), in particular, is changing the societies in which charities operate and dictating how organisations communicate, fundraise, and provide services. As a subset of digital, AI refers to systems that mimic human thought to solve complex tasks. Generative AI has become exceptionally popular in recent years, but other forms of AI, such as machine learning, extractive AI, and automation, also provide significant benefits to charities. Indeed, AI has already revolutionised the very nature of work, providing huge opportunities across the economy. By 2030, according to PwC, AI could add up to $16 trillion (£12.6 trillion) to the global economy through productivity enhancement, stimulated demand, and small-scale automation. Charities, like every sector, need to tap into that potential.

The Code aims to help charities of all sizes, budgets, or causes progress with digital by offering a consistent framework to shape and develop digital ways of working. It is not a regulatory requirement, so it focuses on principles and best practice advice. Given the rapid pace of change in emerging tech, particularly AI, the Code must be aspirational. Emerging tech offers charities of all sizes the opportunity to innovate to drive social change. These technologies, if adopted without the right checks and balances, may increase inequality and create new social harms. Charities have an important role to play by modelling how to adopt digital responsibly, ethically, and inclusively. This will help charities use tech to tackle bigger social challenges and play a more influential role in fighting for social justice.

We hope that charities will use the Code as a practical tool to identify what they are doing well in digital, identifying any gaps they need to address. Digital is rapidly evolving. Organisations who deploy digital successfully will constantly test, learn from, and improve strategies, tactics, and the technologies they use. It is envisaged that organisations will review their progress against the Code at consistent intervals, ensuring it is part of their continuous improvement. The Code is ambitious and offers a positive challenge to charities, but it also provides best practice you can adopt with limited resources.

Thank you to the Co-op Foundation and Lloyds Banking Group for funding the initial development of the Code. Thank you to all the organisations on the steering group and the charities, individuals, and bodies working in the sector who have advised us. We are especially grateful to The Clothworkers’ Company, The WCIT Charity, and Resource for London who have funded the 2025 update of the Code.

Give feedback

Evolution of the Code

The Code was the first of its kind in the UK. It initially aimed to address the digital skills gap that existed in many charities, which prevented them from fully benefitting from digital. The Code proved particularly useful soon after, with the arrival of the pandemic. The Code helped charity leaders to navigate social distancing restrictions, the growth in remote working, the emergence of digital service delivery, and a general period of digital acceleration. It proved instrumental during the sector’s shift to digital and continued to serve charities in the following years.

But digital, as mentioned above, moves rapidly. Since the first iteration, we’ve witnessed a shift towards remote work, cloud computing, and digital payment processing. We’ve watched the rise of blockchain, cryptocurrencies, and decentralised finance. NFTs have been and gone. Legacy social media platforms have become more hostile, more controversial, and tackling misinformation has taken on new importance. We’ve seen a focus on cybersecurity alongside a boom in privacy regulations. We’ve welcomed an emphasis on green tech, accessibility, and digital inclusion. And, most unexpectedly, after decades as a niche technology, AI arrived in force and provided charities with huge opportunities.

To be effective, the Code must evolve as digital evolves. The changes to the second iteration ensure the Code is fit-for-purpose. We’ve defined the different forms of AI and introduced AI across all principles to help charities mitigate risks and seize opportunities. The introduction of a new principle, Data, serves to highlight how charities can adopt a data-driven approach and protect the data of beneficiaries and stakeholders. We’ve introduced advice on procurement and boosted parts on cyber security. We’ve improved the glossary, extended advice on accessibility and inclusion, and so much more.

We hope the second iteration of the Code prepares charities for digital in 2025 and beyond.

Scope of the Code

The Code is intended as an overview of the key areas that charities need to be aware of in digital. It therefore focuses on the how and why, not the more granular what, when, and where. In the resources section, however, we have put together plenty of content to help charities.

Who is the Code for?

The Code is for charities registered in the United Kingdom. Other organisations, such as small community groups that may not be registered charities, could find it useful. The Code’s principles and best practice guidance have been designed to apply to charities of all sizes. We have developed a version for small charities, which we define as being those with an annual income of £1 million or under, and one for larger charities (those who generate over £1 million of income a year).

Give feedback

How to use the Code

The Code should be used as part of how charities benchmark their progress in digital and to inform key decisions in this area. As such, we recommend that organisations use it regularly. Some charities may wish to make digital a standing item at board and leadership meetings, whether separately or part of other points on the agenda, and if appropriate for their size of organisation.

The Code is separated into key principles, each broken down by an explanation of why it matters, what success looks like, and the best practice that is needed to achieve it.

In the Code, we have used ‘must’ and ‘should’ to indicate what we see as the minimum standard of good practice and ‘could’ to indicate enhanced best practice.

While we consider AI to be a subset of digital, the rapid advancements and new challenges associated with AI often justify special mention in the Code. This does not imply that the principles outlined are exclusive to AI or that when AI is not explicitly mentioned the principles outlined do not apply to it. 

We’ve assumed that charities will comply with any legal obligations related to their use of digital, such as data protection legislation and the UK General Data Protection Regulation (GDPR). And, if working with third parties, we’ve assumed compliance with the legal obligations of their jurisdiction.

The Code should be read in conjunction with other codes and best practice guides, including the following:

• The Charity Governance Code.
• The section on digital media in the Fundraising Code of Practice.
• Cyber Essentials.
• The Charity Commission’s digital guidelines for trustees.
• CAST’s digital service design standards.
• Voluntary Sector Digital Maturity Matrix.
• Principles for Digital Development (for NGOs)

We have also assumed familiarity with the charity’s strategy, vision, and mission.

If any commercial organisations are looking to develop a product to support the Code, you will need to contact the steering group.

Give feedback

Steering group

The Code 2025 update has been developed by a steering group of organisations across the sector, comprising:

• Association of Chief Executives of Voluntary Organisations (ACEVO)
• CAST (The Centre for Acceleration of Social Technology)
• The Charity Commission
• Charity Finance Group (CFG)
• Charity Digital
• Microsoft
• WCVA (Wales Council for Voluntary Action)
• The group’s role is to develop, promote, review, maintain, and champion the Code.

Zoe Amar serves as the Code’s independent chair.

Give feedback

Principles of the Code

Digital is a broad area, so we have identified eight principles to shape areas of focus for the Code. These show how digital touches much of what charities do and how it will need to be considered accordingly.

1 . Leadership

Charity leaders must drive digital as a way of helping their charities remain relevant and sustainable. Digital has grown and become embedded in the sector to the point that it needs to be seen as a key element of strategy and governance. Leaders and trustees should take responsibility for defining how digital will help them achieve their charity’s purpose. They should identify how digital and particularly AI could change the society in which their charity operates and how their charity should adapt to meet the evolving needs of beneficiaries and other stakeholders.

2. User led

Charities should make the needs and behaviours of beneficiaries and other stakeholders the starting point for everything they do digitally, ensuring charitable objectives align with needs. This includes taking an equitable approach to respond to the digital needs of those from marginalised communities.

3. Culture

Charities’ values, behaviours, and ways of working should create the right environment for digital success.

4. Strategy

Charities’ strategies should be ambitious about how they can use digital to achieve their vision and mission while being pragmatic about what should be prioritised depending on their resources.

5. Data

All charities should understand the potential of data. They should use data to maximise the value of digital while simultaneously protecting the information of their stakeholders, employees, volunteers, and beneficiaries. Data should be treated as a strategic asset.

6. Skills

Charities should aim for digital and AI skills to be represented at all levels of the organisation. Digital success depends on the confidence, motivation, and attitude of the people who run, work, and volunteer for charities. Soft skills, such as questioning, persuading, and influencing, are equally important to technical skills.

7. Risk and ethics

Charities need to determine and manage any risks involved in digital and AI. Charities will need to consider how some digital issues, including responsible AI adoption, fit with organisational values and ethics. These are broad areas that may include anything from the use of data in partnerships to understanding how adopting AI will impact marginalised communities to deciding which social platforms to prioritise.

8. Adaptability

Charities will need to adapt to survive and thrive as digital and AI create significant changes to society.

Leadership

Principle

Charity leaders must lead on digital as a way of helping their charities be relevant and sustainable. Digital has grown and become embedded in our everyday lives and the charity sector to the point where they need to be seen as key elements of strategy and governance. Leaders and trustees need to take responsibility for defining how digital will help them achieve their charity’s purpose. They need to identify how digital and particularly AI could change the society that their charity operates in and how their charity should adapt to meet the evolving needs of beneficiaries and other stakeholders. 

Why this matters

Digital and AI should be part of every charity leader’s skillset as a means to help their organisation achieve its vision and increase its impact. Emerging technologies such as AI are developing rapidly and charity leaders must take an ambitious, forward-thinking approach to how they might adopt them appropriately.

What success looks like

Charity leaders and trustees are able to identify specific ambitions and a clear vision for how digital and AI can help their charities achieve their organisation’s charitable purpose and goals thereby increasing impact. They are also able to execute these plans with confidence.

Best practice for small charities

Governance

• Charity leadership teams and boards take responsibility for owning and driving the vision and strategy for digital and AI adoption and growth, rather than delegating it entirely to other staff (e.g. a digital lead), suppliers, or volunteers. This will require the leadership team and boards to further develop their digital and AI skills.
• CEOs and trustees must play a critical role in initiating and spearheading these changes and challenging their charities to be more ambitious about how they use digital and AI responsibly to increase its impact.
• Digital skills should be represented on all charity boards, with the aim of every trustee understanding how digital could increase their charity’s impact. For example, if the charity aims to reach more beneficiaries in its local community, how could digital help?
• Digital and AI skills should be represented on all charity boards, with the aim of every trustee, whether new or already in post, developing a working knowledge of how digital and AI can increase their charity’s impact.
• Trustees are ultimately responsible for ensuring that the relevant strategies, policies (e.g. social media, AI, and IT policies), and procedures for digital are in place, and that everyone is clear on the authority they must act.
• Leaders need to be aware what level of investment in digital is required to achieve their charity goals (such as a new, mobile-friendly website). What will this deliver, how will they know if it offers value for money, and how will they know if it has been a success?
• Leaders should ensure that procured tech effectively integrates with their wider tech eco-system, accounting for integration within the procurement process.
• As charities increase their digital presence, trustees and leadership teams should take ownership of increasing cyber security risks and put in place proportionate measures to protect their funds, data, supporters, and reputation.
• Leaders should identify a level of risk the charity is willing to take in the pursuit of its objectives. The implementation of digital demands a certain degree of risk and charity leaders should ensure associated risks align with a charity’s overall risk appetite.

Skills

• Digital can help small charities to be even more efficient and productive. Leaders and boards should explore the new ways of working and communicating digital offers (e.g. collaborating through platforms such as Teams, Slack, and social media platforms, and experimenting with AI tools and models), looking at how peers and similar organisations are using these tools.
• Charity leaders should ensure appropriate upskilling on emerging tech. AI will have an impact on the future of many charities, providing opportunities for streamlining processes, improving service delivery, creating new income streams, and so on. Charities should focus on generative AI skills in the short-term, with employees understanding how models work, how to personalise and tailor outputs, prompt engineering, optimisation through feedback, and so on. Any upskilling should include elements of safeguarding, ensuring that charities reap the rewards of emerging tech while mitigating core risks.

User led 

Principle

Charities should make the needs and behaviours of beneficiaries and other stakeholders the starting point for everything they do digitally, ensuring charitable objectives align with needs. This includes taking an equitable approach to responding to the digital needs of those from marginalised communities.

Why this matters

Building the charity’s strategy, services, and functions around how beneficiaries, supporters, donors, and other stakeholders use digital will make them more likely to engage, positioning the organisation as relevant and increasing impact.

What success looks like

Stakeholders’ needs, including those of beneficiaries from marginalised communities, will be factored into all digital activities from the outset, from user research to product development, with key assumptions tested against data. Learnings will then be factored into continuously improving digital services and other work and used to inform wider questions about the charity’s strategic direction. The digital needs of marginalised groups will be a key element of user research, product development, and supplier procurement. 

Best practice for small charities

Understanding audiences

• Insights and data about what the charity’s beneficiaries, supporters, and other stakeholders, want and need should inform all planning for digital activities. Donors and potential donors should also be included. 
• Charities should aim to map the user journeys of typical beneficiaries, supporters, donors, and other stakeholders to help them inform their planning, service delivery, and product development. The digital needs of staff should also be considered when planning internally focused digital activities, e.g. a new intranet.
• Risks involved in innovation should be managed – for example, by piloting new products or services with small groups before rolling them out more widely. This is key to digital and responsible AI adoption.
• Charities must assess user needs when procuring tech. They should establish clear specifications and conduct effective vendor research, ensuring the offering of the vendor aligns with needs. Charities should take account of the total cost of ownership (TCO), including cost of maintenance, training, upgrades, and hidden costs. 

Digital inclusion

• Charities should aim to follow the basic principles of digital inclusion, i.e. based on an understanding of the digital skills of beneficiaries, supporters, and other stakeholders, their ability to access the internet, and any specific assistive technology needed. Beneficiaries and donors who are not online should be offered alternatives where appropriate.

Accessibility

• The needs of users who are digitally excluded must be considered, including those individuals in vulnerable circumstances. Every effort should be made to ensure that digital services meet accessibility requirements and that the World Wide Web Consortium guidance is taken into account. Offline channels should be offered where appropriate.
• Charity leaders must ensure, when commissioning digital services, that accessibility is a contractual requirement. Contracts should specify compliance with the Web Content Accessibility Guidelines (WCAG) to hold suppliers accountable for delivering accessible solutions.
• Charity leaders must recognise that accessibility benefits everyone. Organisations must embed accessibility into planning, design, development, and content creation processes. Retrofitting accessibility is costly and less effective, whereas considering accessibility from the start leads to better, more inclusive outcomes.
• Charities should use a mix of testing methods for accessibility, including manual and automated testing. Automated accessibility tools can identify technical compliance issues, but manual testing, including user testing with people with disabilities, will prove essential to uncover real-world barriers that automated tools might miss.
• Charities should schedule regular accessibility audits – at least annually – to ensure ongoing compliance and improvement.  Organisations should not rely solely on the claims of designers and developers regarding accessibility. Engaging third-party experts for audits and external reviews ensures an objective assessment and helps maintain high standards.
• Charity leaders should recognise accessibility as an ongoing commitment. Accessibility is not a one-time project but a continuous process of improvement. Training teams, engaging with disabled people for feedback, and keeping up with evolving best practices are crucial to maintaining inclusive services.

Give feedback

Culture 

Principle

Charities’ values, behaviours, and ways of working should create the right environment for digital success.

Why this matters

The right culture will develop the confidence and motivation of staff and volunteers in digital and AI. It will shape their behaviour by fostering innovation, increasing collaboration, creating momentum, breaking down siloes, empowering people to share new ideas, using data to improve decision-making, and increasing transparency.

What success looks like

The people who volunteer or work for charities will be in a better position to collaborate, innovate, and learn additional skills, developing the right mindset for change and innovation, and contributing to how the organisation can achieve its goals through digital and AI. They will focus outwards as much as inwards, horizon scanning, connecting with peers at other organisations, reviewing trends, and understanding how beneficiaries and supporters (including those from marginalised communities) use digital and AI, and how this might change these groups’ expectations of how they interact with charities.

Best practice for small charities

Motivation

• Leaders will need to identify and create the motivation for change and innovation. This must include creating a vision for how digital could help their charity, communicating how they use digital tools to achieve its goals and improve its sustainability, and celebrating and recognising success.
• Leaders will need to develop the right mindset for digital and AI among staff and volunteers, such as being open to trying new ideas and encouraging peer learning and collaboration.
• Charity leaders should champion ‘cyber awareness’, ensuring all staff are aware of the risks of cyber attacks. Incorporating cyber awareness in your charity is crucial for prevention, equipping your staff with the necessary knowledge to mitigate many of the risks.

Behaviour change

• Charities who are just getting started with digital could take small steps and learn as they go with online tools. For example, consider running a workshop on how staff and volunteers use digital outside of work and how they can apply what they have learned to their roles.
• Leaders should encourage a culture of safe experimentation and iterative learning based on testing rapid prototypes with users. This includes developing products, services, and the use of emerging tech such as AI. That might mean creating an AI policy that encourages use while outlining core risks and their appropriate management, such as the dissemination of information, introduction of bias, and privacy violations. And creating space for staff and volunteers to share learnings about skills and use cases.
• Charity leaders should develop an appetite for risk. Leaders should identify a level of risk the charity is willing to take in the pursuit of its objectives. The implementation of digital demands a certain degree of risk and charity leaders should ensure associated risks align with a charity’s overall risk appetite.

Ownership

• While strategic initiatives and products should have specific owners within each charity, digital needs to be involved in everyone’s role, from trustees to volunteers. The ways in which this is achieved will depend on each charity’s aims and individual roles and responsibilities.

Collaboration

• Charity staff and volunteers should take advantage of the opportunities digital offers to collaborate, using online tools or different ways of working, such as an agile approach.
• Charities could work with organisations both in and outside the sector on mutually beneficial digital initiatives, e.g. a charity working on a pro-bono partnership with a tech company to develop a digital product that could help their beneficiaries. When selecting partners charities should consider how the partner’s culture aligns with theirs.

Give feedback

Strategy

Principle

Charities’ strategies should be ambitious about how they can use digital  to achieve their vision and mission whilst being pragmatic about what should be prioritised depending on their resources.

Why this matters

Charities need a clear vision, purpose, and well-defined approach for how they use digital and AI, all of which will create the motivation for change. By understanding user’s digital needs and how to meet them in a way that is aligned to the charity’s goals, they will be able to improve their organisation’s relevance and sustainability in a rapidly changing world.

What success looks like

Charities will be clear about their strategic direction in digital and AI, enabling them to invest time and other resources more effectively. They will be confident about the role digital and AI play in their value proposition and how this is differentiated from other organisations in the same field, putting the charity in a stronger position for the future.

Best practice for small charities

Organisational strategy

• Charities should use digital tools that support their vision and mission and increase impact, understanding where digital approaches are and are not the best way to achieve these aims.
• Charities could develop a strategy that helps them use digital and data to achieve their charitable purposes, aims, and objectives. Ideally, this will be part of the overall organisational strategy but may be a standalone digital strategy until the leadership team has developed their digital experience and skills. In either case, digital should be embedded in the charity’s goals and ways of working, not an add-on.
• Roles and responsibilities for delivering the strategy should be identified (ideally at a senior level) and the appropriate accountabilities created.
• To increase the chances of success, the plans to deliver the strategy should be practical, manageable, iterative, adaptable, and carefully monitored, and appropriate resources are allocated. The strategy should reference how the charity plans to use emerging tech, ensuring that employees feel empowered to learn, use, and experiment with new technologies.

Impact

• Charities should consider ways in which digital and AI could potentially increase their impact, such as reaching and supporting more beneficiaries by using digital channels, new generative AI platforms, and new tools and approaches, where relevant. This should be measured by identifying clear measures of success and using the correct tools for evaluation.
• While generative AI can offer many benefits to charities, leaders should explore the potential other forms of AI offer. Extractive AI and predictive AI can both help improve the way you use data for decision-making, for example, and automation with AI can free up time by automating the tedious and repetitive tasks. Charities should look at their current tools, many of which depend on AI, and experiment to see how they can make improvements. 

Approach

• Charities should be ambitious and challenge themselves about what they wish to achieve with digital and AI, while being aware of what they can undertake based on capabilities and resources. Partnerships should be considered to increase innovation, impact and build capacity and capabilities.
• Charity leaders should identify and agree on how best to deal with barriers to achieving the strategy. These will be different for every organisation and could range from risk management to how legacy technology systems may be impeding progress.

Give feedback

Principle

All charities should understand the potential of data. They should use data to maximise the value of digital while simultaneously protecting the information of their stakeholders, employees, volunteers, and beneficiaries. Data should be treated as a strategic asset. 

Why this matters

Data helps charities to connect with supporters, maximise fundraising, improve service delivery, develop a long-term digital strategy, analyse risk, and streamline processes. But data poses risks, especially around privacy and ethics, so charities need to ensure they collect, process, and store data appropriately.

What success looks like

Charities will collect data fairly, transparently, and with the full consent of users. All decision-making will be data-driven and evidence-based. Data flow will be documented, consistent, and automated to the greatest extent possible. They will store data, ensuring constant compliance with all data privacy regulations. They will apply effective data analytics to boost campaigns, improve service delivery, and make data-driven decisions. They will use and combine data to solve their most important problems.

Best practice for small charities

Data collection

• Charities must comply with the latest regulations around the collection and storage of data, particularly with UK GDPR. Leaders should apply “legitimate interest” when appropriate, ensuring collected data is relevant and accurate, and the data collection is fair and transparent.
• Charities should be ambitious and challenge themselves about what they wish to achieve with digital and AI, while being aware of what they can undertake based on capabilities and resources. Partnerships should be considered to increase innovation, impact and build capacity and capabilities.
• Charities should always articulate and sustain the value of ‘opting-in’ for supporters to further their communications. ‘Opt-in’ options should be uniform across products and platforms to avoid confusion for the users, always providing an opt-out option that is easy to identify.
• Charities should give supporters as much flexibility as possible to manage their own permissions.

Data privacy and security

• Charities should only retain necessary information and regularly review and remove data that no longer serves a specific purpose.
• Put in place robust security measures where possible, including encryption for data, limiting access to sensitive data, proper authentication mechanisms, and regular security audits.
• Charities and charity employees should practice caution when inputting data into generative AI models. Sensitive data should only be entered if the model does not use that data in an insecure manner (i.e. using it to inform future outputs which become generally or publicly available) violating privacy and undermining user trust.
• Train staff on data management. This ensures that everyone understands the importance of data security and proper handling procedures.
• Charities should review the data held, clean up any outdated or unnecessary data, and ensure data is backed up to prevent loss.
• The completion of Data Impact Assessments should be a matter of course across the charity.

Data management

• Regularly review the data held, clean up any outdated or unnecessary data, and ensure that data is backed up to prevent loss.
• Where possible use a centralised database or databases such as customer relationship management (CRMs), volunteer management, and human resource management platforms to store and manage data. This helps in maintaining data integrity, security, and accessibility.

Data analytics

• Charities will likely hold existing data, such as donor, supporter, and attendee data. Leaders should work to understand where that data is held, how to access that data, and how to generate actionable information from that data.
• Leaders can review data, draw conclusions, and make data-driven conclusions. For example, leaders should encourage others to use data to pick the best platforms to invest in digital advertisement by exploring available data on demographics, target audiences, platform usages, potential conversion rates, and so much more. Data analytics therefore can ensure a greater return on investment (ROI) for digital advertisement. Charity leaders should always monitor ROI against their digital strategy.
• Leaders should encourage the use of predictive analytics to better identify trends, target potential donors, reach new audiences, and streamline future processes. Predictive data analytics provides a glimpse into the future, allowing charities to identify long-term opportunities and mitigate upcoming risks.
• Generative AI tools can be used to perform analytical tasks, but there are clear associated risks that charities need to understand, mitigate, and manage. Risks include, but are not limited to:
  • Data privacy and security (see above).
  • Bias and unfairness (see principle 7: Risk and ethics).
  • Transparency and explainability: AI models can produce “black box” outputs that make it hard to understand how conclusions were drawn, which can undermine trust and confidence.
  • Dependence on AI: Over-reliance on AI tools can lead to misinformation, errors, and missed opportunities for critical and creative thinking. Maintaining human oversight remains vital.

Skills 

Principle

Charities should aim for digital and AI skills to be represented at all levels of the organisation. Digital success depends on the confidence, motivation, and attitude of the people who run, work, and volunteer for charities. Technical and soft skills, such as questioning, persuading, and influencing, are equally important.

Why this matters

Everyone who works for a charity, from trustees to volunteers, staff, and partner organisations, all play a fundamental role in helping charities to harness the power of digital.

What success looks like

Leaders will understand the digital and AI skills of their teams. Gaps will be identified and a plan to close and continuously update them should be in place, helping the charity achieve its objectives and attracting, developing, and retaining people with good levels of digital skills.

Best practice for small charities

Understanding their skills

• Charities should understand and be able to state with confidence the digital and AI abilities of staff, volunteers, and trustees (e.g. “our staff are proficient with managing data”) while understanding where gaps exist and how to support their team in closing them, whether through mentoring, training, or other ways of learning.
• Leaders should ensure employees have basic digital skills or support them to gain basic digital skills. Plenty of resources, often free, can help that skill acquisition. 
• Leaders should champion cyber awareness and ensure staff and volunteers are trained on cyber security. Charity staff should take advantage of the free resources available for training, especially the resources made available by the National Cyber Security Centre (NCSC).

Recruitment

• Charities may need to think creatively about how they attract staff or volunteers with digital and AI skills (e.g. by developing partnerships with local technology companies).

Skills development

• Digital skills should be developed in line with benefits for the charity, such as improving impact, understanding beneficiaries’ needs and staff motivation, and increasing productivity and efficiency (e.g. using online tools to edit a shared document easily). Where specialist digital staff or trustees are recruited, charity leaders should be clear on the purpose of the appointment and how this can be supported by the rest of the organisation.
• Charities should remind employees that digital skills development is ongoing and evolving, emphasising the need to improve their skills as specific tech is changed and updated.

Skills sharing

• Charities should also consider opportunities to maximise digital skills sharing within organisations (e.g. through reverse mentoring or informal coaching).Charities could also consider creative approaches to sharing skills. For example, where they have identified a need for specialist digital skills they could ask a tech company or a commercial business for volunteers or other forms of pro-bono advice.

Give feedback

Risk and ethics

Principle

Charities need to determine and manage any risks involved in digital and AI. Charities will need to consider how some digital issues, including responsible AI adoption, fit with organisational values and ethics. These are broad areas is a broad area that may include anything from the use of data in partnerships to understanding how adopting AI will impact marginalised communities to deciding which social platforms to prioritise.

Why this matters

Charities need to assess any risks involved in their use of digital and AI and manage them. Ultimately, this will help them maintain public trust and confidence and handle any reputational issues, as well as safeguard the needs of their beneficiaries and their data. Digital technology is evolving rapidly and any organisations who use online tools will need to assess whether they are aligned with their charity’s principles and values.

What success looks like

Charities will be confident and experienced in identifying risks and mitigating them. Both established and emerging digital technologies offer opportunities to charities to improve sustainability, impact, and income. Charity leaders should manage this by ensuring that they have sufficient skills and knowledge to make informed decisions about ethical issues.

Best practice for small charities

Managing risk in digital

• Charity leaders and trustees should have the necessary skills and oversight of their charity’s digital activities in order to determine risk (e.g. when managing data or using social media to manage reputation). This should be aligned with the charity’s risk management policy and process. Any risks should be identified and assessed accordingly.
• When procuring, appropriate due diligence must be undertaken on suppliers, and legal and commercial advice sought on the terms and conditions of contracts. Any ongoing costs related to the agreement should be understood and evaluated.
• Charity leaders and trustees should periodically review their existing systems and processes, understanding what is in place, how they work together, whether they are obtaining value for money, and anticipating and evaluating any risks, such as the ability to keep services secure, up to date, and working as intended.
• Charities may require support from someone with good technical skills to help them evaluate risk, which could be a member of staff, a trustee, or a volunteer. Where risk is potentially significant, all possible actions to manage it should be evaluated and a plan put in place to deal with different scenarios.
• Charities should safeguard against risks associated with specific areas of digital. For example, people working in social media might be trained in the prevention of misinformation, privacy and security risk, how to handle personal attacks, and so on.
• When introducing any new digital technology any new operational risks should be considered such as system failures or inaccuracies. Monitoring should be in place to mitigate these risks and plans put in place to ensure business continuity in the event of any failures.
• Risks should be reviewed, monitored, and assessed periodically. Where relevant, they should be recorded on the risk register. Charities should also monitor risk around third parties, particularly regarding the use of AI, and ensure they practice ethical use of emerging tech. 
• Charities should read this principle alongside the Charity Commission guidance on charities and risk management.

Cyber security

• Charities should have a board-level awareness of the risks posed to their organisation from cyber attacks and a framework for how to act in the event of a cyber incident. The following steps, taken from Cyber Security: Small Charity Guide, will help any charity protect themselves from the most common cyber attacks:
  • Ensure you take regular backups of your important data.
  • Ensure you keep your devices, antivirus, and software, including apps, up to date.
  • Ensure any smartphones and tablets are kept up to date and can be remotely wiped.
  • Avoid connecting to unknown Wi-Fi hotspots while away from home or the office.
  • Ensure all devices are password protected and staff know how to set secure passwords.
  • Help staff avoid phishing, ensuring they know how to report something that looks wrong.

Diversity

• Equality, diversity, and inclusion (EDI) enhances innovation, improves creativity, and offers unique perspectives to charities. Leaders should enact effective EDI policies and ensure they remain compliant with all relevant legislation, particularly the Equality Act 2010.
• Charity leaders should emphasise the importance of diversity when conducting user research, developing products, building digital teams, and procuring tech.
• We support the guidance on diversity set out in the Charity Governance Code. Charities should ensure that a diversity of backgrounds, life experiences, career paths, and diversity of thinking are represented on their digital teams, digital platforms, and in user research.

Transparency

• Charities should publish how they use data on their websites, annual reports, and other channels.
• Charities should be transparent about their use of AI whether it be in the sourcing of digital assets produced by Generative AI or decisions that are made with the assistance of AI.
• Charities should use digital channels to share their impact and to demonstrate their openness and accountability.

Emerging technologies

• Charity leaders and staff should understand and plan for how new technologies could change how they work, from crowdfunding to automation, ensuring that they remain relevant to their audience.
• Charities should monitor ethical issues revealed by technological developments to assess whether these fit with their organisational values and what the implications of unintended consequences might be. They will need to understand the implications for their users and the charity’s work and any actions they may need to take as a result. The core risks that charities face include the following:
  • Data breaches on particular platforms.
  • Bias and misinformation in AI models.
  • Lack of ethical design in emerging tech.
  • Environmental impact of using large language models.
  • Potential breaches of copyright in generative AI.
  • Displacement or changes to human roles.
  • Legal and reputational risks.
• Charity leaders should practice ethical and responsible adoption of emerging tech, particularly AI. That means ensuring values translate into the tools you use, conducting risk assessment where necessary, and writing policies that inform effective governance. 

Adaptability 

Principle

Charities will need to adapt to survive and thrive as digital changes how everyone lives and works.

Why this matters

Organisations who do not consider how they adapt to the digital age will lose relevance and engagement. Users, stakeholders, and donors are increasingly online and expect the same from charities. Technological change is often quick and adapting to that change allows charities to spot opportunities and react to risk quickly.

What success looks like

Charities and their leaders take an agile approach, regularly reviewing the key trends in digital (and the accompanying opportunities and risks) and their data and insights about their audience so that they can continually fine tune and develop their digital activities. They can include insights in wider organisational strategy and planning where necessary.

Best practice for small charities

Improving current practices

• Charities should aim to make their platforms, systems, and services accessible to users from as wide a range of devices and locations as is appropriate.
• Charities’ systems should work with each other internally and with external systems.
• Data should be captured through all interactions where appropriate, creating a single customer view that improves services along with stakeholders’ experiences.
• Digital teams should work in close partnership with those responsible for IT infrastructure. We see IT infrastructure as an enabler of digital.

Looking to the future

• Charities should review at consistent intervals how their use of digital benchmarks against relevant organisations working in a similar field, learning from the findings.
• Charities could aim to solve problems they identify by developing new ideas, products, and services and testing them, using free and existing digital platforms if resources are limited.
• Charities should develop a “fail fast, fail forward”’ mentality where they pilot new ideas and learn quickly from failure as well as success. Digital creates opportunities for innovating and testing relatively cheaply.
• Insights from users and wider digital trends should be applied to the charity’s work, creating a process of continuous improvement.
• Charities should consider the implications of emerging technology, such as virtual and augmented reality and the evolving digital payments landscape, for their business models.