Digital has accelerated faster than ever in the years since the pandemic. We’ve seen a shift towards the cloud, an embrace of blockchain and cryptocurrency, the rise and fall of NFTs, new challenges in cyber security, and much more. Social media platforms have grown hostile and misinformation runs wild. And the rapid growth of generative artificial intelligence (AI) has changed just about everything.

Background to the Code of Practice

We define digital as the application of the culture, processes, business models, and technologies of the internet era. Since the first iteration of the Charity Digital Code of Practice (Code), digital has continued to change how we live and work. More than 5.5 billion people worldwide use the internet, with 5.2 billion using social media. Digital skills increase charity reach, impact, efficiency, and sustainability. Digital has become essential for charities to remain relevant and fulfill their purpose.

Artificial intelligence (AI), in particular, is changing the societies in which charities operate and dictating how organisations communicate, fundraise, and provide services. As a subset of digital, AI refers to systems that mimic human intelligence to solve complex tasks. Generative AI has become exceptionally popular in recent years, but other forms of AI, such as machine learning, agentic AI, extractive AI, and automation, also provide significant benefits to charities. Indeed, AI has already revolutionised the nature of work, providing huge opportunities across the economy. By 2030, according to PwC, AI could add up to $16 trillion (£12.6 trillion) to the global economy through productivity enhancement, stimulated demand, and small-scale automation. Charities need to tap into that potential.

The Code aims to help charities of all sizes, budgets, and causes progress with digital by offering a consistent framework to shape and develop digital ways of working. It is not a regulatory requirement, so it focuses on principles and best practice advice. Given the rapid pace of change in emerging tech, particularly AI, the Code must be aspirational. Emerging tech offers charities of all sizes the opportunity to innovate to drive social change. These technologies, if adopted without the right checks and balances, may unintentionally create new social harms and expose organisations to significant risks. Charities have an important role to play by modelling how to adopt digital responsibly, ethically, and inclusively. This will help charities use tech to tackle bigger social challenges and play a more influential role in fighting for social justice.

We hope that charities will use the Code as a practical tool to identify what they are doing well in digital, as well as any gaps they need to address. Digital is rapidly evolving. Organisations who deploy digital successfully will constantly test, learn from, and improve strategies, tactics, and the technologies they use. It is envisaged that organisations will review their progress against the Code at consistent intervals, ensuring it is part of their continuous improvement. The Code is ambitious and offers a positive challenge to charities, but it also provides best-practice principles you can adopt with limited resources.

Thank you to the Co-op Foundation and Lloyds Banking Group for funding the initial development of the Code. Thank you to all the organisations on the steering group and the charities, individuals, and bodies working in the sector who have advised us. We are especially grateful to The Clothworkers’ Company, The WCIT Charity, and Resource for London who have funded the 2025 update of the Code.

Evolution of the Code

The Code was the first of its kind in the UK. It aimed to address the digital skills gap that existed in many charities, which prevented them from fully benefiting from digital. The Code proved particularly useful soon after, with the arrival of the pandemic. The Code helped charity leaders to navigate the growth in remote working, the emergence of digital service delivery, and a period of digital acceleration. It proved instrumental during the sector’s shift to digital and continued to serve charities in the following years.

But digital moves rapidly. Since the first iteration, we’ve witnessed a shift towards cloud computing and digital payment processing. We’ve watched the rise of blockchain, cryptocurrencies, and decentralised finance. NFTs have been and gone. Legacy social media platforms have become more hostile, more controversial, and tackling misinformation has taken on new importance. We’ve seen a focus on cyber security alongside a boom in privacy regulations. We’ve welcomed an emphasis on environmentally sustainable tech, accessibility, and digital inclusion. And, most unexpectedly, after decades as a niche technology, AI arrived in force and provided charities with huge opportunities.

To be effective, the Code must evolve as digital evolves. The changes to the second iteration ensure the Code is fit-for-purpose. To help charities mitigate risks and seize opportunities, we’ve defined the different forms of AI and introduced AI across all principles. The introduction of a new principle, Data, highlights how charities can adopt a data-driven approach while safeguarding their own organisation, as well as protecting the data of beneficiaries, employees and other stakeholders. We’ve added tips on buying digital tools and improved sections on cyber security. We’ve improved the glossary, extended advice on accessibility and inclusion, and so much more.

We hope the second iteration of the Code prepares charities for making the most of digital in 2025 and beyond.

Scope of the Code

The Code is intended as an overview of the key areas that charities need to be aware of in digital. It therefore focuses on the how and why, not the more granular what, when, and where.

Who is the Code for?

The Code is for charities registered in the United Kingdom. Other organisations, such as small community groups that may not be registered charities, may find it useful. The Code’s principles and best practice guidance are meant to help charities of all sizes. We have developed a version for small charities, which we define as being those with an annual income of £1 million or under, and one for larger charities, which we define as those with an annual income of more than £1 million.

How to use the Code

The Code should be used as part of how charities benchmark their progress in digital and to inform key decisions in this area. As such, we recommend that organisations use it regularly. Some charities may wish to make digital a standing item at board and leadership meetings, as appropriate to their size of organisation.

The Code is separated into key principles, each broken down by an explanation of why it matters, what success looks like, and the best practice that is needed to achieve it.

In the Code, we have used “must” and “should” to indicate what we see as the minimum standard of good practice and “could” to indicate enhanced best practice.

While AI is deeply integrated into digital technologies, its rapid advancements and associated challenges often justify special mention in the Code. This does not imply that the principles outlined are exclusive to AI or that when AI is not explicitly mentioned the principles outlined do not apply to it.

We’ve assumed that charities will comply with any legal obligations related to their use of digital, such as data protection legislation and the UK General Data Protection Regulation (GDPR). And, if working with third parties, we’ve assumed compliance with the legal obligations of their jurisdiction.

The Code should be read in conjunction with other codes and best practice guides, including the following:

●     The Charity Governance Code

●     The section on digital media in the Fundraising Code of Practice

●     Cyber Essentials

●     The Charity Commission’s digital guidelines for trustees

●     CAST’s digital service design standards

●     Voluntary Sector Digital Maturity Matrix

●     Principles for Digital Development (for NGOs)

If any commercial organisations are looking to develop a product to support the Code, please contact the steering group.

Steering group

The Code 2025 update has been developed by a steering group of organisations across the sector, comprising:

●     Association of Chief Executives of Voluntary Organisations (ACEVO)

●     CAST (The Centre for Acceleration of Social Technology)

●     The Charity Commission

●     Charity Finance Group (CFG)

●     Charity Digital

●     Microsoft

●     WCVA (Wales Council for Voluntary Action)

The group’s role is to develop, promote, review, maintain, and champion the Code.

Zoe Amar serves as the Code’s independent chair.

Principles of the Code

Digital is a broad area, so we have identified eight principles to shape areas of focus for the Code. These show how digital touches much of what charities do and how it will need to be considered accordingly.

1. Leadership

Charity leaders must drive digital as a way of helping their charities remain relevant and sustainable. Digital has grown and become embedded in the sector to the point that it needs to be seen as a key element of strategy and governance. Leaders and trustees should take responsibility for defining how digital will help them achieve their charity’s purpose. They should identify how digital and particularly AI could change the society in which their charity operates, how digital and AI can help them meet charitable objectives, and how their charity should adapt to meet the evolving needs of beneficiaries and other stakeholders.

2. User led

Charities should make the needs and behaviours of beneficiaries and other stakeholders the starting point for everything they do digitally, ensuring charitable objectives align with needs. This includes taking an equitable approach to respond to the digital needs of those from marginalised communities and helping to bridge the digital divide by ensuring digital tools and initiatives are accessible by everyone.

3. Culture

Charities’ values, behaviours, and ways of working should create the right environment for digital success. Key points could include fostering collaboration, embedding inclusivity, encouraging innovation, supporting learning, and building trust and transparency.

4. Strategy

Charities’ strategies should be ambitious about how they can use digital to achieve their vision and mission while being pragmatic about what should be prioritised depending on their resources.

5. Data

All charities should understand the potential of data. They should use data to maximise the value of digital while simultaneously protecting the information of their stakeholders, employees, volunteers, and beneficiaries. Data should be treated as a strategic asset and the importance of data leadership recognised and actioned.

6. Skills

Charities should aim to embed digital and AI skills at all levels of the organisation, ensuring they are integrated into decision-making, strategy, and day-to-day operations. Digital success depends on the confidence, motivation, and attitude of the people who run, work, and volunteer for charities. Soft skills, such as questioning, persuading, and influencing, are equally important to technical skills.

7. Risk

Charities need to determine and manage any risks involved in digital and AI. Charities will need to consider how the adoption of digital and AI aligns with key values such as integrity, inclusivity, accountability, fairness, and transparency. This should include responsible AI adoption and that may include anything from the use of data in partnerships to understanding how adopting AI will impact marginalised communities to deciding which social platforms to prioritise.

8. Adaptability

Charities will need to adapt, not only to survive and thrive as digital and AI drive significant societal change but also to respond to the new opportunities, risks, and inequalities these technologies may create.

1. Leadership

Principle

Charity leaders must drive digital as a way of helping their charities remain relevant and sustainable. Digital has grown and become embedded in our everyday lives and the charity sector to the point that it needs to be seen as a key element of strategy and governance. Leaders and trustees should take responsibility for defining how digital will help them achieve their charity’s purpose. They should identify how digital and particularly AI could change the society in which their charity operates, how digital and AI can help meet charitable objectives, and how their charity should adapt to meet the evolving needs of beneficiaries and other stakeholders. 

Why this matters

Digital and AI should be part of every charity leader’s skillset to help their organisation achieve its vision and increase its impact. Emerging technologies such as AI are developing rapidly, and charity leaders must take an ambitious, forward-thinking approach to how they might adopt them appropriately.

What success looks like

Charity leaders and trustees are able to identify specific ambitions and a clear vision for how digital and AI can help their organisations achieve their charitable purpose and goals, thereby increasing impact. They are also able to execute these plans with confidence.

Best practice for large charities

Governance

• Charity leadership teams and boards take responsibility for owning and driving the vision and strategy for digital and AI adoption and growth, rather than delegating it entirely to other staff (e.g. digital teams), suppliers, or volunteers. This requires not only leadership teams and boards to further develop their own digital and AI skills but also to foster a culture where the whole organisation builds confidence and capability in using these technologies effectively. Ensuring that digital and tech teams work together is also critical. 
• CEOs and trustees must play a critical role in spearheading these changes and challenging their charities to be more ambitious about how they use digital and AI responsibly to increase its impact.
• CEOs need to practice awareness around the international integration of technology and data flows across their charities, and the supranational and international regulations currently governing the application of tech, such as the EU Artificial Intelligence Act and the EU Cyber Security Act.
• Digital and AI issues need to be considered regularly at board and leadership team meetings. Executive teams and trustees must be confident that they have the requisite skills to make informed, data-driven decisions about how digital can help achieve their charity’s objectives.
• Trustees should support and enable senior staff to feel confident in taking a more innovative approach to digital, such as safely exploring emerging tech and piloting ideas for new products and services, including partnering with other organisations in and outside the charity sector.
• Trustees are ultimately responsible for ensuring that the relevant strategies, policies (e.g. social media, AI, and IT policies), and procedures for digital are in place, and that everyone is clear on the authority with which they must act.
• Boards should review how digital and AI can help make the functions, administration, and key principles of governance more effective (e.g. using digital channels to make decisions, provided it doesn’t remove the need for trustees to consider them properly).
• Digital and AI skills should be represented on all charity boards, with the aim of every trustee developing a working knowledge of how digital and AI can increase their charity’s impact.
• Leaders must understand what level of investment in digital is required to achieve their charity’s objectives, what this will deliver, and how to evaluate it, ensuring it represents value for money. They should consider what is appropriate to invest in products and services as well as improving capacity (e.g. digital skills training) and infrastructure (e.g. good systems that improve productivity and efficiency).
• Leaders need to make a positive, evidence-based business case for digital investment, showing how charities will specifically benefit and how they will overcome any potential roadblocks and opposition.
• Leaders should define long-term user needs in procurement to ensure tech is scalable and flexible, capable of meeting future demands and not simply the needs of the moment.
• Leaders should ensure that procured tech effectively integrates with their wider tech eco-system, accounting for integration within the procurement process.
• Leaders can create procurement roadmaps to outline the steps, timelines, and resources necessary to ensure the process proves efficient. Roadmaps are particularly useful in terms of tech integration. Leaders could seek roadmaps from vendors and consider their capacity to influence such roadmaps.
• The impact of new and emerging technologies on users, and how this could change their behaviour, should also be considered, particularly around the implementation of AI. Leaders should consider responsible application, and institute policies that encourage safe exploration and safeguard against potential risk.
• Trustees and leaders must evaluate how charities can adopt AI responsibly to ensure it remains consistent with their ethics and values, does not perpetuate inequalities, and consideration is given to the impact on the environment. These factors must be considered when partnering with organisations to develop products, services, and other initiatives. If appropriate, trustees and leaders should consider developing decision-making criteria or a framework to evaluate these decisions.
• Leaders should identify a level of risk the charity is willing to take in the pursuit of its objectives. The implementation of digital demands a certain degree of risk and charity leaders should ensure associated risks align with a charity’s overall risk appetite.
• Trustees and leadership teams must take ownership of increasing cyber security risks and put in place proportionate measures to protect their funds, data, supporters, and reputation.
• Digital experts on staff teams at large charities could consider offering their skills to be trustees of other charities, capacity permitting.

Leading by example

• Leaders and boards do not need to be digital experts, but all should commit to leading by example, growing their own skills, championing digital, understanding digital opportunities and risks for their charities, and how their organisation benchmarks against others. They should motivate colleagues to do the same. Large charities with a devolved structure should ensure leaders at regional or local level have the confidence, skills, and mindset to lead digital change.

Skills

• Where leaders have identified digital skills gaps, they should attempt to close them through training, recruiting staff or volunteers, or other means of support (e.g. non-executive roles on digital steering groups or advisory boards). This should go beyond individual roles, fostering a culture of continuous learning across the organisation. Leaders can support this by ensuring job descriptions, professional development opportunities, and organisational policies reflect the importance of digital and AI skills.
• Leaders should ensure their boards and charities can attract and retain people with good levels of digital skills. This may involve thinking creatively about the recruitment process or offering short-term, high impact opportunities to staff or volunteers.
• While generative AI can offer many benefits to charities, leaders could explore the potential other forms of AI on offer. Extractive AI and predictive AI can improve the use of data for decision-making, for example, and agentic AI and automation through AI can free up time by automating the tedious and repetitive tasks. Charities should look at their current tools, many of which depend on AI, and safely explore to see how they can make improvements.
• Leaders should consider the broad spectrum of AI and find the best ways to apply forms of AI to particular use cases. Free tools are available to use for each form of AI. Explore the use of AI with your various use cases and focus on the application of AI for specific tasks.
• Leaders and boards need to invest in developing the right mindset, such as being open to new ideas (e.g. learning from peers and regularly reviewing best digital practice from comparable organisations in other sectors) and adapting to new ways of working and communicating digital offers (e.g. reviewing how ways of working can bring in established digital approaches, such as working in multidisciplinary teams, delivering iteratively, incorporating AI tools, and embedding collaborative and asynchronous ways of working through platforms such as Teams, Slack, and social media platforms). 

2. User led

Principle

Charities should make the needs and behaviours of beneficiaries and other stakeholders the starting point for everything they do digitally, ensuring charitable objectives align with needs. This includes taking an equitable approach to responding to the digital needs of those from marginalised communities and helping to bridge the digital divide by ensuring that digital tools and initiatives are accessible by everyone.

Why this matters

Building the charity’s strategy, services, and functions around how beneficiaries, supporters, donors, and other stakeholders use digital will make them more likely to engage, positioning the organisation as relevant and increasing impact.

Navigating the digital divide is important for charities who wish to reduce inequality and advocate for inclusivity regardless of socio-economic or geographic factors.

What success looks like

Stakeholders’ needs, including those of beneficiaries from marginalised communities, will be factored into all digital activities from the outset, from user research to product development, with key assumptions tested against data. Learnings will then be incorporated into continuously improving digital services and other work and used to inform wider questions about the charity’s strategic direction. 

The digital needs of marginalised groups will be a key element of user research, product development, and supplier procurement. Charities actively reduce barriers to access, providing tools, support or training to ensure digital initiatives reach all segments of their audience. By doing so charities will foster greater inclusivity and impact.

Best practice for large charities

Understanding audiences

•  
• Insights and data about what the charity’s beneficiaries, supporters, and other stakeholders want and need should inform all planning for digital activities. Being user led should become part of the culture. Donors and potential donors could also be included.
• Charities could observe users’ behaviour in the context they are trying to help them, encouraging them to share insights and asking how they would like services delivered.
• Charities could map the user journeys of typical beneficiaries, supporters, and other stakeholders and use the insights gained to inform their planning, service delivery, and product development.
• The digital needs of staff (including accessibility) should also be considered when planning internally-focused digital activities, e.g. a new intranet.
• Digital tools and the accompanying behaviours are evolving rapidly. Learning how each charity’s audience is using digital tools needs to be part of the organisation’s continuous learning and planning.
• Charities must assess user needs when procuring tech. They should establish clear specifications and conduct vendor research, ensuring the offering of the vendor aligns with needs. Charities should take account of the total cost of ownership (TCO), including cost of maintenance, training, upgrades, and hidden costs.

Digital inclusion

• Charities should aim to follow the principles of digital inclusion, i.e. based on an understanding of the digital skills of beneficiaries, supporters, and other stakeholders, their ability to access the internet, and any specific assistive technology needed. Beneficiaries and donors who are not online should be offered alternatives where appropriate.
• Charities may wish to lobby for improvements to digital platforms, such as increasing accessibility for their beneficiaries, or on ethical issues, where relevant and appropriate.

Accessibility

• The needs of users who are digitally excluded must be considered, including those individuals in vulnerable circumstances. Every effort should be made to ensure that digital services meet accessibility requirements and regulation, such as the European Accessibility Act, and that the World Wide Web Consortium guidance is taken into account. Offline channels should be offered where appropriate.
• Charity leaders must ensure, when commissioning digital services, that accessibility is a contractual requirement. Contracts should specify compliance with the Web Content Accessibility Guidelines (WCAG) to hold suppliers accountable for delivering accessible solutions.
• Charity leaders must embed accessibility into planning, design, development, and content creation processes. Retrofitting accessibility is costly and less effective, whereas considering accessibility from the start leads to better, more inclusive outcomes.
• Charities should use a mix of testing methods for accessibility, including manual and automated testing. Automated accessibility tools can identify technical compliance issues, but manual testing, including user testing with people with disabilities, will prove essential to uncover real-world barriers that automated tools might miss. Charities should schedule accessibility audits to ensure compliance and improvement. Engaging third-party experts for audits and external reviews ensures an objective assessment and helps maintain high standards.
• Charity leaders should recognise accessibility as an ongoing commitment. Accessibility is not a one-time project but a continuous process of improvement. Training teams, engaging with disabled people for feedback, and keeping up with evolving best practices are crucial to maintaining inclusive services.

Development and iteration

• Charities should respond to users’ changing needs, behaviours, and expectations by factoring data and other insights into improving their activities. This will entail making modifications to products, services, strategy, key messages, fundraising, and other areas of work, creating a cycle of testing, learning, and improving.

3. Culture

Principle

Charities’ values, behaviours, and ways of working should create the right environment for digital success. Key points could include fostering collaboration, embedding inclusivity, encouraging innovation, supporting learning, and building trust and transparency.

Why this matters

The right culture, alongside clear principles and supportive practices, will build the confidence and motivation of staff and volunteers in digital and AI. It will shape their behaviour by increasing collaboration (including between digital and tech teams), creating momentum, breaking down siloes, empowering people, including those from marginalised communities, to share new ideas. It will also encourage the use of data to improve decision-making and enhance transparency.

What success looks like

The people who volunteer or work for charities will be in a better position to collaborate, innovate, and learn additional skills, developing the right mindset for change and innovation, and contributing to how the organisation can achieve its goals through digital and AI. They will focus outwards as much as inwards, horizon scanning, connecting with peers at other organisations, reviewing trends, and understanding how beneficiaries and supporters (including those from marginalised communities) use digital and AI, and how this might change these groups’ expectations of how they interact with charities.

Best practice for large charities

Motivation

• Leaders will need to identify and create the motivation for change and innovation. This must include creating a vision for how digital, tech, data, and AI could help their charity, communicating how they use digital tools to achieve its goals and improve its sustainability, and celebrating and recognising success.
• Staff and volunteers should encourage each other to understand how beneficiaries, supporters, and other stakeholders use digital and how this is changing their behaviour. Being user led should become part of the culture.
• Leaders will need to develop the right mindset for digital and AI among staff and volunteers, such as being open to trying new ideas and encouraging peer learning and collaboration.
• Charity leaders should champion ‘cyber awareness’, ensuring that all staff are aware of the risks of cyber attacks. Incorporating cyber awareness in your charity is the most important step in the prevention of cyber attacks. It provides your staff the necessary knowledge to mitigate many of the risks.

Behaviour change

• Leaders of charities who frequently use digital will need to map and identify the current hallmarks of their culture, understanding the extent of change required to respond to further digital and AI disruption.
• Staff and volunteers should be encouraged to be open about any skills gaps the organisation has in digital and be empowered and supported to progress their personal development.
• Leaders should encourage a culture of safe exploration and iterative learning ensuring that testing rapid prototypes with users is inclusive and reflective of diverse perspectives. This applies to developing products, services, and the use of emerging tech such as AI. Inclusive innovation practices might involve co-designing with marginalised groups, actively addressing biases in AI, and ensuring accessibility. Leaders can support this by creating an AI policy that encourages responsible use while outlining core risks and their appropriate management, such as the dissemination of misinformation, introduction of bias, and privacy violations. And creating spaces where staff and volunteers can share learnings, skills and use cases.
• Charity leaders should develop an appetite for risk. Leaders should identify a level of risk the charity is willing to take in the pursuit of its objectives. The implementation of digital demands a certain degree of risk and charity leaders should ensure associated risks align with a charity’s overall risk appetite.
• Charities could consider how their ways of working and organisational structures can support digital. This could include creating a more flattened structure, where appropriate; developing cross-team working and matrix management; and looking at how to partner collaboratively with suppliers and other partner organisations to increase their capacity.

Ownership

• While strategic initiatives and products should have specific owners within each charity, digital needs to be involved in everyone’s role, from trustees to volunteers. How this is achieved will depend on each charity’s aims and individual roles and responsibilities.

Test, learn, and improve

• Charities need to be open to challenging their established ways of working. They should test assumptions about how beneficiaries, supporters, and other stakeholders use digital, learning from data and improving what they offer as a result.
• To do this successfully, charity staff and volunteers should be encouraged to be curious, share, and try out new ideas and to fail effectively, doing things differently as a result of learning from what works and what doesn’t. Risks involved in innovation should be managed – for example, by piloting new products or services with small groups before wider roll out. Ensuring inclusive testing and iterative learning is key to responsible digital and AI adoption.

Collaboration

• Charity staff and volunteers (including those in digital and tech teams) should take advantage of the opportunities digital offers to collaborate, using online tools or different ways of working, such as an agile approach, and look to normalise cross-functional working using agile principles. Creating a culture of trust and safety will be key to enabling effective collaboration.
• Charities could work with organisations both in and outside the sector on mutually beneficial digital initiatives, e.g. a charity working on a pro-bono partnership with a tech company to develop a digital product that could help their beneficiaries. When selecting partners charities should consider how the partner’s culture aligns with theirs. 
• Where appropriate and compliant, charities could consider sharing digital assets – such as knowledge, data, code, application programming interfaces (APIs) – with other charities or stakeholders who share the same goals and values. They could encourage the reuse of these assets and insights where applicable (e.g. by asking other charities who have more experience with digital and AI to share what they’ve learned).

4. Strategy

Principle

Charities’ strategies should be ambitious about how they can use digital to achieve their vision and mission while being pragmatic about what should be prioritised depending on their resources. 

Why this matters

Charities need a clear vision, purpose, and well-defined approach for how they use digital and AI, all of which will create the motivation for change. By understanding users’ digital needs and how to meet them in a way that is aligned with the charity’s goals, they will be able to improve their organisation’s relevance and sustainability in a rapidly changing world.

What success looks like

Charities will be clear about their strategic direction in digital and AI, enabling them to invest time and other resources more effectively. They will be confident about the role digital and AI play in their value proposition and how this is differentiated from other organisations in the same field, putting the charity in a stronger position for the future.

Best practice for large charities

Organisational strategy

• Charities’ should develop a strategic approach that embeds digital, tech, data, and AI across their work to achieve their charitable purposes, aims, and objectives. Ideally, this will be integrated into the overall organisational strategy but where needed, a standalone digital strategy may serve as a stepping stone while the leadership team builds its digital experience and skills. In either case, digital and AI should be central to the charity’s goals and ways of working, not an add-on, and should include plans to scale and evolve their use over time.
• Prioritisation will be key to achieving strategic goals and digital projects should be evaluated based on their potential impact, alignment with organisational values and resource availability.
• The strategy should be well-structured and have a clear owner who is a leader within the charity and who should have the mandate for change. Roles and responsibilities for delivering the strategy should be identified (ideally at a senior level) and the appropriate accountabilities created.
• Charities should use digital tools that support their vision and mission and increase impact, understanding where digital approaches are and are not the best way to achieve these aims.
• Data on how beneficiaries, supporters, and other stakeholders use digital should be factored into the creation of the strategy and assumptions should be tested where required. Horizon scanning and scenario planning should be used to map how emerging technologies, including generative AI, could change the environment that charities operate in.
• If the charity is large enough to have strategies and plans for different functions (e.g. a fundraising strategy), digital and AI approaches should be embedded within these, ensuring they are integral to achieving organisational goals rather than treated as separate considerations.
• To increase the chances of success, the plans to deliver the strategy should be practical, iterative, adaptable, manageable, and carefully monitored. The strategy should reference how the charity plans to use emerging tech, ensuring that employees feel empowered to learn, use, and explore new technologies.
• The appropriate level of resources will need to be allocated to the plan and the budget monitored. Leaders will also need to ensure time and money are set aside for digital innovation, matching resources with overall strategic ambitions.

Impact

• Charities should consider ways in which digital and AI could potentially increase their impact, such as reaching and supporting more beneficiaries by using digital channels, new generative AI platforms, and new tools and approaches, where relevant. Measurement frameworks should be adapted to reflect the changing technology landscape, ensuring that success is tracked using clear indicators and appropriate evaluation methods.

Approach

• Charities should be ambitious and challenge themselves about what they wish to achieve with digital and AI, while being aware of what they can undertake based on capabilities and resources. Partnerships should be considered to increase innovation, impact, and build capacity and capabilities. 
• Charity leaders should identify and agree on how best to deal with barriers to achieving the strategy. These will be different for every organisation and could range from risk management to how legacy technology systems may be impeding progress.

5. Data

Principle

All charities should understand the potential of data. They should use data to maximise the value of digital whilst simultaneously protecting the information of their stakeholders, employees, volunteers, and beneficiaries. Data should be treated as a strategic asset and the importance of data leadership recognised and actioned. 

Why this matters

Data helps charities to connect with supporters, maximise fundraising, improve service delivery, develop a long-term digital strategy, analyse risk, and streamline processes. But data poses risks, especially around privacy and ethics, so charities need to ensure they collect, process, and store data appropriately.

Strong data leadership at the most senior level is essential for setting the organisation’s culture around data, guiding the development of data skills and practices, and ensuring ethical and responsible data use.

What success looks like

Charities will collect data fairly, transparently, and with the full consent of users. All decision-making will be data-driven and evidence-based. Data flow will be documented, consistent, and automated to the greatest extent possible. They will store data, ensuring constant compliance with all data privacy regulations. They will apply effective data analytics to boost campaigns, improve service delivery, and make data-driven decisions. They will use and combine data to solve their most important problems.

Leaders should champion data leadership, ensuring that the organisation prioritises responsible and effective data use, embeds good data governance, and fosters confidence in data-driven decision-making, resulting in greater impact, transparency, and accountability.

Best practice for large charities

Data collection

• Charities must comply with the latest regulations around the collection and storage of data, particularly with UK GDPR. Leaders should apply “legitimate interest” when appropriate and always ensure all data collection is fair and transparent.
• Charities should apply the Information Commissioner’s Office (ICO) three-part test for legitimate data collection. Assess the purpose of the data you’re collecting, whether the collection of data is necessary, and whether the data stands at odds with the individual’s interests.
• Charities should confirm consent practices and ensure they’re meeting the standards of UK GDPR. Consent requests should be separate from general terms and conditions, and charities should always use clear and straightforward language.
• Charities should always articulate and sustain the value of ‘opting-in’ for supporters to further their communications. ‘Opt-in’ options should be uniform across products and platforms to avoid confusion for the users, always providing an opt-out option that is easy to identify. 
• Charities should give supporters as much flexibility as possible to manage their own permissions.

Data privacy and security

• Charities should only retain necessary information and regularly review and remove any data that no longer serves a specific purpose.
• Leaders should put in place robust security measures where possible, including encryption for data, limiting access to sensitive data, proper authentication mechanisms, and regular security audits. 
• Leaders should create and distribute a clear data privacy policy that outlines how charities collect, store, process, and protect data. Regular data audits can also help to create robust data security practices and monitor any potential vulnerabilities or breaches.
• Charities and charity employees should practice caution when inputting data into AI models. Sensitive data should only be entered if the model does not use that data in an insecure manner (i.e. using it to inform future outputs that become generally or publicly available), violating privacy and undermining user trust.
• Charities should train staff on data management. This ensures that everyone understands the importance of data security and proper handling procedures.
• Charities should regularly review the data held, clean up any outdated or unnecessary data, and ensure that data is backed up to prevent loss. Charities should keep an up-to-date map of their data stack to clarify where all data is held.
• Charities could consider completing Data Impact Assessments .
• Charities could use a centralised database or databases such as customer relationship management (CRMs), volunteer management, and human resource management platforms to store and manage data. This helps in maintaining data integrity, security, and accessibility.

Data analytics

• Charities will likely hold existing data, such as donor, supporter, and attendee data. Leaders should work to understand where that data is held, how to access that data, and how to generate actionable information from that data.
• Leaders should review data, draw conclusions, and make data-driven conclusions. For example, leaders should encourage others to use data to pick the best platforms to invest in digital advertisement by exploring available data on demographics, target audiences, platform usages, potential conversion rates, and so much more. Data analytics therefore can ensure a greater return on investment (ROI) for digital advertisement. Charity leaders should always monitor ROI against their digital strategy.
• Leaders should encourage the use of predictive analytics to better identify trends, target potential donors, reach new audiences, and streamline future processes. Predictive data analytics provides a glimpse into the future, allowing larger charities to identify long-term opportunities and mitigate upcoming risks. However, leaders should recognise that these new techniques may bring new risks (i.e. donor dissatisfaction).
• Generative AI tools could be used to perform analytical tasks, but there are clear associated risks that charities need to understand, mitigate, and manage. Risks include, but are not limited to:
  • Data privacy and security (see above).
  • Bias and unfairness (see principle 7: Risk and ethics).
  • Transparency and explainability: AI models can produce “black box” outputs that make it hard to understand how conclusions were drawn. This can undermine trust and confidence.
  • Dependence on AI: Over-reliance on AI tools can lead to misinformation, errors, and missed opportunities for critical and creative thinking. Maintaining human oversight remains vital.

6. Skills

Principle

Charities should aim for digital and AI skills to be represented at all levels of the organisation. Digital success depends on the confidence, motivation, and attitude of the people who run, work, and volunteer for charities. Technical and soft skills, such as questioning, persuading, and influencing, are equally important.

Why this matters

Everyone who works for a charity, from trustees to volunteers, staff, and partner organisations, all play a fundamental role in helping charities to harness the power of digital.

What success looks like

Leaders will understand the digital and AI skills of their teams. Gaps will be identified and a plan to close and continuously update them should be in place, helping the charity achieve its objectives and attracting, developing, and retaining people with good levels of digital skills.

Best practice for large charities

Skills audit

• Where they have the capacity to do so, charities should measure and map the digital and AI skills they have among their staff, volunteers, and trustees, identifying any gaps and what knowledge, experience, and resources are required to close them. Ideally, this could include both qualitative and quantitative data, such as interviews and gathering statistics (e.g. staff confidence with channels) through a survey. It may also include real-time data analysis where appropriate. The balance of recruitment and existing staff development to achieve desired skills levels for the organisation should be carefully considered.
• The audit should include technical skills (for example, an understanding of generative AI platforms, digital fundraising, computing principles, and analytics) as well as soft skills that assist digital progress, such as collaborative working, innovation, persuading and influencing, coaching and mentoring, and should be applied to all levels of the organisation. The audit should also assess data literacy at all levels—from basic data skills to advanced analytics—ensuring that staff understand how to interpret, manage, and protect data effectively.
• Leaders should ensure employees have basic digital skills or support them to gain basic digital skills. Plenty of resources, often free, can help that skill acquisition.
• Charity leaders should champion ‘cyber awareness’, ensuring all staff are aware of the risks of cyber attacks. Incorporating cyber awareness in your charity is crucial for prevention, equipping your staff with the necessary knowledge to mitigate many of the risks. 
• Recruitment
• Charities may need to think creatively about how they attract staff or volunteers with digital and AI skills (e.g. by developing partnerships with organisations who can source digital volunteers, technology companies, or universities).
• Digital and AI skills should be represented on all charity boards, with the aim of every trustee, whether new or already in post, developing a working knowledge of how digital and AI can increase their charity’s impact.

Skills development

• Staff, volunteers, and trustees should aim to grow their digital and AI skills to help them make better decisions and exercise better oversight. Skills development should be part of leaders’ continuous learning, regularly evaluating progress and broadening their knowledge. This learning could be undertaken in several formal and informal ways, including face-to-face training, mentoring, online courses, advice from colleagues, and learning by doing, such as trying new digital tools.
• Charities should consider how digital skills development can contribute to the confidence, motivation, and satisfaction of staff, volunteers, and trustees, investing in mindset as well as skillset.
• Digital and AI skills should be developed in line with organisational strategy, such as improving impact, understanding beneficiaries’ needs and staff motivation, and increasing productivity and efficiency as well as agility. The Digital and HR/Learning and Development teams should collaborate to enhance the organisation’s digital skills and Communities of Practice should be explored as a valuable method for fostering digital skills.
• Where staff, trustees, and volunteers have high levels of digital skills, they should be challenged further, e.g. by involving them in developing innovative digital projects.
• Charities should remind employees that digital skills development is ongoing and evolving, emphasising the need to improve their skills as specific tech is changed and updated.
• Charity leaders should ensure appropriate upskilling on emerging tech. AI will have an impact on the future of many charities, providing opportunities for streamlining processes, improving service delivery, creating new income streams, and so on. Charities should focus on skills in the short-term, with employees understanding how models work, how to personalise and tailor outputs, prompt engineering, optimisation through feedback, and so on. Upskilling should include elements of safeguarding, ensuring that charities reap the rewards of emerging tech while mitigating core risks.
• Where specialist digital staff or trustees are recruited, charity leaders should be clear on the purpose of the appointment and how this can be supported by the rest of the organisation.

Skills sharing

• Staff, trustees, and volunteers with strong digital and data skills should share learnings and insights with colleagues and other charities.
• Charities should also consider opportunities to maximise digital and data skills sharing within organisations (e.g. through reverse mentoring or informal coaching).
• Charities could consider creative approaches to sharing skills. For example, where they have identified a need for specialist digital skills, they could ask a tech company or a commercial business for volunteers or other forms of pro-bono advice.

7. Risk

Principle

Charities need to determine and manage any risks involved in digital and AI. Charities will need to consider how the adoption of digital and AI aligns with key values such as integrity, inclusivity, accountability, fairness, and transparency. This should include responsible AI adoption and may include anything from the use of data in partnerships to understanding how adopting AI will impact marginalised communities to deciding which social platforms to prioritise. 

Why this matters

Charities need to assess any risks involved in their use of digital and AI and manage them. Working to high ethical standards is important for maintaining trust in stakeholders including beneficiaries, funders and donors. Ultimately, these steps will help maintain public trust and confidence and handle any reputational issues, as well as safeguard the needs of their beneficiaries and their data. Digital technology is evolving rapidly and any organisations who use online tools will need to assess whether they are aligned with their charity’s principles and values.

What success looks like

Charities will be confident and experienced in identifying risks and mitigating them.

Both established and emerging digital technologies offer opportunities to charities to improve sustainability, impact, and income. Charity leaders should manage this by ensuring that they have sufficient skills and knowledge to make informed decisions about ethical issues. They should use technology responsibly, ensuring fairness, inclusivity, and sustainable practices in their operations.

Best practice for large

Managing risk in digital

• Charity leaders and trustees should have the necessary skills and oversight of their charity’s digital activities to determine risk (e.g. when managing data or using social media to manage reputation). This should be aligned with the charity’s risk management policy and process.
• When procuring, charities should practice appropriate due diligence towards suppliers, and legal and commercial advice sought on the terms and conditions of contracts. Any ongoing costs related to the agreement should be understood and evaluated.
• Charity leaders and trustees should periodically review existing systems and processes, understanding what is in place, how they work together, whether they are obtaining value for money, and anticipating and evaluating any risks, such as the ability to keep services secure, up to date, and working as intended.
• When introducing any new digital technology, operational risks should be considered, such as system failures or inaccuracies. Monitoring should be in place to mitigate these risks and plans put in place to ensure continuity in the event of any failures. Charities may require support from someone with good technical skills to help them evaluate risk. This could be a member of staff, a trustee, or a volunteer. Where risk is potentially significant, all possible actions to manage it should be evaluated and a plan put in place to deal with different scenarios.
• Charities should safeguard against risks associated with specific areas of digital. For example, people working in social media might be trained in the prevention of misinformation, privacy and security risks, how to handle personal attacks, and so on. Leaders could establish formal social media policies to address the specific risks.
• Charities should regularly review, monitor, and assess risks related to digital, data, and AI, ensuring these are recorded in the risk register where relevant. When working with third-party suppliers – such as technology providers, AI developers, cloud services, and data processors – charities should evaluate their practices, transparency, and compliance with ethical and legal standards. This includes assessing their approach to data protection, security, bias mitigation, and responsible AI use to ensure alignment with the charity’s values and obligations.
• Charity leaders and trustees should prioritise digital risks focusing on those with highest likelihood and / or most significant impact on beneficiaries and operations.
• Charities should read this principle alongside the Charity Commission guidance on charities and risk management.

Cyber security

• Charities should have a board level awareness of the risks posed to their organisation from cyber attacks and a framework for how to act in the event of a cyber incident. Charities could follow steps from Cyber Security, which will protect them from the most common cyber attacks:
  • Ensure you take regular backups of your important data.
  • Ensure you keep your devices, antivirus and software, including apps, up to date.
  • Ensure any smartphones and tablets are kept up to date and can be remotely wiped.
  • Avoid connecting to unknown Wi-Fi hotspots while away from home or the office.
  • Ensure all devices are password protected and staff know how to set secure passwords.
  • Help staff avoid phishing, ensuring they know how to report something that looks wrong.

Diversity

• Equality, diversity, and inclusion (EDI) enhances innovation, improves creativity, and offers unique perspectives to charities. Leaders should enact effective EDI policies and ensure they remain compliant with all relevant legislation, particularly the Equality Act 2010.
• Charity leaders should emphasise the importance of diversity when conducting user research, developing products, building digital teams, and procuring tech.
• We support the guidance on diversity set out in the Charity Governance Code. Charities should ensure that a diversity of backgrounds, life experiences, career paths and diversity of thinking are represented on their digital teams, digital platforms, and in user research.

Transparency

• Charities should publish how they use data on their websites, annual reports, and other channels.
• Charities should clearly communicate when and how they use AI, whether in generating digital assets (e.g. images, text, or video) or in decision-making processes. This could include disclosing AI use in public communications, adding disclaimers on AI-generated content, explaining AI-assisted decisions that impact beneficiaries or stakeholders, and ensuring accountability by documenting AI-driven processes internally.
• Charities should use digital channels to share their impact and to demonstrate their openness and accountability.

Other ethical considerations

• Charity leaders should drive ethical awareness and ensure ethics are considered in technology adoption.
• The environmental impact of digital strategies should be considered by charity leaders. Reducing this impact through the use of second-hand and refurbished devices, as well as the responsible use of AI, can contribute to sustainability and demonstrate the charity’s commitment to environmental stewardship.
• Charity leaders and staff should understand and plan for how new technologies could change how they work, from crowdfunding to automation, ensuring that they remain relevant to their audience.
• Charities should implement ethical frameworks for digital activities, ensuring activities are fair, privacy is respected, and bias and misinformation are managed.
• Social media has introduced new ethical considerations and leaders should consider their duty to counter misinformation. They should also evaluate the appropriateness of different social media platforms for their content given rising levels of toxicity and potentially damaging advertising appearing alongside it.
• Charities should monitor ethical issues revealed by technological developments to assess whether these fit with their organisational values and what the implications of unintended consequences might be. They will need to understand the implications for their users and the charity’s work and any actions they may need to take as a result. The core risks that charities face include the following:
  • Data breaches on platforms.
  • Bias and misinformation in AI models.
  • Lack of ethical design in emerging tech.
  • Environmental impact of using large language models.
  • Potential breaches of copyright in generative AI.
  • Displacement or changes to human roles.
  • Legal and reputational risks.
• Charity leaders should practice ethical and responsible adoption of emerging tech, particularly AI. That means ensuring values translate into the tools you use, conducting risk assessments, writing policies to bolster effective governance, ensuring accountability remains constantly in place, and regularly testing to monitor ongoing risk and make incremental changes as necessary.

8. Adaptability

Principle

Charities should develop flexible digital strategies that allow them to respond to changes in the digital landscape including advancements in AI, while remaining aligned with their mission and values. This involves anticipating how digital and AI developments can transform their work and regularly revising strategies to leverage opportunities and address emerging challenges.

Why this matters

Organisations who do not consider how they adapt to the digital age will lose relevance and engagement. Users, stakeholders, and donors are increasingly online and expect the same from charities. Technological change is often quick and AI in particular is evolving at an unprecedented pace. Adapting to changes will allow charities to spot opportunities and react to risk quickly.

What success looks like

Charities and their leaders take an agile approach, regularly reviewing the key trends in digital (and the accompanying opportunities and risks) and their data and insights about their audience so that they can continually fine tune and develop their digital activities. They can include insights in wider organisational strategy and planning where necessary.

Best practice for large charities

Improving current practices

• Charities should aim to make their platforms, systems and services accessible to users from as wide a range of devices and locations as is appropriate.
• Charities’ systems should work with each other internally and with external systems.
• Data should be captured through all interactions where appropriate, creating a single customer view that improves services along with stakeholders’ experiences.
• Digital teams should work in close partnership with those responsible for IT infrastructure. We see IT infrastructure as an enabler of digital.

Looking to the future

• Charities should review at consistent intervals how their use of digital benchmarks against relevant organisations working in a similar field, learning from the findings.
• Charities could aim to solve problems they identify by developing new ideas, products and services and testing them, using free and existing digital platforms if resources are limited.
• Charities should develop a “fail fast, fail forward” mentality where they pilot new ideas and learn from failure as well as success. Digital creates opportunities for innovating and testing relatively cheaply.
• Insights from users and wider digital trends should be applied to the charity’s work, creating a process of continuous improvement.
• Charities should regularly evaluate AI developments to identify potential tools or risks and adjust their strategies accordingly.
• Charities should consider the implications of emerging technology, such as virtual and augmented reality and the evolving digital payments landscape, for their business models.

1. Leadership

Principle

Charity leaders, who we define as anyone with a position of significant responsibility in their organisation, must lead digital as a way of helping their charities remain relevant and sustainable. Digital has grown and become embedded in the sector to the point that it needs to be seen as a key element of strategy and governance. Leaders and trustees should work out how digital tools can help them reach their charity’s goals. They should identify how digital, and particularly AI, could change the society in which their charity operates and how their charity should therefore adapt to meet the evolving needs of beneficiaries, supporters, and other stakeholders.

Why this matters

Digital and AI should be part of every charity leader’s skillset as a means to help their organisation achieve its vision and increase its impact. Emerging technologies such as AI are developing rapidly and charity leaders should take an ambitious, forward-thinking approach to how they might adopt them appropriately.

What success looks like

Charity leaders and trustees are able to identify specific ambitions and a clear vision for how digital and AI can help their charities achieve their organisation’s charitable purpose and goals thereby increasing impact. They are also able to execute these plans with confidence.

Best practice for small charities

Governance

• Charity leaders and boards should take charge of planning and using digital tools and AI, rather than leaving it to other staff, suppliers, or volunteers. They should learn more about digital and AI themselves and create an environment where everyone feels confident using these technologies effectively
• Leaders and trustees should lead these changes and encourage their charities to use digital tools and AI in a responsible way to make a bigger impact and avoid risks
• Every charity board should have some digital and AI skills, helping all trustees understand how these tools can help their charity increase its impact
• Trustees need to ensure that are clear plans and rules for using digital tools, including social media and AI, and that everyone knows their role and responsibility
• Leaders should understand how much they need to spend on digital tools to achieve their charity goals (such as a new, mobile-friendly website). They should know what this will achieve for the charity’s cause, if it’s worth the money, and how to measure success
• Leaders should make sure any new technology that they introduce works well with their existing systems, considering this when buying new tools
• Trustees and leaders should take responsibility for cyber security risks and put measures in place to protect their charity’s money, data, supporters, and reputation
• Leaders should decide how much risk their charity is willing to take to achieve its goals. Using digital tools involves some risk, and charity leaders should make sure these risks match the charity’s overall comfort level with risk
• Digital tools can make small charities more efficient and productive. Leaders and boards should look at new ways of working and communicating using digital tools (e.g. collaborating through platforms such as Teams, Slack, and social media platforms, and safely exploring AI tools and models), and seeing how other similar organisations are using them

2. User led

Principle

Charities must focus on the needs and behaviours of beneficiaries and supporters when planning digital activities, ensuring charitable objectives align with needs. This includes addressing the digital needs of those from marginalised communities and helping to bridge the digital divide by ensuring digital tools and initiatives are accessible to everyone.

Why this matters

Planning your charity’s digital activities around the needs of beneficiaries, supporters, and donors, will make them more likely to engage, and increase your charity’s impact. When it comes to digital, being user-led can help address the digital divide, which is important for reducing inequality and promoting inclusivity.

What success looks like

The needs of the people you help and work with, including those from marginalised communities, will be considered in all digital activities from the start. You will use data to test your assumptions and continuously improve your digital services. Charities should focus on reducing barriers to access by providing tools, support, or training to ensure digital initiatives reach everyone. This will help create a more inclusive and impactful charity.

Best practice for small charities

Understanding audiences

• Use insights and data about what the charity’s beneficiaries, supporters, potential supporters, and other stakeholders, want and need to plan your digital activities
• Map the journeys of typical beneficiaries, supporters, and other stakeholders, to help plan your services
• Consider the digital needs of your staff when planning internal digital activities, e.g. a new intranet
• Manage risks in innovation by testing new services with small groups before a wider roll out
• Assess user needs when buying tech. Set clear specifications and research vendors to ensure their offerings meet your needs. Consider all costs, including maintenance, training, upgrades, and other hidden costs

Digital inclusion

• Follow the principles of digital inclusion by understanding the digital skills and access of your beneficiaries, supporters, and other stakeholders. That includes their access to the internet, and any assistive technology they need. Offer alternatives for those who are not online

Accessibility

• Consider the needs of users who are digitally excluded, including those in vulnerable circumstances. Ensure your digital services meet accessibility requirements and regulations, such as the European Accessibility Act, and that the World Wide Web Consortium guidance is taken into account. Offer offline channels where appropriate
• Make accessibility a requirement when commissioning digital services. Contracts should specify compliance with the Web Content Accessibility Guidelines (WCAG)
• Embed accessibility into planning, design, development, and content creation processes from the start
• Schedule regular accessibility audits to ensure compliance and improvement. Engage third-party experts for objective assessments
• Recognise accessibility as an ongoing commitment. Train your teams, engage with people who have disabilities for feedback, and keep up with best practice to maintain inclusive services

3. Culture

Principle

Charities should create a positive environment that supports digital success through their values, actions, and ways of working. This includes working together, being inclusive, encouraging new ideas, supporting learning, and building trust and openness.

Why this matters

Having the right culture, with clear principles and supportive practices, will build the confidence and motivation of staff and volunteers in using digital tools and AI. It will encourage teamwork, create momentum, break down barriers, and empower everyone – including those from marginalised communities – to share new ideas. It will also promote the use of data to make better decisions and enhance openness.

What success looks like

Volunteers and staff will be better able to work together, come up with new ideas, and learn new skills. They will develop a mindset that embraces change and innovation, helping the charity achieve its goals through digital tools and AI. They will look both inside and outside the organisation, connecting with peers at other organisations, reviewing trends, and understanding how beneficiaries and supporters (including those from marginalised communities) use digital tools and AI. They will consider how user experiences might change their expectations of charities.

Best practice for small charities

Motivation

• Leaders should inspire change and innovation by creating a vision for how digital tools, technology, data, and AI can help their charity. They should communicate how these tools can help the charity to achieve its goals, improve its sustainability, and recognise success
• Leaders should encourage staff and volunteers to be open to new ideas and support peer learning and teamwork. Focusing on the needs of users should become part of the charity’s culture
• Charity leaders should promote cyber awareness, by making sure all staff know about the risks of cyber-attacks. Teaching staff about cyber security is crucial for preventing attacks and protecting the charity

Behaviour change

• Small charities starting with digital can take small steps and learn as they go with online tools. For example, running a workshop to see how staff and volunteers use digital in their personal lives and how they can use those skills in their roles
• Leaders should promote a culture of safe exploration and continuous learning. This means testing new ideas with users and making sure everyone’s views are included, both when developing services and using new technologies like AI
• Inclusive practices might involve working with marginalised groups, addressing biases in AI, and ensuring accessibility
• Leaders can support this by creating an AI policy that encourages responsible use and outlines how to manage risks like misinformation, bias, and privacy issues
• Leaders should also create spaces where staff and volunteers can share their learnings, skills and examples of how they use digital tools

Ownership

• Each charity should have specific people responsible for key projects and service developments, but everyone from trustees to volunteers should be involved in using digital tools. How this is done will depend on the charity’s goals and the roles of each person

Collaboration

• Charity staff and volunteers, including those with tech and digital skills, should use digital tools to work together. They can try different ways of working, like flexible and iterative methods. Building a culture of trust and safety is important for effective teamwork
• Charities can work with organisations inside and outside their sector on digital projects that benefit both parties. For example, a charity could partner with a tech company to develop a digital tool for their beneficiaries. When choosing partners, charities should ensure their values and culture align

4. Strategy

Principle

Charities should be ambitious with their digital plans but also be realistic about what they can do with the resources they have.

Why this matters

Charities need a clear vision and plan for using digital tools and AI. This will motivate change and help them understand and meet the digital needs of their users, making the charity more relevant and sustainable in a fast-changing world.

What success looks like

Charities will have a clear plan for using digital tools and AI, allowing them to use their time and resources more effectively. They will understand how digital and AI add value to their work and how this sets them apart from other organisations, putting them in a stronger position for the future.

Best practice for small charities

Organisational strategy

• Charities should use digital tools that help them achieve their goals and make a bigger impact. They should understand when digital approaches are the best way to achieve these aims and when they are not
• Charities could create a plan that includes digital tools, including data and AI, to help achieve their goals. Ideally, this plan should be part of the overall organisational strategy but if needed, a separate digital plan can be a good starting point while the leadership team gains more digital experience and skills. In any case, digital should be a core part of the charity’s goals and operations, not just an extra
• Prioritising tasks is essential for achieving goals. Digital projects should be evaluated based on their potential impact, how well they align with the charities’ values and the resources available
• Identify who is responsible for delivering the plan, ideally at a senior level, and make sure they are accountable
• To increase the chances of success, plans should be practical, manageable, flexible, and carefully monitored, with appropriate resources allocated. They should explain how the charity intends to use new technologies, ensuring that employees and volunteers feel empowered to learn, use, and safely explore them

Impact

• Charities should explore how digital tools can increase their impact, such as reaching and supporting more beneficiaries by using digital channels and using new generative AI platforms. They should update their measurement methods to keep up with technological changes, using clear indicators to track success
• While generative AI can be beneficial, charity leaders should also explore other types of AI. Extractive AI and predictive AI can help improve the way you use data to support decision-making, and AI automation can free up time otherwise spent on repetitive tasks. Charities should review their current tools, many of which use AI, and see how they can make improvements

Approach

• Charities should aim high and challenge themselves about what they want to achieve using digital tools, while being realistic about their capabilities and resources. They should consider partnerships to boost innovation, support impact, and build capacity and capabilities
• Charity leaders should identify and agree on how to overcome barriers to achieving their plans. These barriers will vary for each organisation and could include issues like risk management or outdated technology systems

5. Data

Principle

All charities should understand the potential of data. They should use data to maximise the value of the charity to beneficiaries and should protect the information of all stakeholders when using data. Data should be treated as a valuable resource, and leaders should plan its use and management appropriately.

Why this matters

Data helps charities to connect with supporters, maximise fundraising, improve service delivery, develop long-term digital plans, analyse risk, and streamline processes. But data poses risks, especially around privacy and ethics, so charities need to ensure they collect, process, and store data appropriately.

Taking responsibility for data at the most senior level is essential for setting the organisation’s culture around data, guiding the development of data skills and practices, and ensuring ethical and responsible data use.

What success looks like

Charities will collect data fairly, openly, and with the full consent of users. All decisions will be based on data and evidence. Movements of data flow will be documented, consistent, and automated where possible. Data storage will comply with all data privacy regulations. Effective data analytics will be used to boost campaigns, improve service delivery, and support decision making. Charities will use and combine data to solve their most important problems.

Leaders should champion data management, ensuring that the organisation prioritises responsible and effective data use, embeds good data practices, and fosters confidence in using data in decision-making, resulting in greater impact, openness, and accountability.

Best practice for small charities

Data collection

• Charities must comply with the latest regulations around the collection and storage of data, particularly with UK GDPR. Leaders should apply “legitimate interest” when appropriate, ensuring collected data is relevant and accurate, and the data collection is fair and open
• Charities should always clearly communicate and maintain the value of “opting-in” for supporters to enhance their communications. “Opt-in” options should be consistent across all platforms to avoid user confusion, and there should always be an easy-to-identify opt-out option
• Charities should give supporters as much flexibility as possible to manage their own permissions

Data privacy and security

•  
• Charities should only retain necessary information and regularly review and remove data that no longer serves a specific purpose
• Leaders should put in place robust security measures where possible, including data encryption, limiting access to sensitive data, proper authentication mechanisms, and regular security audits
• Charities, charity employees, and volunteers should practice caution when inputting data into AI models. Sensitive data should only be entered if the model does not use that data in an insecure manner (i.e. using it to inform future outputs which become generally or publicly available) as this could violate privacy and undermine trust in the charity
• Charities should train staff and volunteers on data management. This ensures that everyone understands the importance of data security and proper handling procedures
• Charities could consider completing Data Impact Assessments

Data management

• Charities should regularly review the data held, clean up any outdated or unnecessary data, and ensure that data is backed up to prevent loss
• Charities could use a centralised database or databases such as customer relationship management systems (also known as CRMs), volunteer management, and human resource management platforms to store and manage data. This helps maintain data integrity, security, and accessibility

Data analytics

• Charities will likely hold existing data, such as donor, supporter, and attendee data. Leaders should work to understand where that data is held, how to access it, and how to generate actionable insights from it
• Leaders should review data, draw insights, and make decisions based on it. For example, leaders should encourage charity staff and volunteers to use data to pick the best digital advertisement platforms by exploring available data on demographics, target audiences, platform usages, and potential conversion rates. Data analytics therefore can ensure a greater return on investment (ROI) for digital advertisement. Charity leaders should always monitor ROI against their digital plans
• Leaders should encourage the use of predictive data analytics to better identify trends, target potential donors, reach new audiences, and simplify processes. Predictive data analytics provides a glimpse into the future, allowing charities to identify long-term opportunities and address upcoming risks. However, leaders should recognise that these new techniques may bring new risks (i.e. donor dissatisfaction)
• Generative AI tools could be used to perform analytical tasks, but there are clearly associated risks that charities need to understand, mitigate, and manage. Risks include, but are not limited to:
  • Data privacy and security (see above)
  • Bias and unfairness (see principle 7: Risk)
  • Transparency and explainability: AI models can produce “black box” outputs that make it hard to understand how conclusions were drawn, which can undermine trust and confidence
  • Dependence on AI: Over-reliance on AI tools can lead to misinformation, errors, and missed opportunities for critical and creative thinking. Maintaining human oversight remains vital

6. Skills

Principle

Charities should encourage digital and AI skills among team members so everyone can help with decisions, planning, and daily work. Digital success depends on the confidence, motivation, and attitude of the people who run, work, and volunteer for charities. Soft skills, such as questioning, persuading, and influencing, are equally important to technical skills.

Why this matters

Everyone who works for a charity, from trustees to volunteers, staff, and partner organisations, all play a fundamental role in helping charities to harness the power of digital.

What success looks like

Leaders should understand the digital and AI skills of their teams. They should identify any gaps and have a plan to close and continuously update these skills. This approach will help the charity achieve its objectives and attract, develop, and retain people with strong digital skills.

Best practice for small charities

Understanding their skills

• Charities should understand and confidently state the digital and AI abilities of staff, volunteers, and trustees (e.g. “our staff are proficient with managing data”). They should also understand where gaps exist and support their team in closing them, through mentoring, training, and other ways of learning. Additionally, charities should carefully balance recruitment and the development of existing staff to achieve the desired skills levels for the organisation
• Leaders should ensure employees and volunteers have basic digital skills or support them in acquiring them. There are plenty of resources, often free, that can help with this skill acquisition
• Leaders should champion cyber awareness and ensure that staff and volunteers are trained in cyber security. Charity staff should take advantage of the free resources available for training, especially those made available by the National Cyber Security Centre (NCSC)
• Charity leaders should ensure appropriate upskilling on emerging technologies. AI will significantly impact the future of many charities, providing opportunities to simplify processes, improve service delivery, create new income streams, and more. Charities should focus on developing skills in the short-term, with employees and volunteers developing AI skills in relation to the goals of their work, such as understanding how AI models work, how to conduct prompt engineering, and how to personalise and tailor outputs for use. . Any upskilling should include elements of safeguarding, to ensure that charities reap the rewards of emerging tech while addressing core risks

Recruitment

• Charities may need to think creatively about how they attract staff or volunteers with digital and AI skills. They could do so, for example, by developing partnerships with local technology companies or working with local Tech for Good networks
• Skills development
• Digital skills should be developed in line with the benefits for the charity, such as improving impact, understanding beneficiaries’ needs, enhancing staff motivation, and increasing productivity and efficiency (e.g. using online tools to edit a shared document easily). Where recruiting specialist digital staff or trustees, charity leaders should be clear on the purpose of the appointment and how this can be supported by the rest of the organisation
• Charities should remind employees that digital skills development is ongoing and evolving, emphasising the need to continuously improve their skills as technology changes and updates

Skills sharing

• Charities should consider opportunities to maximise digital and data skills sharing within organisations, such as through reverse mentoring or informal coaching. They could also consider creative approaches to sharing skills. For example, if a need for specialist digital skills is identified, charities could ask a tech company or a commercial business for volunteers or other forms of pro-bono advice

7. Risk

Principle

Charities need to identify and manage any risks involved in digital tools. They should ensure that adopting digital tools, such as AI, aligns with key values such as integrity, inclusivity, accountability, fairness, and openness. This includes using AI responsibly and considering areas such as the use of data in partnerships, understanding how adopting AI will impact marginalised communities, and deciding which social platforms to prioritise.

Why this matters

Charities need to identify and manage any risks involved in using digital tools. It’s important to work to high ethical standards to maintain trust with stakeholders including beneficiaries, funders, and donors. This will help maintain public trust and confidence, handle any reputational issues, and protect the needs and data of beneficiaries. As digital technology is evolving rapidly, organisations who use online tools need to check to ensure they align with their charity’s principles and values.

What success looks like

Charities will be confident and experienced in identifying and managing risks. Both established and new digital technologies offer opportunities for charities to improve impact, sustainability, and income. Charity leaders should ensure they have the skills and knowledge to make informed decisions about ethical issues and use technology responsibly. This means ensuring fairness, inclusivity, and sustainable practices in their operations.

Best practice for small charities

Managing risk in digital

• Charity leaders and trustees should have the skills and oversight needed to manage their charity’s digital activities and identify risks. This includes managing data or using social media to manage the charity’s reputation. These actions should be aligned with the charity’s risk management policy and process
• When buying technology, charities should carefully check suppliers and seek legal and commercial advice on contract terms and conditions
• Charity leaders and trustees should regularly review existing systems and processes. They need to understand what is in place, how these systems work together, and whether they are good value for money. They should also anticipate and evaluate any risks, such as keeping services secure, up to date, and working as intended
• Charities may require support from someone with good technical skills to help them evaluate risks. This could be a member of staff, a trustee, or a volunteer. If the risk is significant, all possible actions to manage it should be evaluated and a plan put in place to handle different scenarios
• Charities should protect against risks in specific areas of digital. For example, people working in social media might be trained in the prevention of misinformation, privacy and security risk, how to handle personal attacks, and so on
• When introducing any new digital technology, operational risks should be considered, such as system failures or inaccuracies. Monitoring should be in place to manage these risks and plans made to ensure business continuity if any failures occur
• Charities should regularly review, monitor, and assess risks related to digital, data, and AI, and record in the risk register when relevant. When working with third-party suppliers – such as technology providers, AI developers, cloud services, and data processors – charities should evaluate their practices, openness, and compliance with ethical and legal standards. This includes assessing their approach to data protection, security, bias mitigation, and responsible AI use to ensure they align with the charity’s values and obligations
• Charity leaders and trustees should prioritise digital risks focusing on those that are most likely to happen or have the biggest impact on beneficiaries and operations
• Charities should read this principle alongside the Charity Commission guidance on charities and risk management

Cyber security

• Charities should ensure their board is aware of the risks posed by cyber-attacks and have a plan for how to act in the event of a cyber incident. They can follow steps taken from Cyber Security: Small Charity Guide, to protect against common cyber attacks:
  • Regularly backup important data
  • Keep devices, antivirus, and software, including apps, up to date
  • Ensure smartphones and tablets are kept up to date and can be remotely wiped
  • Avoid connecting to unknown Wi-Fi hotspots while away from home or the office
  • Make sure all devices are password protected and staff know how to set secure passwords
  • Train staff to avoid phishing, and ensure they know how to report something that looks suspicious

Diversity

• Equality, diversity, and inclusion (EDI) enhances innovation, improves creativity, and offers unique perspectives to charities. Leaders should implement effective EDI policies and ensure they comply with all relevant laws, particularly the Equality Act 2010
• Charity leaders should emphasise the importance of diversity when conducting user research, developing new services, building digital teams, and buying technology
• We support the guidance on diversity set out in the Charity Governance Code. Charities should ensure that digital teams, digital platforms, and user research include people with diverse backgrounds, life experiences, career paths, and ways of thinking

Transparency

• Charities should publish how they use data on their websites, annual reports, and other channels
• Charities should clearly communicate when and how they use AI, whether in creating digital assets (e.g. images, text, or video),in making decisions, or in other uses. This could include disclosing AI use in public communications, adding disclaimers on AI-generated content, explaining AI-assisted decisions that impact beneficiaries or other stakeholders, and ensuring accountability by documenting AI-driven processes internally
• Charities should use digital channels to share their impact and to demonstrate their openness and accountability

Other ethical considerations

• Charity leaders should promote ethical awareness and ensure that ethics are considered when adopting new technology
• The environmental impact of digital activities and plans should be considered by charity leaders. Using second-hand and refurbished devices, as well as responsibly using AI, are two ways to reduce this impact. This shows the charity’s commitment to sustainability and environmental stewardship
• Charity leaders and staff should understand and plan for how new technologies could change how they work, from crowdfunding to automation. This will help them stay relevant to their audience. Charities should implement ethical frameworks for digital activities, ensuring activities are fair, privacy is respected, and bias and misinformation are managed
• Social media has introduced new ethical considerations and leaders should consider their duty to counter misinformation. They should also evaluate whether different social media platforms are appropriate for their content, with some containing greater toxicity and potentially harmful advertising that can appear alongside charity content
• Charities should monitor ethical issues that arise with new technologies to see if they fit with their organisational values and understand the possible unintended consequences. They will need to know how these issues affect their users and the charity’s work and what actions they might need to take. The main risks that charities face include:
  • Data breaches on particular platforms
  • Bias and misinformation in AI models
  • Lack of ethical design in new technologies
  • Environmental impact of using large language models
  • Potential breaches of copyright by generative AI
  • Displacement or changes to human roles
  • Legal and reputational risks
• Charity leaders should practice ethical and responsible adoption of emerging tech, particularly AI. This means ensuring that the charity’s values are reflected in the tools used, conducting risk assessments when needed, and writing policies to guide effective management

8. Adaptability

Principle

Charities should develop flexible digital plans that allow them to respond to changes in the digital landscape, including advancements in AI, while staying true to their charitable objectives and values. This means anticipating how digital and AI developments can transform their work and regularly updating plans to take advantage of new opportunities and address emerging challenges.

Why this matters

Organisations who do not consider how they adapt to the digital age will lose relevance and engagement. Users, stakeholders, and donors are increasingly online and expect the same from charities. Technological change happens quickly, especially with AI evolving at an unprecedented pace. Adapting to these changes will help charities spot opportunities and react to risk quickly.

What success looks like

Charities and their leaders use a flexible approach, regularly looking at the latest digital trends (and the accompanying opportunities and risks) and their audience data to improve their digital activities. They include insights in their wider organisational strategy and planning where necessary.

Best practice for small charities

Improving current practices

• Charities should aim to make their platforms, systems, and services accessible to users from as wide a range of devices and locations as is appropriate
• Charities’ systems should work with each other internally and with external systems
• Data should be captured through all interactions where appropriate, creating a single user/donor view that improves services along with user experiences
• Anyone working with digital services or tools should work in close partnership with those responsible for IT infrastructure. We see IT infrastructure as an enabler of digital

Looking to the future

• Charities should regularly compare their digital use with similar organisations and learn from the findings
• Charities can solve new problems by developing and testing new ideas and services, using free and existing digital platforms if resources are limited
• Charities should pilot new ideas and learn quickly from both failures and successes (known as a “fail fast, fail forward” mentality). Digital tools make it easier to and cheaper to innovate and test
• Insights from users and wider digital trends should be regularly applied to the charity’s work, creating a process of continuous improvement
• Charities should regularly assess AI developments to find potential tools or risks and adjust their plans accordingly
• Charities should think about how new technologies such as virtual and augmented reality and changes in digital payments could affect their business models