AI Governance is AI Strategy. What does this actually mean.

9 June 2026 By J Cromack

Curia AI | AI Governance Advisory | Insights & Perspectives

The pattern the evidence describes is one of widespread AI adoption without strategic governance. Charities experimenting with AI at pace, but without the data foundations, decision policies, or accountability structures to do so safely. The organisations that treat governance as a precondition for AI adoption, rather than a constraint on it, will be the ones that unlock sustainable value from the technology while protecting the donor trust on which their missions depend.

The numbers that should concern every trustee and charity leader

The Charity Digital Skills Report 2025 found that 76% of UK charities now use AI tools, up from 61% the previous year. In the same period, the proportion of charities with a digital strategy has fallen from 50% to 44%. Over a third report that their CEO lacks AI skills, and 44% rate board AI knowledge as poor. Those statistics, taken together, describe an acceleration without direction.

This is not a challenge unique to the charity sector. Microsoft’s enterprise research found that 80% of business leaders report concerns about data leakage from AI tools their staff are already using without approval. When even the organisations with the largest technology budgets and dedicated compliance teams struggle to keep pace, it is not surprising that charities, typically resource-constrained, face the same challenges without the same infrastructure to absorb them. Gartner predicts that through 2026, organisations will abandon 60% of AI projects unsupported by AI-ready data. These are not charity-specific statistics, but they describe exactly the trajectory the sector is on.

Why governance and strategy are the same thing

There is a persistent temptation to treat AI governance as the responsible-but-boring counterpart to AI strategy: the thing you do after the exciting decisions have been made, to make sure nothing goes wrong. This framing is wrong, and it is expensive. An AI system built on poorly governed data will produce unreliable outputs regardless of how sophisticated the model is. AI deployed on untrusted data does not improve decision-making; it automates confusion at scale.

AI governance is not a separate initiative from AI strategy. It is AI strategy. The charities that recognise this earliest will be the ones that move fastest, most safely, and with the greatest confidence from their boards, their regulators, and their supporters.

The distinction between data governance and AI governance is conceptually useful but practically inseparable. Data governance protects the inputs: it ensures data is accurate, complete, appropriately permissioned, and properly owned. AI governance protects the outcomes: it ensures that the decisions and actions produced by AI systems are fair, explainable, accountable, and aligned with organisational values. Both are essential. Neither works without the other. For charities, the path to safe, effective AI adoption begins with data governance, not as a separate preparatory phase but as the foundational layer of a unified governance strategy that extends upward into AI deployment and oversight.

The structural bottleneck charities cannot ignore

Charities operate under a unique governance model. Trustees carry ultimate fiduciary and legal responsibility for the organisation, yet they are typically volunteers with limited exposure to data strategy or AI. The Director of Fundraising, CTO or CEO may champion technology adoption but cannot authorise it without trustee confidence. The result is a structural bottleneck in which the people who must approve AI adoption are often the least equipped to evaluate its risks and benefits.

Compounding this, charities handle some of the most sensitive personal data of any sector: supporter records, donation histories, legacy intentions, safeguarding information, and beneficiary data, all of which carry significant privacy and ethical weight. The Fundraising Regulator’s AI guidance, published December 2025, the ICO’s ongoing guidance on AI and automated decision-making, and the Data Use and Access Act 2025 (which introduced the charitable purpose soft opt-in from February 2026) all create a compliance landscape that demands structured data governance as a foundation for any AI deployment.

Most UK charities sit below the governance threshold when it comes to fundraising. Their data landscape typically features a CRM, a finance system, a legacy database, an events platform, and several campaign-specific tools, each holding a partial view of the supporter. Reports conflict, teams maintain their own spreadsheets, and nobody trusts the dashboards. This is not a technology problem. The data exists. But without clear ownership, agreed definitions, quality standards, and accountability structures, it cannot be trusted.

What trustees need to be able to answer

Trustees do not need to understand the technical architecture of AI systems. What they do need is confidence that the organisation can answer four questions clearly, and where those answers are not yet available, a plan to make them so.

The four questions every charity board trustee should be asking

What are we using AI for, and what decisions is it making or influencing?
Can we trust the data going into these systems, and can we explain the outputs coming out?
Who is accountable if something goes wrong, and what is the escalation path?
Are we compliant with regulatory requirements and aligned with our values as a charity?

Where those questions cannot be answered clearly today, the organisation is not yet ready for AI. That is not a reason to delay; it is a reason to invest in the governance foundations that will make confident answers possible.

Transparency as a legal obligation and a trust asset

There is a distinction worth drawing between two kinds of transparency. The first is operational transparency: whether the people inside an organisation can see and understand what AI systems are doing and why. This is the transparency that internal governance frameworks address. It is necessary, though not sufficient on its own.

The second is relational transparency: whether the people affected by AI-influenced decisions can understand what happened and why, and whether they have a meaningful route to challenge it. GDPR Article 22 and the EU AI Act both establish that this external transparency is a legal obligation, not a discretionary gesture. Where AI influences a decision about an individual, that individual has rights: to know, to understand, and to contest.

For charities, this obligation carries particular weight. Beneficiaries, donors, and grant applicants extend trust on the assumption that decisions about them are made fairly, with care, and with accountability. Where AI influences those decisions, a scoring model that ranks beneficiaries, a tool that prioritises donor outreach, a system that assesses grant applications, the relational contract is at stake. Compliance sets the floor, but donor and beneficiary trust is what charities are built on, and good governance is what protects it.

The regulatory moment that rewards the prepared

The Data Use and Access Act 2025 represents a significant expansion of charities’ ability to communicate with supporters electronically. The charitable purpose soft opt-in, in force from 5 February 2026, allows charities to send direct marketing to supporters who have expressed interest or offered support, without requiring prior explicit consent, provided the communication solely furthers the charity’s purposes and a clear opt-out is offered.

But this opportunity is conditional. It only applies to contacts whose details were collected under circumstances that meet the new requirements. Charities must be able to demonstrate how contact details were collected, whether opt-out was offered, and that ongoing communications meet the statutory conditions. This is, at its core, a data governance requirement. Charities that cannot evidence the provenance and permissible status of their supporter data will be unable to take advantage of it. Those that can will gain a significant advantage in supporter engagement and fundraising effectiveness.

Governance is how you move faster

The instinct to treat governance as a brake on innovation and ambition is understandable but wrong. Good governance removes friction. It provides guardrails rather than gates, makes clear what is allowed so teams do not waste time in ambiguity, creates faster approvals because criteria are defined, reduces rework because quality standards are agreed, and enables pilots to scale because the accountability structures are already in place.

For UK charities navigating the AI transition, the choice is not between governance and innovation. It is between governed AI adoption that protects beneficiaries and donors, satisfies regulators, and builds sustainable capability, or ungoverned experimentation that puts mission, reputation, and income at risk. Governance is not the price of compliance. It is the architecture of trust.