We talk to Andy Gordon, Head of Design and Innovation at Torchbox, about the growing adoption of AI policies in the sector and the development of Torchbox’s Charity AI Policy Builder, supporting charities at different stages of AI maturity.
1. What trends have you seen in charity AI policy development over the last year?
One of the biggest shifts has been a growing recognition that AI is not one thing. Over the last year, charities have become much more sophisticated in how they talk about it, moving away from broad, catch-all language and towards clearer distinctions between deterministic systems, probabilistic systems like large language models (LLMs), and now increasingly agentic AI.
Broadly, we’ve seen two camps emerge. One is still focused on high levels of control, risk reduction and setting clear guardrails around use. The other is beginning to think more proactively about enablement and how to create policies that not only reduce risk or harm but also help teams proactively use AI responsibly and confidently in practice.
The latter is more effort, but it is where we are seeing the most progress.
We’re also seeing a much stronger focus on embedding policy into the organisation itself, rather than treating it as a standalone document. Art Fund, for example, has done a great job of integrating AI policy thinking into areas like onboarding, while in our work with the Disasters Emergency Committee (DEC) we’re looking at how these principles can be built directly into tools and systems, so teams are actively using them as part of day-to-day workflows.
More generally, there’s now much greater acceptance that the landscape is moving quickly and it’s not slowing down. That means organisations need principles that are stable enough to guide decision making, but policies that are reviewed and revisited more regularly than they might have been in the past.
How often that happens will depend partly on an organisation’s own maturity and adoption, but also on how quickly the wider landscape shifts around them.
2. What led you and the Torchbox team to set up the Charity AI Policy Builder?
We’ve learned a huge amount over the last three years. Both through our own internal adoption journey and from supporting charities at very different stages of AI maturity. We won’t pretend we’ve got everything right either; we’ve definitely got things wrong along the way, but that’s been an important part of innovation and learning and has shaped what we do next.
As an employee-owned organisation, we felt a strong responsibility to give something back and share those learnings more openly.
One of the clearest signals came from the Charity Digital Skills Report, which highlighted a real gap in AI preparedness and policies. Larger charities were more likely to have some form of policy in place, although the quality and maturity varied significantly. Smaller and medium-sized organisations, meanwhile, often had far less in place, despite facing many of the same questions, challenges and risks.
That made it clear there was both a need and an opportunity to open up what we’d learned, rather than keeping it locked inside individual projects or only accessible to those with more resources.
The Policy Builder actually started as an internal experiment to assist us with our own AI work with clients, but it’s evolved into something much more collaborative and hopefully valuable for other charities. It’s designed to help charities of all sizes get started; using AI as an enabler, but with a strong emphasis on human-in-the-loop thinking and the conversations that need to sit around it.
For example, organisations like Women’s Aid have used the tool to generate a starting point, which they refined internally and have put this to practice. That’s exactly how we see it being used; not as a finished product, but as a catalyst.
For some charities, it’s a first step towards formalising their thinking. For others, it helps strengthen and evolve what they already have. In both cases, the aim is to make responsible AI adoption feel more achievable, practical and grounded in the realities charities are actually facing.
It’s not a finely tuned finished product, we see it as a living tool and that’s intentional. We’ll keep evolving it as the landscape changes and as we get feedback from those using it.
3. How did you develop the Policy Builder? What did you learn along the way?
We developed the Policy Builder by drawing on a wide range of perspectives and practical experience. We crowdsourced insight from organisations including the RSPCA, DEC, Art Fund and many others, and looked closely at the kinds of questions, concerns and approaches emerging across the sector.
We also reviewed a lot of existing best practices both within charities, wider legal frameworks and more broadly to understand what actually makes a policy useful in the real world, not just something that looks good on paper.
One of the biggest things we learned is that charities need something practical, not overly abstract. A policy has to be clear enough to guide decisions, but flexible enough to work across different teams, use cases and levels of digital maturity. Tone matters too; if something feels too legalistic or restrictive, people are far less likely to engage with it. The strongest approaches tend to balance principles, guardrails and real-world usability.
Another key learning is that policy development works best when it’s not done in isolation. Bringing together perspectives from different organisations helped us create something more grounded, adaptable and relevant to the sector as a whole.
From a technical point of view, the builder is currently powered by OpenAI, which has also been a useful learning opportunity for us. Given how quickly the landscape is shifting, and some of the recent changes in the space, we’re actively exploring how we reduce dependency on any single provider. That’s part of a broader focus for us around avoiding vendor lock-in and making sure we can plug and play different models over time.
In that sense, the tool itself has also been a way for us to learn, not just about policy, but about how you build responsibly and flexibly with AI in a fast-moving ecosystem.
4. As more charities adopt agentic AI and other new AI developments, how will they need to develop their policies?
That’s a really important question, and one we’re taking very seriously.
As charities begin to explore agentic AI, policies will need to evolve beyond questions of content generation alone and start dealing more explicitly with autonomy, explainability, oversight and accountability. A major issue here is explainability: when an AI system is taking actions, making decisions or interacting across tools and workflows, organisations need to understand what it is doing, why and within what limits.
Risk tolerance also becomes much more important. Different charities will have very different thresholds depending on the context. Using an agent to help summarise internal notes is very different from allowing one to trigger actions, contact service users or make recommendations in higher-stakes environments. Policies will need to reflect those differences clearly.
I believe we’ll also see a stronger shift towards tiered governance models, where different types of AI use are subject to different levels of scrutiny, approval and human oversight.
In other words, policies will need to become more nuanced: not just asking ‘Can we use AI?’ but ‘What kind of AI, for what purpose, with what safeguards, and with whose oversight?’
5. Do you think charity governance needs to evolve to create better oversight for AI? If so, how?
Yes, I do. A big part of this is leadership and board-level understanding. In many organisations, governance hasn’t yet caught up with the pace of change in AI, and that can create a gap between adoption on the ground and oversight at the top. If boards and senior leaders don’t have enough confidence or literacy in this area, it becomes much harder to provide meaningful challenges, set appropriate risk appetite or make informed decisions.
So, I do think governance needs to evolve, not necessarily by creating entirely new structures in every case, but by strengthening existing ones too. That could mean improving board literacy around AI, making AI a clearer part of risk and audit conversations, and ensuring there is visible ownership at senior level for how these technologies are being used.
It also means moving beyond compliance alone. Good governance should help charities ask better questions: where could AI create value, where are the risks highest, what should always involve human judgement, and how do we make sure use stays aligned with our mission and values?
Ultimately, better oversight is not about slowing innovation down. It’s about creating the confidence, clarity and accountability needed to use AI well.