The short answer
Yes, and it fits on one page. If your staff use AI tools, and in most organisations they already do, you have a policy: it is unwritten, and it is different for every person. Write down four things. What AI is for here. What it is never used for. What never goes into a public tool. Who checks the output before it leaves the building. Name the person to ask when someone is unsure. Everything else can wait.
The longer answer
The gap between use and governance is widest in small organisations. The 2026 Charity Digital Skills Report found that 79 per cent of charities are using AI tools in some way, while 18 per cent have a formal policy and 51 per cent have none, rising to 62 per cent of small charities. Only 7 per cent review AI use and its risks regularly at board level. The pattern in the report is the one we see in practice: some staff use the tools every day, others hold back, and neither group has an organisational position to stand on.
An engagement we began in September shows how that plays out. A small international charity, a team of about a dozen, had three tools in informal use across fundraising, communications and programmes, and no agreed position on any of it. The team had already found three uses that worked, first drafts of trust applications, research on prospective corporate partners and award entries. The organisation was past the question of whether to use AI. It needed to agree how.
What we are writing with them is a one-page note in plain English, agreed by the whole team rather than issued to it. It says what AI is for in that organisation and what it is never used for. It draws the data line where a small charity needs it drawn: donor personal data, unpublished financial information and anything sensitive never go into a consumer tool, and the habit that makes the rule stick is to treat a free chatbot as a public space. It says that a transcript is a draft until someone who was in the room has checked it, and that a generated image is never presented as a photograph. It names one person to ask. It commits to a review each quarter.
Two things make a note like this hold where a longer policy fails. It is short enough to be read, and it is written with the people it governs, so the questions they actually have (“can I put a board paper into this?”) are answered on the page. For charities there is now a regulatory floor underneath it as well. The Fundraising Regulator’s guidance of December 2025, its first on AI, expects a charity to have a process for a person to check the accuracy, fairness and legality of any content generated by AI before using it, and to be more transparent with donors the greater the risk of misleading them. A one-page note shows that process exists.
The questions are the same at every size. What changes is the weight of the risk and the number of people you need to bring with you. A communications team that wants a governance template to start from will find one in the Leadership AI Governance Toolkit at Comms With AI.
What to do this month
Ask each member of staff which AI tools they have used for work in the last month and for what. Half a day and a spreadsheet, with no judgement attached. The list you get back is your current policy. Once you can see it, the one-page version of the policy you want will take an afternoon to draft, and the data line will be obvious from what people tell you.
Where Faur comes in
Faur AI Adoption does this work with organisations too exposed to improvise and not ready to hire a Head of AI. An AI Adoption Assessment is a fixed-scope engagement from £2,500, no VAT to add, and it produces the use policy, the tool decision and the rollout plan together, delivered directly by Faur’s founder.