AI in trustee meetings: what small charities need to decide

If an AI note-taker joins your next trustee meeting, the board should already have decided whether it is welcome. In many small charities that decision never gets made. A trustee's Otter or Fireflies account joins the Zoom call automatically, or Copilot is switched on in Teams, and a summary of the whole meeting ends up with whoever set it up.

None of this is unlawful in itself, and the tools can save a volunteer secretary hours of work. The problems come from using them without any agreed rules. This guide sets out what the board needs to decide, and offers a simple protocol you can adopt at your next meeting.

Where the regulators stand

There is no AI rulebook for charities, so trustees' existing duties apply. In a 2024 blog post, the Charity Commission said it did not currently anticipate producing specific AI guidance, and expected trustees to apply its existing guidance to new technology. It said it expects human oversight to be in place to prevent material errors, and that relying solely on AI-generated advice for a critical decision, without independent checks, may mean trustees are not complying with their duties. It also suggested charities consider an internal AI policy. As of October 2026, no specific guidance has followed.

The Charity Governance Code, refreshed in November 2025, now suggests that charities have a policy on the use of technology and AI tools. The Code is voluntary and written for charities in England and Wales, but it is a fair benchmark for any board.

In Scotland, trustees' duties are set in law by section 66 of the Charities and Trustee Investment (Scotland) Act 2005, including acting with the care and diligence expected of someone managing another person's affairs. The Scottish Governance Code for the Third Sector sets out good practice. The same care and diligence test applies to how a board uses AI. In Northern Ireland, the Charity Commission for Northern Ireland regulates and the Code of Good Governance plays the same role as the codes elsewhere.

In practice, the main legal issue in a meeting is data protection. A recording or transcript of a meeting will almost always contain personal data, so UK GDPR applies whichever app produced it.

Transcripts and minutes

Minutes are a record of what the board decided and why. A transcript is a record of everything anyone said, including asides and remarks about people who were not there.

An AI summary can be a useful first draft. It does not become the minutes until someone has checked it against the meeting and the board has approved it in the usual way. Your governing document still governs how minutes are taken and signed off.

Data protection in plain terms

You do not always need everyone's consent to transcribe a meeting, but you do need to tell people, and your privacy notice should mention the tool. The ICO's position is that an organisation must identify a lawful basis for each purpose it uses personal data for, and consent is only one of the options. For a board meeting, the charity will usually rely on legitimate interests. If so, record briefly why transcription is necessary and proportionate. People can object, which is why the chair asks at the start.

Four questions cover most of what a small charity needs to think about.

1. Have people been told? Say in the meeting papers or invitation that the meeting will be transcribed, and the chair should repeat it at the start. A bot in the participant list is not enough notice.
2. Whose tool is it? If a trustee uses their own personal account, the transcript sits outside the charity's control. Agree one tool, set up in the charity's name where possible, and no personal note-takers.
3. Where does the data go? Check where the provider stores recordings, whether it uses them to train its models, and whether it offers a data processing agreement. Some tools, particularly free versions, store data outside the UK.
4. When is it deleted? Anyone mentioned in a recording, a transcript or the minutes can ask for their personal data through a subject access request, for as long as you hold it. Deleting recordings and transcripts once the minutes are approved keeps what you hold, and may have to disclose, to a minimum.

If meetings regularly touch on beneficiaries' health, safeguarding or other special category data, the risk is higher, because that kind of data needs an extra legal condition. Take advice, or keep those discussions off the recording.

Confidential items and checking the draft

Some business should not be recorded at all. Staffing matters, safeguarding concerns, complaints, legal disputes and anything about an individual beneficiary are the usual examples. The simplest approach is to put these items at the end of the agenda and stop the recording before you reach them. Minutes for those items are taken in the usual way, without the tool.

AI summaries also make mistakes that matter for governance. Common errors include:

• a view attributed to the wrong trustee, especially when people talk over each other;
• a discussion written up as if a decision had been made;
• a declared conflict of interest, or a trustee leaving the room for an item, left out;
• a vote recorded as unanimous when someone abstained.

Whoever takes the minutes should check the draft against their own notes before it goes to the chair. The ICO also expects organisations to check AI summaries for accuracy and correct any errors, and the point about human oversight applies here directly. The board is responsible for the accuracy of its minutes, however the first draft was produced.

A simple meeting protocol

A one-page protocol, agreed by the board and minuted, covers most of these points. You can use the table below as it stands or adapt it.

If a trustee objects, the simplest answer is to switch the tool off for that meeting and take the minutes in the usual way.

Beyond the meeting room

Meetings are usually where a board first notices AI, but staff and volunteers are probably using it elsewhere already, for example for funding bids. Trustees need to know what is being used in the charity's name, and someone should keep an eye on it.

For a charity with an income under £500k, a proportionate starting point is short:

• a one-page AI use policy, covering what tools may be used, what information must never be put into them, and that a person checks anything published or sent;
• a simple list of the tools in use and who uses them;
• an entry in the risk register;
• one trustee who takes an interest and reports to the board once a year.

The policy should cover trustees too. Uploading board papers to a free chatbot to get a quick summary puts confidential information into a system the charity does not control.

Sources: Charity Commission, Charities and artificial intelligence (April 2024); Mills & Reeve, Trustee duties in the age of AI (September 2026); Trowers & Hamlins, Charity Governance Code 2025: what's new; Charities and Trustee Investment (Scotland) Act 2005, s66; SCVO, Scottish Governance Code for the Third Sector; Volunteer Now, Code of Good Governance; ICO, Innovation advice: previously asked questions.

This guide is general information for trustees and committee members, not legal advice, and every charity is different. Your governing document may set rules of its own, so check it, and confirm the position with the relevant regulator or a suitably qualified adviser before acting. Last reviewed October 2026.