Case Study · AI Governance
November 2026

Case Study · Charity Sector · AI Governance

Closing the Governance Gap

How Ways Into Work Moved from AI Risk to AI Readiness

UK charities are using AI faster than their boards are aware of it. 79% of charities now use AI tools (Charity Digital Skills Report, 2026), while in the Charity Commission's 2024 survey only 3% of trustees said their charity used AI in its operations. The surveys differ in year and respondents, so this shows a gap in awareness rather than a like-for-like comparison. All three board-level AI governance indicators were rated Red in Charity Excellence's Future Charity report (2026). This is the story of one organisation that decided to act, and what it built.

Hassan Khan

Founder & Principal Advisor, HK Strategy Advisory

From complexity to clear action.

The Opportunity

Unlocking AI's Potential Through Governance

For a resource-constrained charity, the attraction of AI is practical. It can reduce the time spent on routine administration, help staff draft and summarise information more quickly, support referral and case-management workflows, improve access to organisational knowledge, and ease the reporting burden on managers and frontline teams.

Used well, those gains can release scarce capacity back into the work that matters most — supporting beneficiaries, managing relationships with funders and commissioners, and responding to growing demand without simply adding more overhead.

But the opportunity comes with choices. Which activities are suitable for AI? What information can safely be used? Where must human judgement remain? Which tools are approved, and who is accountable for the outcome?

Ways Into Work chose to establish those answers before scaling its use of AI. The objective was not to restrict adoption, but to create the conditions in which productivity gains could be pursued with clear ownership, appropriate controls and confidence at board level.

The Context

A sector using AI without knowing it

The sector data points to a wide gap between AI use and trustee awareness, though the surveys behind it differ in year and respondents. The 2026 Charity Digital Skills Report found that 79% of UK charities are now using AI tools in some form — and the adoption curve is accelerating year on year.

Yet the Charity Commission's 2024 survey of trustees found that only 3% of charity trustees said their organisation used AI in its operations. Among larger charities, the figure rose to just 8%. What this tells us is that AI is already deeply embedded in how charities operate — through individual staff using ChatGPT to write bids, Microsoft Copilot to prepare communications, or AI tools to manage scheduling — while boards remain largely unaware.

That gap carries direct legal and governance implications. The Charity Commission has been explicit: trustees remain legally responsible for how AI is used within their organisation, including risks around data protection, safeguarding, and algorithmic bias — regardless of whether the board was aware the tools were in use.

The November 2025 refresh of the Charity Governance Code addressed this directly for the first time, introducing a new recommendation that charities have a policy for the use of technology and AI tools. Charity Excellence's Future Charity report (2026) rated all three board-level AI governance indicators Red across the sector — covering board strategy, named trustee or committee responsibility, and awareness and training across the organisation. The same report found that fewer than one in four charities are implementing approved tools and policies — and full governance, with named accountability and staff training alongside it, remains rarer still.

Ways Into Work, a UK disability employment charity, decided to address the issue before scaling its use of AI further.

The Challenge

Ways Into Work supports people with disabilities and complex barriers into sustainable employment across the UK. Its mission places it in daily contact with some of the most vulnerable members of society — processing sensitive personal data at every stage of the beneficiary journey, from initial referral through to employment placement and ongoing support.

That context makes the governance question unusually high-stakes. AI tools that might carry modest risk in a commercial setting carry significantly greater risk when the data involved belongs to people with disabilities, mental health conditions, or other protected characteristics. The potential for algorithmic bias — AI systems that inadvertently discriminate against the beneficiaries they are meant to support — is a real and documented risk in employment-related AI applications. Under the Equality Act 2010, discriminating against people with these protected characteristics — whether deliberately or through a biased algorithm — is unlawful, not just poor practice.

At the same time, Ways Into Work faced the same operational pressures as every charity of its size: limited resources, growing demand for its services, and an expectation from funders and commissioners that it would use technology to operate more efficiently. AI was not a distant possibility — it was already arriving, through individual staff using tools they found useful, with no organisational framework to guide how those tools should be used, what data could be shared, or who was responsible when something went wrong.

The regulatory exposure was concrete. Where AI processing is likely to result in a high risk to individuals, a Data Protection Impact Assessment is required before that processing begins. Any processing of personal data must also have an appropriate lawful basis. Failure to meet either creates liability exposure for the organisation — and the Charity Commission has been clear that trustees can be held personally accountable for serious data protection failures. The ICO has investigated and fined charitable organisations. Trustee awareness is now an expected standard, not a courtesy.

There was a second dimension to the challenge, internal rather than regulatory. Understanding of AI across the organisation was genuinely uneven — some staff had barely encountered it, others were already experimenting with tools in their own work, and familiarity at board level varied just as sharply from one trustee to the next. That gap sat at the heart of the governance problem: a board cannot govern what it does not understand, and staff will not follow a policy they were never brought into.

The governance question Ways Into Work had to answer: How do we enable staff to use AI tools responsibly and effectively — capturing the gains that let us serve more beneficiaries — without exposing the organisation, our data, or the people we support to unacceptable risk?

The immediate need was clear rules, ownership and oversight before scaling adoption further. That is where the engagement began.

The Approach

HK Strategy Advisory delivered this engagement pro bono. Its founder, Hassan Khan, is a serving trustee of Ways Into Work, and that connection is disclosed here so the case study can be read with it in mind. The work reflected the firm's founding commitment to making high-quality AI governance accessible to organisations that cannot normally access senior strategic advisory support.

The engagement was structured around a deliberate sequencing principle. Where boards have not shaped a governance framework themselves, policies risk existing on paper without ever being meaningfully embedded in practice.

Conversation before infrastructure.
Education before policy.
Principles before tools.

That sequencing mattered at Ways Into Work specifically, not just in theory. The uneven understanding of AI across the organisation split into two distinct forms of resistance. Some, more cautious than fearful, argued for waiting — the technology "hadn't matured" yet. Others, with the least direct exposure to it, were genuinely apprehensive, shaped less by their own experience than by a public narrative dominated by a single message: AI is coming for your job.

The process therefore began not with documents but with a board education and alignment session — building a shared vocabulary for AI, its different forms, and what it could and could not do, before any governance conversation was possible. That session did the work neither camp could do alone: it gave the cautious enough understanding to stop waiting, and gave the apprehensive a direct answer to the fear driving their resistance. The board agreed, deliberately, that the organisation would rather be an early adopter than a latecomer — AI adoption, they concluded, was inevitable, and the only real choice was whether to shape it on their own terms or have it arrive unmanaged.

That reassurance was written directly into the governing principles the board went on to adopt, not left as a verbal promise: Staff Empowerment, Not Replacement — AI augments the team's capabilities; efficiency savings are reinvested in frontline capacity and mission delivery. Once that alignment was in place, the shift in the room was immediate. The Chief Executive and the Chair moved from cautious observers to full, visible advocates, putting their weight behind the governance work that followed — and that leadership conviction is what gave the programme the momentum to move from shared understanding to a fully built operating framework.

The CLEAR Framework — HK Strategy Advisory's CLEAR governance methodology — provided the structural backbone from that point forward. Its five dimensions — Compliant, Lawful, Ethical, Accountable, Responsible — align with the UK Government's five cross-sectoral AI principles and the Charity Commission's expectations of trustee oversight. Every component of the governance framework built for Ways Into Work was tested against all five dimensions before it was finalised.

The engagement was designed from the outset to be replicable. Every document, process and structure was built so that Ways Into Work could own, maintain and update the framework independently, rather than creating dependency on external advisers.

The Methodology · HK Strategy Advisory

Compliant

Operating within the UK's five cross-sectoral AI principles and UK GDPR. Ongoing — not a one-off exercise.

Lawful

Every AI system must have a clear legal basis. Data protection, Equality Act, and trustee and statutory duties all apply.

Ethical

Apply clear values: fairness, transparency, and respect for human dignity. Not just what is legal — what is right.

Accountable

Named ownership at board level. Audit trails. Human review of every AI output affecting individuals.

Responsible

Proactive ownership of AI risk across the full operational footprint, including third-party tools and shadow AI.

The CLEAR Framework aligns with the UK Government's five cross-sectoral AI principles (2023): Safety and Robustness, Transparency and Explainability, Fairness, Accountability and Governance, and Contestability and Redress.

The Deliverables

What Was Built

Workstream 1 — the governance foundation — delivered a complete AI governance infrastructure across nine components. Each was designed to serve a specific governance function, and together they form a coherent, defensible, and operational framework.

Board AI Literacy Briefing

A 12-slide briefing for the full board and senior leadership, closing an uneven starting understanding of AI — covering the regulatory landscape, trustee duties, the CLEAR Framework and the six governing principles.

Six Governing Principles

Formally adopted by board resolution: human always in the loop, data privacy first, transparency with beneficiaries, bias awareness, staff empowerment, and regular review.

AI Governance Handbook

The operational foundation of the framework: the AI Use Policy, risk classification, New Tool Request process, incident protocol and quarterly review cycle.

Accountability Structure

Named individuals at every level — trustee, executive and operational leads — with clear escalation routes for each incident tier.

AI Tool Inventory

A live register of every approved AI tool: permitted use cases, data handling conditions, compliance status and review date.

DPIA Process

A completed DPIA process for any AI tool processing personal data — no new tool is approved without one.

Staff Training Suite

Three purpose-built sessions: all-staff AI awareness, line manager responsibilities, and an AI Working Group deep dive.

AI Working Group

A constituted governance body with defined membership and a quarterly review mandate, chaired by the AI Governance Lead.

AI Governance Hub

A dedicated internal resource housing all policies, forms, the tool inventory and the New Tool Request process.

The Outcomes

Ways Into Work completed Workstream 1 with a fully operational AI governance framework — named accountability, board-adopted principles, trained staff at all three levels, and a live audit trail. That places the organisation among the small minority of UK charities with governance of this kind fully embedded, a distinction quantified in the table below.

The outcomes are specific and measurable across eight governance dimensions.

"We knew AI was already being used across the organisation, but we needed clearer oversight and a more consistent approach. This work has given us clear accountability, practical guidance and a framework that people can actually use. As a result, we're in a much stronger position to make the most of AI safely, responsibly and with confidence.

The Charity now looks forward to capitalising on the possibilities presented by AI ethically and effectively and, most excitingly, impactfully for the people we support."

MAURICE GEORGE · Chief Executive Officer, Ways Into Work

Governance Dimension	Before the Engagement	After Workstream 1	UK Charity Sector Benchmark
Board awareness of AI use	No formal discussion of AI at trustee level	Full board literacy briefing delivered; six principles formally adopted by resolution	Only 3% of trustees report their charity uses AI in its operations (Charity Commission annual survey of trustees, 2024)
AI Use Policy	No policy in place	Comprehensive policy live, communicated to all staff	Only 36% of small charities have an AI policy (Charity Digital Skills Report, 2026)
Named accountability	No named individual responsible for AI governance	Three named leads — board, executive, and operational level	No sector-wide benchmark available; board-level AI accountability rated Red across the sector (Charity Excellence, Future Charity 2026)
Tool approval process	No process — staff using tools at their own discretion	Formal New Tool Request process with DPIA requirement	Sector data not published; most AI tool use remains informal and ungoverned
Data protection compliance	No DPIA process for AI tools	DPIA mandatory for any tool processing personal data	No formal sector standard exists; GDPR compliance for AI tools is a known and documented gap
Staff training	No AI governance training at any level	Three-tier training suite delivered across all staff	56% of charities cite limited skills as the biggest barrier to adopting AI (Charity Digital Skills Report, 2026)
Incident management	No incident reporting or escalation structure	Three-tier incident classification with named escalation routes	Not yet a sector norm; most charities lack this structure
Ongoing oversight	No governance review mechanism	Quarterly Working Group review with board reporting	Fully embedded AI use remains rare: fewer than 3% of charities had achieved it (Charity Excellence, Future Charity 2026)

The board resolution gave the framework formal organisational authority and established clear accountability for its operation. Ways Into Work's board adopted its six principles by formal resolution, creating the organisational foundation for everything built above it.

Looking Ahead

Ready for Responsible Adoption

Workstream 1 gives Ways Into Work the controls and accountability needed to adopt AI more widely: named principles adopted by board resolution, an operational accountability structure, trained staff at every level, a live tool approval process, and an audit trail — all in place before the first tool is deployed at scale. Most organisations only build this after a problem has occurred. Ways Into Work built it first.

That means the organisation can move into AI adoption — identifying use cases, piloting tools, and building capability — against controls that already exist, rather than governance retrofitted after the fact. Workstream 1 was built to make that adoption safe, not to promise its results in advance.

The foundations are in place. What Ways Into Work does with them next is the story still being written. Risk remains, but the organisation now has named owners, approval routes and records for managing it.

"From the Trustee board's perspective, the main benefits have been visibility and assurance that we are on the right side of the law and a more transparent route to seeing how we can use AI to improve productivity in a resource constrained environment. These give the trustees a much firmer basis for proactive efficiency as well as good governance."

JAMES WELCHMAN · Chairman of the Board of Trustees, Ways Into Work

Implications

What This Means for Your Organisation

The Ways Into Work engagement was designed as a proof of concept for a replicable model. The CLEAR Framework, the governance handbook, the accountability structure, the training suite, and the working group constitution are not bespoke to Ways Into Work. They are a methodology that can be adapted for any charity, SME, or founder-led organisation facing the same governance challenge.

AI is almost certainly already being used across your organisation, whether or not the board is aware. The question is whether the governance structures are in place to ensure that use is lawful, ethical, and accountable.

Three questions worth putting to your board this quarter:

Do we know which AI tools are currently being used across our organisation — by staff, volunteers, and contractors — and do we have a formal approval process for any new tool?

Is there a named individual at board or senior leadership level who is accountable for AI governance — and do they have the information, authority, and structures to discharge that responsibility?

If an AI tool used by our organisation were to produce a biased or harmful output affecting a beneficiary or customer, do we have the audit trail, escalation process, and accountability structure to respond appropriately?

If the answer to any of these questions is "no" or "I'm not sure," the organisation has a material governance gap. The Ways Into Work engagement illustrates one structured approach to closing it — and suggests that with the right methodology, the process is more achievable than many organisations expect.

Clear ownership and proportionate controls give boards a firmer basis for approving suitable AI use cases.

Complimentary · Executive AI Governance Review

Not sure where your organisation stands?

Answer ten statements in under three minutes. You will receive a personally written review of your priority governance risks within three to five working days, at no cost.

Take the AI Check → Book a 30-minute conversation

Hassan Khan

Founder & Principal Advisor, HK Strategy Advisory

Hassan Khan is the Founder and Principal Advisor at HK Strategy Advisory, where he works with boards, executive teams, and founder-led organisations on AI adoption, AI governance, and responsible AI decision-making at board level.

He is a serving trustee of Ways Into Work. He developed the CLEAR Framework to provide boards and leadership teams with a structured approach to AI governance — helping boards adopt AI with confidence, clear governance and practical oversight.

hassan@hkstrategyadvisory.co.uk hkstrategyadvisory.com linkedin.com/in/hkhan1968