High-Risk AI in the Charity Sector: 7 Use Cases You Didn't Realise Were Regulated
Seven charity-sector AI use cases that fall into the EU AI Act's high-risk category — and what your charity has to do for each one if you keep using them.
Most UK charities using high-risk AI under the EU AI Act do not know they are. Here are seven specific charity scenarios that fall into the Act's most heavily regulated category, and what to do about each.
The category most charities miss
Ask a charity CEO if their organisation uses "high-risk AI" and most will say no. ChatGPT for newsletter drafts. Microsoft Copilot for Excel. The new AI feature in their CRM. Nothing high-risk about any of that.
That answer is right about the tools and wrong about the use cases.
Under the EU AI Act, risk follows the use case, not the technology. The same AI model used to draft a newsletter is minimal risk. Used to score an applicant's eligibility for a programme, it is high-risk and subject to a different obligation regime.
Annex III of the Act lists eight high-risk domains. Six of these regularly catch UK charities operating in education, employment, welfare, justice, and migration. Most charities working in these areas do not realise the Act applies to their AI use because they think of themselves as "using ChatGPT," not "deploying a high-risk AI system."
This article lists seven specific scenarios where UK charities are unknowingly operating high-risk AI today. Read them. If any sound familiar, you have homework.
A note on timing: the Digital Omnibus political agreement reached on 7 May 2026 looks set to delay the high-risk AI obligations from August 2026 to December 2027. That gives charities more runway. It does not remove the obligation. And the underlying classification (high-risk or not) applies now.
Use case 1: Scholarship, bursary, or programme admissions
What charities do this: Education charities, foundations awarding student grants, charities running training programmes with selective admission, mentoring schemes with capacity limits.
The scenario: Your team uses AI to summarise applications, score candidates, identify "strong" applications, or recommend a shortlist. The AI does not make the final decision (a human does). But the AI has shaped the candidate pool.
Why this is high-risk: Annex III of the Act covers AI systems used to "determine access or admission" to education or vocational training. Even if a human reviews the AI's output, the AI is informing a decision that affects access to education. That is the regulated activity.
The honest version: Your charity is making a decision that materially affects someone's life chances. The AI has been part of that decision. Article 26 deployer obligations apply.
What to do:
- Document where AI is used in any selection workflow
- Maintain human oversight that is meaningful, not rubber-stamp
- Keep records of the AI's recommendations and the human decisions made on them
- Check for bias in selection outcomes by protected characteristic
- Ensure unsuccessful applicants can request information about the decision
- Plan for AI Act Article 26 deployer obligations once they apply
Use case 2: Job matching and employment support
What charities do this: Employment support charities, refugee employability programmes, youth employment schemes, women's employment initiatives, charities supporting ex-offenders into work, disability employment charities.
The scenario: Your team uses AI to match clients to opportunities, score CVs, identify "ready" candidates for employer referrals, or generate personalised career recommendations.
Why this is high-risk: Annex III covers AI systems used for "recruitment or selection of natural persons" and "to evaluate candidates." The classification applies whether you are matching people to your own programmes or to external employers.
The honest version: AI used to decide who gets put forward to an employer is doing exactly what the Act is designed to regulate. The fact that your charity is the intermediary, not the employer, does not change the category.
What to do:
- Map every AI touchpoint in your employability workflow
- Document why the AI is being used, what it is being used to decide, and what its alternatives would be
- Test for disparate impact across protected characteristics
- Ensure clients can opt out of AI-mediated matching without disadvantage
- Plan for full AI Act compliance once Article 26 applies
Use case 3: Eligibility assessment for welfare, food, or housing support
What charities do this: Food banks. Homelessness charities. Welfare advice agencies. Debt advice charities. Hardship grant administrators. Crisis support organisations.
The scenario: Your team uses AI to assess client circumstances, score need, prioritise referrals, identify clients eligible for specific programmes, or flag cases for urgent attention.
Why this is high-risk: Annex III covers AI systems used to "evaluate the eligibility of natural persons for essential public assistance benefits and services." Charity-provided emergency support sits in this category. Where the AI is part of deciding who gets help and who does not, the regulated category applies.
The honest version: A food bank that uses AI to decide which client gets a referral first is making a decision that the Act explicitly regulates. The fact that it is a charity, not a government department, does not exclude the use case.
What to do:
- Identify any AI scoring, prioritisation, or eligibility assessment in your service delivery
- Ensure decisions are reviewable by humans who can override the AI
- Maintain records of AI recommendations and final decisions
- Test outcomes for disparate impact, particularly on vulnerable groups
- Brief trustees explicitly: this is the Act-relevant area of service delivery
Use case 4: Risk assessment in criminal justice support
What charities do this: Probation support charities, ex-offender resettlement organisations, victim support, restorative justice charities, youth offending prevention programmes.
The scenario: Your team uses AI to assess reoffending risk, identify clients needing intensive support, score safety considerations, summarise case histories for staff briefings, or recommend intervention pathways.
Why this is high-risk: Annex III lists multiple AI uses in law enforcement and judicial contexts as high-risk, including risk assessment of natural persons in criminal proceedings. Charity provision in this area sits in the regulated zone.
The honest version: Risk assessment of any individual in a justice context is one of the most heavily regulated AI use cases in the Act. Charities providing this support are part of that regulated space.
What to do:
- Document every AI tool used in any risk assessment or case-handling workflow
- Apply strict human oversight: AI output should inform, not replace, qualified judgment
- Audit for bias in risk scoring across protected characteristics
- Plan for full Article 26 compliance, including conformity assessment for any AI systems classified as high-risk
- Engage with sector partners: charities in this space should be having a sector-level conversation about Act compliance
Use case 5: Vulnerability assessment for refugees and asylum seekers
What charities do this: Refugee support charities, asylum advice services, migrant welfare organisations, anti-trafficking charities, charities supporting victims of modern slavery.
The scenario: Your team uses AI to assess case vulnerability, identify priority cases, summarise interview transcripts, score asylum interview consistency, or recommend referral pathways.
Why this is high-risk: Annex III specifically covers AI systems used in migration, asylum, and border control, including risk assessment of irregular entry, vulnerability assessment, and verification of authenticity of travel documents.
The honest version: This is the highest-stakes area in the Act. AI used in any decision affecting an asylum seeker or refugee touches multiple high-risk categories simultaneously. Some uses may also approach the Act's prohibited practices.
What to do:
- Be exceptionally cautious about any AI use in this domain
- Where AI is used, ensure it is supporting (not replacing) qualified human judgment
- Document, document, document: this is the area where regulators will look hardest
- Consider whether AI use is appropriate at all for some decisions
- Engage legal advice on specific use cases before deployment
- This is not a "we will figure it out" area. It is a "we will get specialist advice first" area.
Use case 6: Affordability and creditworthiness scoring in debt advice
What charities do this: Debt advice charities. Money advice services. Credit unions with charitable status. Financial inclusion charities. Some housing charities making lettings decisions.
The scenario: Your team uses AI to score client affordability, recommend debt management plans, assess capacity to repay, or flag risk of default.
Why this is high-risk: Annex III covers AI systems used "to evaluate the creditworthiness of natural persons or establish their credit score." This includes affordability assessments. The classification applies regardless of whether you are a lender (most charities are not) because the regulated activity is the AI-mediated scoring itself.
The honest version: Even where your charity is advising the client rather than lending to them, AI-mediated affordability scoring sits in the Act's high-risk zone.
What to do:
- Map AI tools used in any client financial assessment
- Ensure clients understand AI is being used and can request human-only assessment
- Test scoring for disparate impact across protected characteristics
- Document decisions, particularly where the AI's recommendation is overridden by an advisor
- Engage with sector bodies (Money Advice Trust, StepChange precedents) on compliance approaches
Use case 7: Triage and prioritisation in health charity services
What charities do this: Mental health charities running helplines. Cancer support charities. Disability charities with helpdesks. Health-related crisis support services. Charities running health navigation services.
The scenario: Your team uses AI to triage incoming calls or messages, prioritise urgency, route calls to specialist teams, identify safeguarding flags, or recommend service pathways.
Why this is high-risk: Annex III covers AI used in healthcare contexts including "establishment of priority in the dispatching of emergency first response services" and AI used "for triage of patients in need of emergency healthcare." Charity helplines and support services that perform triage functions sit in this category when AI is involved.
The honest version: Helpline triage is the operational area where many health charities have started experimenting with AI. The Act treats this as high-risk because of the consequences of getting it wrong.
What to do:
- Identify every AI tool used in triage, routing, or prioritisation
- Apply rigorous human oversight: AI recommendations should support, not replace, trained call handlers
- Document decisions, particularly where AI flagged something the human caller did not, and vice versa
- Ensure clear escalation pathways for cases the AI cannot handle confidently
- Test for bias: triage AI can systematically under-weight presentations from specific demographic groups
What changed in May 2026
The Digital Omnibus political agreement of 7 May 2026 looks likely to delay the high-risk AI obligations from August 2026 to December 2027. The agreement is not yet final law. If adopted as drafted, it gives charities operating in any of the above seven scenarios an additional sixteen months before formal compliance becomes enforceable.
That is the runway. It is not the cancellation.
Two reasons charities should not relax.
The classification still applies now. Even with delayed enforcement, your charity is still operating high-risk AI today if any of these scenarios apply. Documentation built now is documentation that exists when enforcement begins. Charities that wait for the deadline will scramble.
Article 4 (AI literacy) is not delayed. Whatever happens to the high-risk obligations, the AI literacy enforcement deadline remains 2 August 2026. Staff using AI in any of these high-stakes contexts need documented, role-specific training before then.
What to do next
If any of the seven scenarios apply to your charity:
Tell your trustees. This is the kind of operational reality that trustees should know about before a regulator briefs them on it. A short paper covering which Annex III category applies, what the charity does in that space, what mitigations exist, and what the plan is, is the minimum for proper governance.
Audit your AI use specifically in that domain. A general AI inventory is not enough. You need a specific inventory of every AI tool, every workflow, every decision point in your high-risk activity.
Apply the 4Ps Framework with extra rigour. Purpose, Policies, People, Practice. For high-risk use cases, the Policies must be detailed, the People literacy must be deep, the Practice habits must be consistent. The [4Ps Framework] is the methodology; high-risk contexts are where it gets tested.
Consider whether the AI use is appropriate at all. Sometimes the right answer is to remove AI from the workflow. The Act's high-risk classification is not a permission slip; it is a warning that the stakes are high. Some high-risk uses pass the cost-benefit test for the charity. Some do not.
Get specialist advice. Legal advice on conformity assessment, DPIA support, sector-body engagement. For high-risk AI, the cost of getting it wrong is high enough to justify the cost of getting external help.
The honest takeaway
UK charities operating in education, employment support, welfare, justice, migration, finance, and health are using high-risk AI now. Most do not know it. By the time the high-risk obligations are enforced in December 2027 (assuming the Omnibus passes), the charities that started preparing in 2026 will be ready. Those that did not will be in the same scramble that always follows new regulation.
The work is not technically complex. It is the kind of structured governance that charities apply routinely to safeguarding, data protection, and finance. AI sits next to those now.
If you would like help mapping your charity's high-risk AI use, or running the audit that produces the trustee briefing, [book a call]. For the broader compliance picture, see our [EU AI Act for UK Charities] pillar. For the literacy framework that underpins all of it, see the [4Ps].
This article is informational and does not constitute legal advice. The EU AI Act's high-risk classifications are a complex and actively interpreted area of law. The Digital Omnibus simplification package remains subject to formal adoption. Charities with specific high-risk AI use cases should obtain qualified legal advice in addition to operational guidance.
Similar Posts
Forget prompting tutorials. Every person on your charity payroll needs to understand four things about AI before they use it for anything. The plain-language briefing for staff who never had the training.
Twenty-eight per cent of charity boards admit poor digital skills. Most have had no briefing on AI. With Article 4 enforcement weeks away, this is the plain-English briefing your trustees should have had a year ago.
Two-hour ChatGPT masterclasses are the default in the charity sector — and the most common reason AI literacy fails to land. Why generic doesn't work and what role-specific training looks like.