Data (Use and Access) Act 2025
The DUAA 2025 received Royal Assent on 19 June 2025. Where AI is involved in a decision affecting an individual, including beneficiary eligibility assessments, safeguarding referrals, and hardship fund allocations, that person must be informed, must be able to make representations, and must be able to request human intervention. Meaningful human involvement means a person reviews and can challenge the AI-generated decision. It does not mean rubber-stamping an output.
The ICO's Recruitment Rewired report (March 2026) found that most organisations described automated tools as "decision support" when those tools were making the decisions. The same mischaracterisation applies in charity work. Reviewing an AI-summarised case note in thirty seconds before acting on it is not meaningful human involvement. This course addresses what the Act requires in the tasks charity staff carry out every day.
ICO expectations under the UK GDPR accountability principle
The UK GDPR requires organisations to demonstrate accountability for how they process personal data, including processing that involves AI tools. The ICO's Data Protection Audit Framework expects documented training programmes, completion records, and assessment evidence as part of that accountability position. This course produces evidence that meets those expectations. The ICO does not mandate AI training as a standalone legal requirement, but the documentation produced here directly supports a charity's accountability position under UK GDPR.
EU AI Act Article 4: who it binds and who it benchmarks
Article 4 of the EU AI Act (Regulation (EU) 2024/1689) requires providers and deployers of AI systems to ensure their staff have appropriate AI literacy. It has been in force since 2 February 2025.
For charities with EU exposure, this is a binding legal obligation. EU exposure includes serving EU-based beneficiaries, receiving funding from EU sources, or having AI outputs used in EU jurisdictions. For charities operating entirely in the UK with no EU exposure, Article 4 does not apply directly. It sets the benchmark that UK regulatory thinking is moving toward. This course contributes to meeting the Article 4 obligation for EU-exposed charities, and demonstrates the equivalent standard for UK-only organisations.