Readiness is not a maturity score; it is a set of specific conditions that decide whether an AI programme delivers in the first quarter or stalls in the second. Twelve questions a leadership team can answer in an hour.
Charities run on trust and on too little time. The AI opportunities that respect both are practical ones, none of them needs a large budget, and most of them need a policy before a product.
The contractual commitment that your data is not used to train the model is what makes enterprise AI tools safe to open. What the commitment actually covers, where it does not apply, and the six things to confirm at contracting.
"Human in the loop" is a slogan until someone decides where the loop closes. The real design question is the threshold: how sure must the system be before it acts alone, and who decides that, on what evidence.
Most investment templates were written before AI. Four fields, risk category, data protection, human oversight and transparency, make governance part of every AI decision instead of a gate at the end.
The AI management-system standard, explained without the jargon: what it asks for, who actually needs certification, and why a governed-access model gets most businesses most of the way there.
Article 4 of the EU AI Act has applied since February 2025 and requires a sufficient level of AI literacy among staff who use AI systems. Who it covers, what "sufficient" means, and the training that meets it without a compliance programme.
The alternative to blocking AI tools is not a free-for-all. It is five controls, all well established, that make enterprise AI safe to open and unlock the cheapest value in any AI programme.
A blanket block on AI tools is the costliest governance decision we see. It does not stop AI use; it moves it to personal accounts the business cannot see, and it forfeits the cheapest value in any AI programme.
A long-form guide: who is in scope, the four risk categories with examples, every date that matters, the AI literacy duty already in force, what each category requires, the UK position, and a twelve-step plan a business can run without a compliance programme.