UK Charity Commission + GDPR + EU AI Act. One substrate.

Often yes. Annex III section 5 captures AI used to evaluate eligibility for, or to allocate, essential public assistance and social services. A charity using AI to triage or rank beneficiaries for support is squarely in that category and must meet the full high-risk stack — risk management, data governance, human oversight (Article 14), transparency (Article 13) and logging. MEOK's eu-ai-act-compliance-mcp ships the 9-Article evidence pack and bias-detection-mcp covers the fairness testing.

Charities routinely process special-category data — health, religion, political opinion, trade-union membership, sexual orientation — for example a health charity or a faith-based organisation. Article 9 prohibits processing unless a specific condition applies (explicit consent, not-for-profit-body processing of members, substantial public interest, etc.). You need to document the Article 9 condition alongside an Article 6 lawful basis. The gdpr-compliance-ai-mcp maintains that dual-basis register automatically.

Where beneficiaries are children or adults at risk, the Children Act 1989/2004 and Care Act 2014 impose safeguarding and mandatory-reporting duties. Any AI that profiles, screens or makes recommendations about vulnerable people must keep a human in the loop and an auditable decision trail so safeguarding leads can review and override. MEOK's agent-policy-enforcement-mcp and agent-audit-logger-mcp provide the override controls and the signed log.

Yes, but the Code of Fundraising Practice requires lawful, fair processing, valid consent for marketing, and extra care with people in vulnerable circumstances. AI donor segmentation that profiles individuals needs a DPIA and must honour the Charities SORP / FRS 102 record-keeping (donor lists, gift-aid records, 6-year retention). MEOK runs the DPIA template and bias-detection-mcp checks that targeting models do not unfairly exclude or pressure vulnerable donors.