Charities are facing an increasingly complex risk landscape — from fraud and safeguarding to financial pressure, governance challenges, cyber threats and the rapidly evolving risks associated with technology and AI.

At the same time, the financial pressure on charities has never felt more acute.

The Commission's latest assessment found that around, two in five charities had expenditure exceeding income, while smaller organisations continue to operate on particularly narrow margins.

And yet charities still have to grow.

They need to generate voluntary income.

They need to improve supporter experiences.

They need to find efficiencies.

They need to reach more people.

And ultimately, they need to create more impact with the resources entrusted to them.

This creates a difficult dilemma.

Technology can help charities move the dial, but using it responsibly is becoming increasingly complex.

The opportunity is enormous

The potential of digital technology and AI for charities is genuinely exciting.

Better data can help fundraisers understand supporters and identify opportunities.

Automation can reduce repetitive administration and release valuable staff time.

Digital journeys can make it easier for people to engage and give.

AI can help teams analyse information, develop content, improve processes and explore new ideas.

For charities operating under significant financial pressure, these aren't simply interesting technological developments.

They could make a material difference to an organisation's ability to deliver its purpose.

But there is another side to the equation.

Every opportunity brings responsibility

The Charity Commission's latest assessment highlights the growing complexity of the risks facing charities, including risks arising from rapid technological development.

The Commission reports a 29% increase in concerns about charitable status being abused for private benefit during 2025–26, following a 38% increase the previous year. It also identifies the use of AI as one factor that can make certain forms of abuse more difficult to detect.

But the challenge goes far beyond malicious use of AI.

Charities are increasingly dependent on technology to operate.

And that creates a different kind of risk.

Your digital risk doesn't stop at your own organisation

This is perhaps one of the most important lessons for charity leaders.

A charity can have good internal controls, sensible policies and responsible people — and still be exposed through a technology supplier.

Think about the systems a modern charity might depend upon:

• CRM.
• Fundraising platforms.
• Payment providers.
• Cloud services.
• Websites.
• Marketing automation.
• Data analytics.
• AI tools.
• Third-party integrations.

These systems are no longer peripheral to the organisation.

They are part of its infrastructure.

And when something goes wrong, the consequences can extend well beyond the technology itself.

The Beacon CRM incident is a good example.

In August 2026, the Charity Commission issued guidance following a cyber-security incident involving Beacon's CRM service.

The Commission said it was aware of the potential impact on charities using the service, that a number of affected charities had submitted serious incident reports, and that trustees should consider their obligations to regulators and individuals whose data was stored on Beacon systems. It also emphasised the importance of clear communication with supporters and stakeholders.

The important point isn't to assign blame.

It is to recognise what this tells us about the modern charity environment.

Your organisation's digital risk increasingly extends into the ecosystem of suppliers and platforms you rely upon.

A charity may not have been individually targeted.

It may have followed good practice.

It may have trusted an established technology provider.

And yet an incident elsewhere in the technology chain can still create consequences for the charity, its supporters, its beneficiaries and its reputation.

That changes the questions we should be asking when we procure technology.

It isn't enough to ask:

Does it work?

We also need to ask:

How resilient is it?

How is our data protected?

Where is our data held and processed?

What happens if the supplier suffers an incident?

How quickly will we be told?

What is our exit strategy?

And perhaps most importantly:

How much of our organisation would stop functioning if this service disappeared tomorrow?

The pressure to innovate isn't going away

This is where the conversation becomes difficult.

It would be easy to respond to increasing digital risk by saying charities should simply be more cautious.

But that isn't realistic.

The financial pressures facing charities mean that organisations need to find new ways of working.

They need to generate voluntary income.

They need to make better use of data.

They need to improve supporter journeys.

They need to reduce avoidable administration.

They need to create capacity.

They need to become more efficient without compromising the quality of their work.

And technology can genuinely help.

The answer isn't less innovation.

It's better-informed innovation.

AI makes the dilemma even more complicated

AI is perhaps the clearest example.

The potential is enormous.

But so are the questions.

What data are we putting into AI systems?

Who can access it?

How are outputs being checked?

Where does human judgement remain?

Could an algorithm introduce bias?

Could confidential information be exposed?

What happens when an AI supplier changes its model or terms?

What decisions should never be delegated to AI?

And are staff and volunteers using AI tools that the organisation doesn't even know about?

The more powerful the technology becomes, the more important governance becomes. Efficiency cannot become an excuse for removing accountability. Digital resilience is now organisational resilience. This is why I think we need to broaden the way we talk about digital transformation.

Digital isn't simply an IT issue.

• Your CRM affects fundraising.

• Your website affects income.

• Your payment platform affects cash flow.

• Your data affects decision-making.

• Your AI tools affect how people work.

• Your suppliers can affect your resilience.

• And a cyber incident can affect trust.

Digital resilience is therefore becoming organisational resilience. That means technology decisions are strategic decisions. They are financial decisions. They are governance decisions. And sometimes they are decisions about the safety and trust of the people a charity exists to support.

So what should charities do?

I don't think every trustee needs to become a technology expert. But boards and leadership teams increasingly need to become confident asking the right questions.

For example:

What problem are we actually trying to solve?

What value could this technology create?

What could go wrong?

What happens to our data?

How resilient is the supplier?

How dependent would we become on them?

Where does human judgement need to remain?

Can we afford not to change?

And perhaps the most important question: Is the potential benefit proportionate to the risk we're taking? These aren't simply IT questions. They're leadership questions.

This is where external expertise can help

I think there is an important role for external partners here.

Not because charities need another supplier telling them which technology to buy.

Quite the opposite.

Sometimes the most valuable external partner is the one who helps you decide whether you should buy anything at all!

The right partner should sit alongside the charity. Understand its purpose. Understand its financial pressures. Understand its people. Understand its appetite for risk.

And then help leadership teams make informed decisions about where technology can genuinely create value. That might mean assessing digital maturity. It might mean exploring AI readiness.

It might mean identifying opportunities to improve income generation through better data and digital journeys. It might mean reviewing processes and identifying where automation could release capacity. It might mean putting appropriate AI governance around experimentation.

Or sometimes it might mean saying:

"This isn't the right technology for you right now."

That is just as valuable.

Why Digi4Good is different

This is particularly personal for me. I've spent much of my career on the charity side of the table. I've been responsible for fundraising, marketing, communications, digital transformation, data, teams, budgets and organisational change. I've also experienced the reality of being expected to increase income while managing limited resources and significant organisational pressures. So I understand both sides of the conversation. I understand why charities need to move quickly. I also understand why trustees and leadership teams sometimes hesitate. The consequences of getting a technology decision wrong can be significant.

That's why I built Digi4Good.

Not as another technology vendor. But as a partner that can sit alongside purpose-led organisations and help them navigate the decisions. We can look at the technology.

But we also look at the purpose, the people, the processes, the data, the risks and, crucially, the potential impact.

Because the objective isn't digital transformation for its own sake.

It's better organisations, better decisions and greater impact.

The charity sector cannot afford to stand still

The Charity Commission is right to highlight the growing complexity of the risks facing the sector. But we also need to recognise the other side of the equation. The pressure to generate voluntary income, improve efficiency and increase impact isn't going away. Technology will be an increasingly important part of how charities respond to that pressure.

The answer isn't to avoid the risk. And it isn't to blindly embrace the opportunity.

It's to get better at navigating the space between the two.

Charities need partners who understand that this isn't simply about technology.

• It's about purpose.

• It's about people.

• It's about income.

• It's about trust.

And ultimately, it's about making sure that every investment, every innovation and every decision helps the organisation deliver more of the impact it exists to create.

If you're wrestling with these questions in your organisation, I'd genuinely welcome a conversation (not a sales pitch).

Just an opportunity to understand where you are, what you're trying to achieve and whether there might be a useful role for Digi4Good alongside you. Sometimes the first step towards better digital transformation is simply having the right conversation.**