[ 01 ]
Humanity
AI must never be used in ways that cause additional harm or compromise the protection of affected populations. Efficiency gains that create harm are not gains.
AI governance for NGOs and humanitarian organisations
The data NGOs hold belongs to people in the most vulnerable situations. It was given in trust. Deploying AI without a governance framework does not only create compliance risk — it can cause direct harm to the people the organisation exists to serve. Technology must be made compatible with humanitarian values, not the other way around.
Accountability runs to people, not shareholders
Every AI decision must be answerable to affected populations before it is answerable to funders or oversight bodies.
The data is sensitive by definition
It describes people in crisis: their locations, health, legal status, family composition and vulnerabilities.
Existing frameworks already apply
Humanitarian principles, international law and data responsibility standards carry no technology exemption.
The principles that govern every AI decision
The four foundational principles of humanitarian action are operational constraints, not aspirational statements. Any AI system that cannot be made compatible with all four should not be deployed.
[ 02 ]
Impartiality
AI systems optimised on incomplete data systematically disadvantage the most marginalised. Impartiality requires continuous scrutiny of what a system is optimising for, and whose interests it reflects.
[ 03 ]
Neutrality
Dependency on commercial cloud infrastructure or third-party data platforms can compromise an organisation's perceived or actual neutrality in the field. Dependency creates vulnerability.
[ 04 ]
Independence
Any AI system that transfers operational control to an external provider — for data processing, knowledge management or programme analytics — is a structural threat to organisational independence. Institutional intelligence must remain under organisational control.
Priority challenges
- 01
Data held in systems outside organisational control
RiskBeneficiary safety — exposure to third-party, commercial or state access with no organisational recourse
- 02
Fragmented beneficiary data with inadequate access controls
RiskProtection failures for the most vulnerable; potential breach of humanitarian principles and international law
- 03
Programme decisions made on stale or incomplete data
RiskMission effectiveness — resources misallocated, populations missed, outcomes that cannot be defended to funders or communities
- 04
Knowledge lost when staff leave or contexts shift
RiskStrategic continuity — institutional learning that took years to build, lost in a single transition cycle
- 05
Administrative burden displacing mission capacity
RiskOrganisational sustainability — the slow erosion of the ratio between what the organisation spends on doing its work and what it spends on reporting it
The ethical floor: do no harm, consent and accountability
In humanitarian action, data about a person's location, health, legal status or family situation is not neutral. In the wrong hands, or through a compromised system, it can expose people to persecution, violence or refoulement. Three principles define the minimum ethical standard for any AI deployment.
Do no harm is a data obligation.
Ungoverned access controls, biased training data and open-ended retention have each caused documented harm in humanitarian contexts. The obligation to avoid harm applies to system design, not only programme intent.
Affected populations are rights-holders, not data sources.
People in crisis have the right to understand how their data is used by AI systems, and to decline without consequence. When AI influences decisions about programme eligibility, service allocation or protection assessments, those affected have the right to a meaningful explanation. Opaque systems are incompatible with humanitarian accountability.
Participation produces both better ethics and better outcomes.
AI designed without input from affected communities reflects the assumptions of those who built it. Accountability to Affected Populations (AAP), formalised in the Core Humanitarian Standard, applies in full when technology is introduced — it does not pause for implementation timelines.
The frameworks that apply
/ Ethics — ordered by direct operational relevance
- IASC Operational Guidance on Data Responsibility in Humanitarian Action — The cross-agency field standard for data collection, storage, sharing and protection; binding for all organisations operating within the inter-agency humanitarian system.
- UN Principles for the Ethical Use of AI in the UN System (2022) — Applicable to UN agencies, IGOs and their implementing partners; grounded in the UN Charter and international human rights law.
- UNESCO Recommendation on the Ethics of Artificial Intelligence (2021, adopted by 194 states) — Establishes human dignity, cultural diversity and the right to privacy as foundational requirements for any AI deployment.
- OECD AI Principles (2019, updated 2024) — Transparency, accountability, inclusivity and human oversight; increasingly referenced in donor compliance requirements.
- UN Guiding Principles on Business and Human Rights (UNGPs) — Organisational responsibility for AI's impacts on the rights of affected populations.
/ Data sovereignty — ordered by severity of exposure risk
CLOUD Act — the highest operational protection risk
Data processed on US-headquartered cloud infrastructure can be compelled by US federal authorities regardless of where it is physically stored. For organisations holding data on people in conflict zones or under authoritarian governments, this is a direct threat to the safety of those people — not a legal footnote. Sovereign or on-premises alternatives must be assessed wherever this risk is acute.
GDPR Chapter V — mandatory for all organisations handling EU resident data
International data transfers are subject to strict requirements that apply to field operations abroad, not only European headquarters. Any AI system routing beneficiary data through a jurisdiction without an adequacy decision is in breach.
Staff security data — a protection risk that is regularly overlooked
Data about staff movements, communications and locations in field environments is as sensitive as beneficiary data. AI systems that aggregate operational data without adequate controls create exposure for the people delivering the mission, not only those receiving it.
EU Data Act (applicable 2025)
Regulates access to data generated by connected field systems — directly relevant to the survey, monitoring and beneficiary feedback platforms most NGOs use in programme delivery.
/ Regulatory compliance — ordered by enforcement maturity
One principle cuts across every instrument in this table: retention must be purposeful and time-limited. Any AI deployment premised on the open-ended accumulation of organisational data is structurally at odds with humanitarian data standards. Accumulation is not governance.
Instrument
What it requires
Status
GDPR
Lawful basis; data minimisation; subject rights; 72-hour breach notification
In force
UN Personal Data Protection and Privacy Principles
Applicable to UN entities and all operational partners
In force
nLPD
Switzerland's revised Federal Act on Data Protection — applies to all organisations with Swiss operations or Swiss-resident data
In force since September 2023
EU AI Act
Risk classification; documentation; human oversight; conformity assessment for high-risk systems
Fully applicable August 2026
Digital Services Act
Transparency and accountability for public-facing digital systems
In force
EU Data Governance Act
Rules governing reuse and sharing; relevant to NGOs in data altruism schemes
In force
How we work
Each phase is a prerequisite for the next. The sequence is not a preference — it is a protection architecture.
- 01
Data governance foundation
Classification, access controls, sovereignty decisions and retention policy established before any AI system connects to organisational data
- 02
AI literacy
Every staff member understands what AI can and cannot do — and what it must never do with the data the organisation holds
- 03
Productivity
Administrative processes become faster, governed and auditable — returning capacity to mission
- 04
Programme intelligence
Field data surfaces decision-relevant insights within a fully governed environment
- 05
Organisational capability
An internal intelligence layer grounded in the organisation's own knowledge, policies and humanitarian mandate
Guardrails built into every engagement
- 01Data classification and sovereignty decisions — before any system connection
- 02Human review and accountability at every decision point affecting people directly
- 03Access controls, cybersecurity and field-context security protocols applied by design
- 04AI usage policy aligned with the humanitarian mandate and applicable law
- 05Only approved, auditable systems within a defined and documented scope
- 06Ongoing output monitoring, error correction and scheduled ethical review
- 07Staff AI literacy training, including operational application of do-no-harm principles
What it looks like in practice
[ 01 ]
Programme analytics
Beneficiary data from the field surfaces trends and anomalies with full traceability of how that data was collected, processed and protected. Leadership makes programme decisions grounded in real field conditions.
[ 02 ]
Reporting and accountability
Field data and programme notes move through a governed drafting process. Staff verify, contextualise and submit. Accountability to affected populations is built into the output — not only accountability to donors.
[ 03 ]
Institutional memory
Decisions, owners and actions are captured in a structured record, retained according to minimisation principles and accessible only to those with a documented need.
Frequently asked questions
The people you serve gave their data in trust.
We help NGOs build AI governance frameworks grounded in humanitarian principles, international law and field operational reality — before systems are deployed, not after incidents force the question.