For charities running Microsoft 365 that have switched on Copilot or AI agents. A reference model, a ladder with a gate at every step, and plans your board and your IT team can work from.
Find out in three minutes whether your charity has the ten foundations in place before AI goes further.
AI does not create access. It reveals access that already exists. Most charities switched on Copilot or an assistant before anyone checked what it could reach, who owns each assistant, or who could stop one. The gap between what is happening and what the board knows is the risk.
Charity Digital Skills Report 2026, published July 2026 (charitydigitalskills.co.uk).
The things a charity must be able to do to run AI safely, from "one list of every piece of AI in use" to "every AI system can be stopped by a named person through a route that has been tried". Each one says what proves it works and which recognised standard it maps to: ISO/IEC 42001 (the international AI management standard), NIST's AI Risk Management Framework, and others.
A ladder of AI ambition: from foundations, through letting AI read your organisation's knowledge, up to autonomous agents, with the gate that must be passed before each step. It tells you which rung you are on, which one you are reaching for, and what has to be true first.
Based on NIST's Cybersecurity Framework: done once and informally (Partial); done because someone understood the risk (Risk Informed); done the same way every time and written down (Repeatable); done and improved as things change (Adaptive). Every capability is read twice, on how firmly the organisation decides it and on how firmly it actually operates. The two are never averaged, and the gates on the ladder are set on what operates. That is why a control which is written and approved, but not switched on, does not pass.
The sector's regulators quoted from their own pages in the regulators' own words, the red lines a charity board should set, and the risks that are specific to charities: supporter data, service users, donations and Gift Aid, safeguarding. The core model, for any sector, is at → the RAISE Method.
What makes it different. Your board paper, your technical plan and your control map are all in sync and based on one and the same model.
It starts with the AI Exposure Scorecard, which tests the foundations: ten questions on what every charity needs in place before AI goes further. Your score tells you whether to go deeper. If you do, the assessment takes about eight weeks, in four stages.
If you are further on, and about to let agents take actions in live systems rather than only answer questions, there is a second scorecard for that rung. → Take the agentic control scorecard
We pull what is actually switched on in your Microsoft 365 estate: licences, assistants, connectors, sharing and labelling, audit and retention. Your IT team works through a short questionnaire with us. "We don't know" is a real answer.
Your position against every capability that applies to you, with the evidence. The gaps, in the order to close them, and what each one costs.
One session with your executive or trustee group. A board paper in plain English: where you are, what the risks are, what we recommend, and the red lines to set.
The technical plan and the control map go to your named owner, together with your charity's own overlay: your position against each capability in the reference model, so your team can keep it current.
Extras are agreed as a change on request.
Find out in three minutes whether your charity has the ten foundations in place before AI goes further.
Ossama Adel, enterprise AI architect and AI security and governance specialist, with twenty years of Microsoft enterprise architecture and information governance. Most recently, he designed and put into operation an enterprise AI governance and security framework at a large UK charity through 2026; that work is powered by the RAISE Method.
Write to ossama@raiseai.co or book a 30-minute intro call.