Every bid drafted from the charity's own approved evidence, every figure traced to its source, each funder's terms checked first, and a named person approving before anything is sent.
At a glance
An illustrative scenario. The numbers are typical examples, not a client case study. The cloud services and UK rules were checked on 9 November 2026.
Grants are a large share of income for many charities, and the work behind them is mostly searching. A bid writer reads the funder's guidance, works out whether the charity is eligible, then hunts for the latest outcomes figures, a case study someone agreed could be used, the right budget lines and the current safeguarding policy. The same facts are rewritten for every funder, in a different word count and a different order.
Figures drift. Last year's number of people supported appears in one bid and this year's in another. A case study is reused after the person's consent has lapsed, or in a way they never agreed to. Budgets in the bid don't match the finance system. None of this is dishonest, but funders notice, and some of it matters legally: government grant agreements usually let the funder claw money back if the application turns out to be inaccurate or misleading.
Funders have also changed. Many report far more applications than before, and some link the rise to AI tools. Experienced assessors say generic AI text is easy to spot: fluent, vague and interchangeable. Some funders now ask whether AI was used, some research funders set clear rules on it, and a few have closed open rounds altogether. A charity that uses AI to send more, weaker bids will lose ground. The aim here is fewer, better-evidenced bids, written faster.
Agree these, and measure the baseline, before anything is built. Example targets are typical, not promises.
Hours from deciding to apply to a draft ready for editing.
ExampleFrom 3 days to under half a day
Share of figures, quotes and claims in a sent bid that link to an approved, in-date source.
ExampleEvery one
Figures the approver had to change because they didn't match finance or impact data.
ExampleFalling month on month
Bids started for funds the charity didn't qualify for, or that ruled out its approach.
ExampleClose to zero
How much writers change the drafts. Very high means it isn't helping; near zero can mean drafts are sent unread.
ExampleStable, and reviewed monthly
Awards per application, and what funders say, compared with last year. AI doesn't win bids; this checks it isn't losing them.
ExampleNo worse than last year, then improving
Cross-sector rules are on the UK regulation map.
Trustees can delegate day-to-day work but not responsibility. The Commission hasn't issued AI-specific guidance; it expects trustees to apply their existing duties, not to rely on AI output for important decisions without reasonable independent checks, and to consider an internal AI policy. The trustees approve the charity's AI policy, and a named person, not the tool, approves each bid.
The revised guidance covers trustees' oversight of fundraising, including grant fundraising and the use of AI, and how it fits with managing fraud and other risks. Report the AI-assisted process to the board like any other fundraising change.
Fundraising must be legal, open, honest and respectful, must not mislead, and needs appropriate evidence for claims. Grant applications must be prepared responsibly, and changes to how a grant is spent need the funder's written permission. Case studies must reflect real situations, say if details were changed, and have the person's clear and informed permission. The regulator's AI guidance asks for a person to check accuracy and fairness before use.
Funders' rules vary and change. UKRI's policy (September 2024), for example, lets applicants use generative AI with care, asks them to declare substantive use, rules out AI writing whole applications or sections without human involvement, and makes applicants responsible for anything falsified, fabricated or misrepresented. Other funders ask for declarations, discourage AI, or say nothing. The fit check reads each funder's current rules before drafting starts.
Statutory funders must assess fraud risk and do due diligence on every scheme. The government's model grant funding agreement makes materially misleading or inaccurate information in an application an event of default. If a 'grant' is really a contract for services, it is a procurement, and supplying misleading information is an exclusion ground under the Procurement Act 2023. The library records which is which, as the annual return asks for government grants and contracts separately.
A knowingly false statement to win a grant can be fraud by false representation. The corporate offence applies to large incorporated bodies meeting two of three tests (over 250 staff, over £36 million turnover, over £18 million assets), including large charitable companies, unless they had reasonable prevention procedures. A mid-sized charity may be below the thresholds, but the evidence check and sign-off log are good practice either way.
Case studies, outcomes data and staff CVs are personal data, and stories about service users often touch special category data. Only consented, minimised case studies enter the library, consent records travel with them, personal details are checked before indexing, processing stays in UK regions, and the contract stops providers training their models on the charity's data.
Showing AWSAzuresovereign / on-prem services. Switch with the toggle; every diagram and table on this page follows it.
01Channels
02Intake
03Intelligence
04Orchestration
05Systems of record
06People
| Layer | AWS | Azure | Sovereign / on-prem |
|---|---|---|---|
| Intake: funder documents, pipeline eventsEach bid gets its own folder, holding the funder's guidance and terms at the date they were read. | API Gateway, S3 | API Management, Blob Storage | Kong or your existing API gateway; Ceph or IONOS S3 Object Storage |
| Reading funder documentsGuidance comes as PDFs, web pages and portal forms. Questions and word limits are pulled out so drafts follow the funder's structure. | Amazon Textract | Azure Content Understanding (includes Document Intelligence) | Open-source parsing (e.g. Docling) plus an open-weight vision model |
| DraftingBoth clouds offer a choice of models, including Claude. Prompts ask for the charity's own voice and specifics, not generic grant language. | Amazon Bedrock | Microsoft Foundry | Open-weight models served with vLLM on your own GPUs, or IONOS AI Model Hub |
| Evidence library (retrieval)Only approved content: outcomes figures with their period, consented case studies, budgets, policies and organisation facts. Each item has an owner and an expiry date. | Bedrock Knowledge Bases | Foundry IQ, built on Azure AI Search | OpenSearch, or PostgreSQL with pgvector |
| Personal data check before indexingCatches names and contact details left in case studies or notes before they reach the library. A person reviews what it finds. | Amazon Comprehend PII detection | Azure Language in Foundry Tools (PII detection) | Open-source PII detection (e.g. Microsoft Presidio) |
| Agent runtimeThe original Bedrock Agents closed to new customers on 30 July 2026; new builds use AgentCore. | Amazon Bedrock AgentCore | Foundry Agent Service | An open-source agent framework (e.g. LangGraph) on Kubernetes |
| WorkflowTracks each bid from fit check to sign-off against the deadline, including who still needs to confirm a figure. | AWS Step Functions | Logic Apps or Durable Functions | Temporal, or n8n |
| Middleware and events | Amazon EventBridge, SQS | Event Grid, Service Bus | Apache Kafka or RabbitMQ |
| Link to CRM, finance and outcomes dataConsent withdrawn or a figure updated arrives as an event, so the library changes without anyone remembering to tidy it. | API Gateway, plus your existing integration platform if you have one | API Management, plus your existing integration platform if you have one | Kong or your existing API gateway, plus your existing integration platform if you have one |
| Human reviewWriters edit where they already work. If the charity already uses Microsoft 365, drafts can land in the documents and channels the team already uses. | In the team's existing documents and grants pipeline | In the team's existing documents and grants pipeline | In the team's existing documents and grants pipeline |
| GuardrailsBlocks drafts that state a figure, quote or partner name not found in the library. | Bedrock Guardrails | Foundry guardrails (Azure AI Content Safety) | Open-source guardrails (e.g. NeMo Guardrails, Llama Guard) |
| Identity, keys, data protectionWriters see the library, not the case management system behind it. | IAM Identity Center, KMS, Macie | Entra ID, Key Vault, Purview | Keycloak or your existing Active Directory; OpenBao or HashiCorp Vault; an HSM |
| Monitoring and auditLog every draft, every source used, every edit and every approval, kept with the bid. | CloudWatch, CloudTrail | Azure Monitor, Log Analytics | Prometheus, Grafana, OpenTelemetry |
| UK data residencyIONOS AI Model Hub runs in German data centres: EU, not UK, residency. Some funders' terms may require UK processing. | eu-west-2 (London) | UK South / UK West | Your own UK data centre, or a UK or EU provider |
On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →
Many organisations keep core systems and sensitive data on their own servers. This is how the same design works across both.
Stays on-prem
The CRM, finance system and case management system stay where they are, whether hosted by a supplier or on the charity's own servers. Service user records never move into the AI. Only approved outcome figures and consented case studies are copied into the library.
Uses cloud AI
Reading funder documents, the evidence library and drafting run in a UK cloud region, or on the charity's own GPUs for the sovereign option. A charity of this size rarely needs its own GPUs; managed services in a UK region are usually the simpler choice.
How they connect
Through the API layer over encrypted connections, typically a site-to-site VPN for a charity this size, or AWS Direct Connect or Azure ExpressRoute for larger ones. Only library items and bid documents cross the link.
If the link drops
Bid writing carries on by hand, as it did before. Drafts and the last approved copy of the library are kept in the team's own documents, so a deadline is never lost to an outage.
What each agent may do through its tools, what it may not, and where a person signs off. The limits are enforced by the platform, not the prompt.
Funder fit and terms check
Where a person signs offThe head of trusts and grants decides whether to apply. Where a funder restricts or bans AI, the bid is written without the drafting assistant.
Bid drafting assistant
Where a person signs offA named approver signs off every bid, after the figures' owners have confirmed them. The agent's permissions are enforced by the platform's identity and policy controls, not by instructions in a prompt.
The CRM or grants pipeline stays the record of every application, decision and grant condition. The AI reads funder details from it and writes a draft status back through the API layer, never directly into its database.
The evidence library is fed by events, not copied by hand. An updated outcomes figure, a new budget or a withdrawn consent arrives as a message, the library item is replaced or retired, and every draft that used it is flagged for review.
The AI can be switched off without stopping fundraising. If it's paused, writers work from the same library through a normal search, exactly as they would without drafting help.
Map today's bid process, measure the baseline, list current funders' AI rules, audit where evidence lives and the state of case study consents.
Gate · must be true to passBaseline agreed, evidence owners named, DPIA started, AI policy drafted for trustees.
One funding round, in shadow mode: the assistant drafts alongside writers working as normal, and the two are compared on accuracy, sources and time.
Gate · must be true to passEvery claim in pilot drafts traced to a source, edit rate within agreed limits, and sign-off from the head of trusts and grants.
Drafting goes live for trust and foundation bids, with monitoring, support and a rollback plan.
Gate · must be true to passMonitoring, support model, rollback plan and writer training in place; trustees approve the AI policy.
Add statutory bids, grant reports and renewals, then reuse the library for the trustees' report and supporter communications.
Gate · must be true to passEach new bid type passes the same pilot gate.
| Activity | Director of fundraising | Head of trusts and grants | Solutions architectI can fill this | Technical PMI can fill this | EngineersI can fill this | Data protection lead | Finance and impact leads |
|---|---|---|---|---|---|---|---|
| Business case and AI policy | Accountable | Responsible | Consulted | Consulted | Informed | Consulted | Consulted |
| Target architecture | Informed | Consulted | Accountable and Responsible | Consulted | Consulted | Consulted | Informed |
| Evidence library content and owners | Informed | Accountable | Consulted | Consulted | Responsible | Consulted | Responsible |
| DPIA and case study consents | Consulted | Consulted | Consulted | Informed | Informed | Accountable and Responsible | Consulted |
| Build and integration | Informed | Consulted | Accountable | Responsible | Responsible | Informed | Consulted |
| Pilot on a real funding round | Informed | Accountable | Consulted | Responsible | Responsible | Consulted | Consulted |
| Go-live decision | Accountable | Responsible | Consulted | Responsible | Informed | Consulted | Consulted |
| Run, monitor and improve | Informed | Accountable | Consulted | Consulted | Responsible | Consulted | Consulted |
R ResponsibleA AccountableC ConsultedI Informed· not involved
Option A
If there's no architect on the programme, I'd own the design end to end: the evidence library and how it stays current, the link to your CRM and finance data, the drafting and the sign-off gates. I'd report to your director of fundraising and keep the trustees' AI policy and the build in step.
Option B
If your partner or your own team already has an architect, I'd take on the evidence library, the retrieval and the integration with your CRM and finance systems under their lead, and give them a second senior opinion on data protection and the controls around sign-off.
Goes wrong
Drafts read like everyone else's bid, and assessors notice.
How the design avoids it
Drafts built from the charity's own evidence, rewritten in its own voice, with funder feedback reviewed monthly.
Goes wrong
The tool is used to send more bids, not better ones.
How the design avoids it
A fit check before any writing, and success rate and funder feedback measured alongside time saved.
Goes wrong
A figure in the bid doesn't match the accounts or last year's report.
How the design avoids it
Figures come only from the library, each owner confirms theirs, and the approver sees the source next to every number.
Goes wrong
A case study is used beyond what the person agreed to.
How the design avoids it
Consent records travel with each case study, are checked before drafting, and withdrawals retire it everywhere.
Goes wrong
A funder's rule on AI is missed.
How the design avoids it
The fit check reads every funder's current terms first, and the bid record shows how AI was used.
Changes already announced or under way that affect this design. More in the UK horizon scan.
For charities that apply to research funders, feed each call's assessment notes into the fit check. With desk rejection, an eligibility mistake costs the whole bid.
Keep a per-answer record of AI use, and put the time saved into relationships and fewer, stronger bids.
Draw bid figures from the same approved figures as the trustees' report, with the same periods and definitions.
Review how outcomes data is de-identified before it enters the library once the final guidance lands.
Good answers are specific. Vague answers to any of these are worth following up.
Whether you need someone to lead the design or to support the architect you already have, let's talk it through.
