Impact reporting from case notes

• Outcome measures come from structured fields first. Where they are missing, a model reads the notes and tags outcomes against the charity's own outcome framework, which a person can check.
• Every figure is calculated by a defined query on a dated snapshot of the records, not written by a language model, and can be traced back to the records behind it.
• Notes are de-identified before analysis, and small numbers are suppressed or grouped before any figure leaves the impact team.
• Emerging themes across services are surfaced for service leads to review, as internal learning, not as conclusions.
• Draft narrative sections for the trustees' report and funder reports are written around the approved figures, quoting people only where there is consent.
• Nobody is scored. The system never rates an individual service user, caseworker or team. Trustees approve the annual report, and the named grant holder approves each funder report.

• Charity regulators (the SORP-making body)Charities SORP 2026 (periods beginning on or after 1 January 2026)
  →

  Reporting is tiered by income: Tier 1 (up to £500,000) summarises main achievements; Tier 2 (to £15 million) must review performance against objectives and explain the charity's impact; Tier 3 adds a review of fundraising performance. Every figure in the impact section carries its source, period and method, and the report says what the data can't show.

• Charity CommissionThe essential trustee (CC3, updated 16 September 2026) and the Commission's view on AI
  →

  Trustees approve the annual report and can't delegate that responsibility. The Commission expects reasonable independent checks before relying on AI output for an important decision. Trustees see the method, the tagging accuracy and the limitations alongside the draft, not just the numbers.

• Charity CommissionSerious incident reporting (guidance updated 16 January 2026)
  →

  A significant data breach or loss is a reportable serious incident, reported as soon as reasonably possible, and trustees decide whether it is significant. That stays true when a supplier causes it, and the Commission has reminded trustees of this. A personal data breach may also need reporting to the ICO within 72 hours. The incident plan covers the analysis store and the AI suppliers.

• ICOUK GDPR, the Data Protection Act 2018 and statistical purposes
  →

  Case notes hold special category data such as health, and often concern people in vulnerable circumstances. A DPIA settles the lawful basis and the Article 9 condition before the pilot. Since 5 February 2026 the UK GDPR defines statistical purposes: the output must be aggregate data that is not personal data, and the data must not be used for measures or decisions about a particular person. That is why nothing flows back into individual records.

• ICOAnonymisation and pseudonymisation guidance (March 2025, under review)
  →

  Pseudonymised notes are still personal data; only properly anonymised outputs fall outside the law. Names, contact details and other identifiers are removed or replaced before analysis, the re-identification key stays with the case management team, and small numbers are suppressed. The ICO consulted on research-specific guidance from August to October 2026, so the rules are reviewed when it is final.

• Fundraising RegulatorCode of Fundraising Practice (in effect 1 November 2025)
  →

  When impact figures and stories are reused in appeals or bids, they must not mislead and need appropriate evidence. Case studies must reflect real situations, say if details were changed, and have the person's clear and informed permission.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• The outcome framework and its definitions are owned by the head of impact and approved by trustees. Changes are versioned.
• Caseworkers code a sample of notes each quarter, which is used to train the tagging model and to check its accuracy.
• A small-number rule, for example no figure below 10, applied before anything leaves the impact team.
• A written rule, approved by trustees, that outputs are never used to judge individual staff or service users.
• Caseworkers and service users are told how notes are used for reporting, in plain language, in the privacy notice.
• A data breach plan that covers the analysis store and the AI suppliers, with trustees deciding on serious incident reports.

1. 3–4 weeks

   Discovery

   Map today's reporting, agree the outcome framework, audit note quality and consent records, and confirm what the case management supplier allows.

2. Gate · must be true to passOutcome framework agreed, DPIA started, extract route confirmed, suppression rule set.

3. 8–10 weeks

   Pilot

   One service, last year's notes: de-identify, tag, calculate and draft, then compare with a human-coded sample and last year's reports.

4. Gate · must be true to passDe-identification tested on real notes, tagging accuracy above the agreed threshold, every pilot figure reproducible, DPO sign-off.

5. 4–6 weeks

   Production

   Live for that service's funder reports, with monitoring, support and a rollback plan.

6. Gate · must be true to passMonitoring, support model, rollback plan and impact team training in place.

7. Ongoing

   Scale

   Add services one at a time, then the trustees' annual report impact section for the year.

8. Gate · must be true to passEach new service passes the same pilot gate; trustees see the method before the first annual report.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   The language model writes numbers, and one is wrong in the trustees' report.

   How the design avoids it

   Figures come only from versioned queries. Guardrails block any number that isn't in the approved set.

2. 2

   Goes wrong

   De-identification misses local details, and a small service's story identifies someone.

   How the design avoids it

   Charity-specific rules on top of standard detection, testing on real notes, and a small-number rule before anything leaves the team.

3. 3

   Goes wrong

   Tagging works for one service and quietly fails for another.

   How the design avoids it

   Accuracy reported by service against a human-coded sample, and services added one at a time.

4. 4

   Goes wrong

   Outcome data drifts into judging caseworkers.

   How the design avoids it

   A trustee-approved rule, no staff or team scoring in the design, and aggregate outputs only.

5. 5

   Goes wrong

   Thin notes produce confident-looking figures.

   How the design avoids it

   Report coverage alongside every figure, and say plainly in the report what the data can't show.

1. Year ends from 31 December 2026
   The first trustees' annual reports under Charities SORP 2026, due within 10 months of the year end. Tier 2 and Tier 3 charities must explain their impact, not just list activities.

   Run the pipeline in shadow on this year's notes now, and agree the outcome measures with trustees before the year closes.

2. Late 2026 to 2027
   The ICO's final guidance on anonymisation and pseudonymisation for research, archiving and statistics, after consultation from August to October 2026, alongside its updated guidance on the research and statistics provisions.

   Keep de-identification and suppression rules as configuration, so they can be tightened without a rebuild.

3. 2026–2027
   The ICO's statutory code of practice on AI and automated decision-making, required by regulations in force since May 2026.

   Keep the records that show outputs are aggregate and never used for decisions about individuals.

4. Late 2026–2028
   The Cyber Security and Resilience Bill, still going through Parliament, would bring medium and large managed service providers into regulation, with duties set by secondary legislation.

   Expect your IT, case management and AI suppliers' duties to change, and review contracts and the breach plan with them.