Perspectives

Humanitarian organizations are already using AI to review supplier quotes, validate health data and communicate with the communities they serve. But the rules around AI are evolving, and many teams work in fragile settings without in-house legal support. The practical question is not whether these rules matter, but what to do about them before a prototype goes live.

Humanitarian organizations are already using AI to review supplier quotes, validate health data and communicate with the communities they serve. But the rules around AI are evolving, and many teams work in fragile settings without in-house legal support. The practical question is not whether these rules matter, but what to do about them before a prototype goes live.

What does the EU AI Act mean for humanitarian AI?

The EU AI Act applies based on the AI system and its effects, not only where an organization is registered. It takes a risk-based approach:

• Prohibited – banned outright. (e.g., social scoring of aid recipients, emotion recognition of staff)
• High-risk – strict requirements, from December 2027 (e.g., eligibility for essential services, recruitment, biometric identification, asylum)
• Transparency – people must be told it is AI, since August 2026 (e.g., chatbots for communities, AI-generated campaign media)
• Minimal risk – few obligations, though data protection and other laws still apply (e.g., document extraction, translating manuals, drafting)

Even outside the EU, these standards are increasingly written into donor terms and vendor products. The EU AI Act and its risk-based approach have become the inspiration for AI regulation in many other parts of the world, for example in Vietnam’s new AI law, which took effect on March 1, 2026.

Why this matters for humanitarian organizations

The work of humanitarian organizations rests on compassion, impartiality and accountability towards the vulnerable communities they serve. These values align closely with what AI regulation seeks to protect. Yet according to TechSoup and Tapp Network’s 2025 benchmark report, while 85% of nonprofits are highly interested in generative AI, about 76% have no AI strategy and 80% have no acceptable-use policy.

Within Tech To The Rescue’s (TTTR) program, ten local and national organizations from across the globe are exploring AI to improve their humanitarian work, each with a specific bottleneck and a dedicated team. Over ten weeks, they built AI prototypes: tools that sort donor offers into standard categories (Distribute Aid, Sweden), suggest nearby facilities that can share missing medicines (inSupply Health, Tanzania), check purchase files in Arabic and English against policy, donor contract and national law (Violet, Syria), show the full purchase trail from request to delivery on one page for auditors (Basmeh & Zeitooneh, Lebanon), follow medicine quantities from handwritten pharmacy logs to monthly reports (BFD, Yemen), turn partners’ chat messages and emails into stock records (Suwannimit Foundation, Thailand), and pull key facts from funding opportunities, each linked to its source (Boxtribute).

There are real-world examples that show the importance of safe data handling in these humanitarian use cases. In 2022, the International Committee of the Red Cross suffered a cyberattack that compromised the personal data of more than 515,000 people in vulnerable situations. Incidents like these illustrate the lesson that humanitarian data is a valuable target, so it needs the same level of protection as any other sensitive data. Another lesson concerns automated assessments. When people are scored or evaluated by an automated tool, a human should review the result before it affects them. Lastly, regarding accountability, an organization remains responsible for what its tools produce, even when the output comes from an automated system.

What should organizations do?

Here are six practical steps to help you with safe AI use:

• Know your role
  Are you a provider (you built a system and launch it under your name) or a deployer (you use someone else’s)? Providers bear more comprehensive compliance obligations. Check whether you have connections to the EU, for example through donors or users, and which national rules apply where you operate.
• Minimize personal data use
  Remove names, phone numbers and IDs before text is entered into an AI tool. Voice notes, location data, and household IDs can all constitute personal data.
• Keep humans meaningfully in charge
  A reviewer must be able to overrule the AI, and have the time and training to do so. Decisions about human aid should remain with humans.
• Be transparent
  Inform people when they are interacting with AI or when AI is used to make decisions about them.
• Check tools and vendors
  Use organizational accounts with a data agreement, do not enter beneficiary data into free tools, and ask vendors where data is stored and who holds the rights to code developed pro bono.
• Start small
  Create an AI use policy, a simple register of AI uses, and the traffic-light check: green for no personal data (go ahead), yellow for personal data or operational decisions (add safeguards), red for decisions about people or health data (stop and assess first).

The bigger picture: Growing AI regulation

On the world stage, the EU’s AI Act sits alongside the OECD AI Principles, UNESCO’s AI ethics recommendation and a growing set of national laws such as Vietnam’s AI Law or South Korea’s AI Basic Act. The sector is building its own guardrails too, such as the SAFE AI Framework and IASC guidance on data responsibility. Where national law is still silent, humanitarian standards should fill the gap.

Final thoughts

Good AI compliance should not slow humanitarian teams down, as delays in the humanitarian supply chain carry a real cost in human lives. Its purpose is to enable speed in a safe manner, not to impede it. A policy, a register and traffic-light checks are a sound starting point, and all three can be in place before a prototype is ever deployed in the field.

This article builds on the AI Impact Lab session “Safe and legally compliant AI deployment in organizations,” delivered by Trilligent for Tech To The Rescue.