Is AI in grant management software safe under GDPR?

It depends on what data the AI processes, where, and what controls you have. For Flexigrant’s AI Due Diligence Checker, the AI step runs on Azure OpenAI in the EU, uses only the organisation name and numbers you type, is not used for training, and can be restricted by role or switched off. Your own assessment makes the final call.

Does Flexigrant send our grant data to the AI?

No. The only data used from Flexigrant is the organisation name and registration numbers your user types into the checker. Application forms, applicant contact details, grant records and documents are not sent.

Where is the AI processing carried out?

The AI step is processed in the EU, on Azure OpenAI. Flexigrant does not claim UK processing for the AI step. Your Flexigrant data itself is not sent to the AI step at all.

Is our data used to train the AI model?

No. Data sent to Azure OpenAI by the checker is not used to train the models. Microsoft’s abuse monitoring may store a sample of a flagged request for review; for the checker, that would be an organisation name and its registration numbers.

What is Microsoft abuse monitoring?

It is a check Microsoft runs on Azure OpenAI to detect misuse of the service. If a request is flagged, Microsoft may store a sample of it for review. The checker sends only organisation names and registration numbers, so that is what any stored sample would contain.

Can we restrict who uses the AI Due Diligence Checker?

Yes. By default it is available to users of the Manage Grants menu. A dedicated role limits it to the users you choose. Ask Flexigrant support to enable the role through a support ticket, then assign it to your due diligence team.

Can we switch the AI Due Diligence Checker off?

Yes. A tenant setting switches the checker off for every user in your organisation, and nothing is sent to Azure OpenAI while it is off. Request it through a support ticket, and request it back on the same way.

Is the risk score in Flexigrant’s AI Due Diligence Checker produced by AI?

No. A fixed formula calculates the score from public register data, and the same inputs always give the same result. Azure OpenAI writes only the plain-English summary and analysis notes, which are labelled as AI-generated and should be checked against the source records.

What does a grant applicant risk score of 45% mean?

A score of 45% falls in the Medium band, which runs from 31 to 60%. It means the register data raised some concerns but not many. Read the factor breakdown and any red flags to see where the points came from, then apply your funding policy.

Why is the score out of 80 and not 100?

Because one of the five factors had no data in the registers, so the checker excluded it rather than guessing. Each factor with data is scored, and the percentage shows points scored against points available. The screen tells you which factors were assessed.

Does a High score mean we should refuse the grant?

No. A High score, 61 to 100%, means the register data raised several concerns. Your funding policy decides what follows, such as a second review or a request for more information. The checker is advisory and does not make funding decisions.

What is a red flag in the AI Due Diligence Checker?

A red flag is a specific finding in the register data that the checker highlights separately from the overall score, with a link to the register that raised it. It shows you where to look and what to ask the applicant about.

Can we see how the score was calculated?

Yes. The checker shows the score, the breakdown by factor, which factors were assessed, and any red flags. Each register field is labelled by its source and linked to the original record, so you can follow every point back to the data.

Does the risk score replace our due diligence policy?

No. The score is advisory. It gives every applicant the same documented starting point from public register data. Your policy decides what each band and each red flag requires, and your team records the decision.

What checks should you do before awarding a grant to a charity?

Confirm the charity is registered and active on the Charity Commission or OSCR register. Check that its accounts and annual return are up to date. Read its recent income and spending. Identify the trustees. If it is also a company, check Companies House for status, filings, charges and insolvency data. Then apply your own policy.

How do you check a company before giving it a grant?

Search Companies House by company number. Confirm the company is active. Check the filing history for late or missing accounts. Review the directors, any charges registered against the company, and any insolvency events. Read the latest accounts for financial health, and remember they describe a period that has already ended.

Do you need to check both Companies House and the Charity Commission?

Yes, if the applicant is a charitable company in England or Wales. It has a record on both registers, and each shows different information. Companies House shows charges and insolvency data. The Charity Commission shows charity-specific filings and trustee details.

Why do funders ask for a charity number on the application form?

Because registered names often differ from working names, and two organisations can share a name. A registered number takes you straight to the right record and removes the risk of checking the wrong organisation.

Can software do the due diligence check for you?

Software can gather the register data in one place and apply the same formula to every applicant. The AI Due Diligence Checker in Flexigrant does exactly that. The decision remains yours. The checker is advisory and supports your policy rather than replacing it.

What is the AI Due Diligence Checker in Flexigrant?

It is a search built into Flexigrant that retrieves an applicant’s records from Companies House, the Charity Commission for England and Wales and OSCR. A fixed formula scores five risk factors, and Azure OpenAI writes a labelled plain-English summary. It is included in every Flexigrant subscription.