What should an AI due diligence policy for grant funders include?

Five things: what the AI may do, what it may not do, what data it may receive and where that data is processed, who reviews its output and how, and how each check is recorded. Add the action you take in each risk band, and the name of the person who approved the policy.

Should AI be allowed to score a grant applicant?

We recommend not. A score should come from a fixed formula that gives the same result for the same record every time, so you can explain it to a panel or an auditor. AI is better used to read the record and explain it in plain English for a person to check.

What data should an AI due diligence tool receive?

As little as possible. It needs the applicant’s name and registered numbers to find the public record, and nothing else. Your policy should state where that data is processed and confirm that application data, grant records and personal data stay inside your own system.

Does using AI change your due diligence duties?

No. Your duties come from your policy, your funder agreements and any standards you follow. An AI tool gathers and explains the public record. It does not certify that you have met any duty, and your process still needs to show what you checked and why you decided as you did.

How does the Flexigrant AI Due Diligence Checker fit these parameters?

It is built to them. A fixed formula scores five factors and the AI only writes labelled analysis notes. Only the typed name and numbers are sent, processed in the EU. Access is limited to Manage Grants users by default and can be restricted by role or switched off. Every item links to its source record.

Can you restrict who uses the AI Due Diligence Checker in Flexigrant?

Yes. By default, any user with Manage Grants access can run a check. The GMSAIDueDiligence role narrows that to named users, and a tenant setting switches the checker off for your whole organisation. You request either change by raising a ticket on the support portal.

See the parameters working on your own applicants

Book a demo, and we will run the checker on organisations you name and show you how each of your five parameters holds on screen.

Where is the AI Due Diligence Checker in Flexigrant?

It sits in the Manage Grants menu under AI Due Diligence. Any user with access to Manage Grants can open it by default. If you cannot see it, your administrator may have restricted access or switched the checker off for your organisation.

Do you need a company or charity number to run a check?

No. You can search by organisation name alone. We recommend adding the number because registered names often differ from trading names, and a number takes the checker straight to the right record. A Scottish charity number is required if you want OSCR included.

Why does the check show no OSCR section?

The checker searches OSCR, the Scottish Charity Regulator, only when you enter a Scottish charity number. If you searched by name or by an England and Wales number alone, the OSCR section does not appear. Add the Scottish number and run the check again.

What does the risk score percentage mean?

A fixed formula scores five factors and shows the result as a percentage of the factors it could assess. Factors with no data are left out rather than guessed. The percentage falls into one of three bands: Low (0 to 30%), Medium (31 to 60%) and High (61 to 100%).

Can you rely on the AI analysis notes?

Treat them as a starting point. The notes are labelled as AI-generated commentary and can misread a record. Every item on the results page links to its source, so check each point against the register before you rely on it or repeat it in a paper.

Does the check use data from your Flexigrant applications?

No. The checker sends only the organisation name and registered numbers you type. It does not use application data, grant records or anything else held in your Flexigrant tenant. Processing takes place in the EU.

What should you do if the checker finds no match?

Check the number you entered for a typing error and try again. If you searched by name, find the registered name and number on the register and search with those instead. Some organisations, such as small unincorporated groups, have no registered record to find.

When did the failure to prevent fraud offence come into force?

The offence came into force on 1 September 2025. It applies to fraud committed on or after that date by a person associated with a large organisation. The Home Office confirmed the date in its statutory guidance, first published on 6 November 2024.

Are charities covered by the failure to prevent fraud offence?

Yes, some are. A charity is covered if it is incorporated, such as a charitable company or CIO, and passes the large organisation test. That test requires two of three thresholds in the previous financial year: more than 250 employees, £36 million turnover, or £18 million in total assets.

What is the defence to the failure to prevent fraud offence?

The defence is that the organisation had reasonable fraud prevention procedures in place. The Home Office guidance describes six principles: top level commitment, risk assessment, proportionate procedures, due diligence, communication and training, and monitoring and review. The organisation must prove the defence.

Is a grant recipient an associated person?

Usually not. An associated person performs services for or on behalf of the organisation. A grantee that spends a grant on its own work receives a benefit rather than acting for you. A partner that delivers your programme in your name may be an associated person, and that depends on the facts.

How does a grant-making charity work out if it is a large organisation?

Apply the two of three test to the previous financial year: employees, turnover and total assets. The Charity Commission's regulatory alert of 4 February 2025 frames the turnover test as "£36m of income", so apply it to total income in your accounts. Take professional legal advice if you sit close to the line.

Does the offence apply to public bodies such as councils?

Yes, where they meet the size thresholds. The Home Office guidance names NHS trusts and local authorities as examples of public sector organisations that can be in scope. Government departments and arm's length bodies should also read the Government Functional Standard for grants, GovS 015.

Do register checks on grantees satisfy the reasonable procedures defence?

No single check satisfies the defence. Reasonable procedures are a whole framework, from board commitment to monitoring and review. Register checks can form part of the due diligence principle, and you should document how they fit your wider fraud risk assessment.

Who can use the AI Due Diligence Checker by default?

Any user with access to the Manage Grants menu in Flexigrant can run a check. The checker ships this way in v4.66. If that is wider than you want, the GMSAIDueDiligence role lets you restrict access to named users.

What is the GMSAIDueDiligence role?

It is a dedicated role in Flexigrant that restricts the AI Due Diligence Checker to the users who hold it. Once the role is enabled for your tenant, users without it cannot run checks. You ask for it by raising a ticket on the support portal.

How do you switch off the AI Due Diligence Checker?

Raise a ticket on the support portal and ask for the AI Due Diligence tenant setting to be switched off. Once applied, nobody in your organisation can run a check. To switch it back on later, raise another ticket.

Can you keep the checker on but limit who uses it?

Yes. That is what the GMSAIDueDiligence role is for. The checker stays available to the users who hold the role and unavailable to everyone else. The tenant setting is the stronger option and removes the checker for everyone.

Does the checker send our Flexigrant data anywhere?

No. It sends only the organisation name and registered numbers that the user types into the search. No application data, grant records or personal data from your Flexigrant tenant leaves the system. Processing takes place in the EU.

Where do you raise the ticket?

On the Flexigrant support portal, the same place you raise any other support request. State whether you want the GMSAIDueDiligence role enabled, and for whom, or the tenant setting switched off. Keep the ticket reference for your records.