AI and humanitarian data: why safeguarding must come first 

In 2026, a cyberattack exposed the personal information of around 600,000 households in Gaza through a World Food Programme registration app.

Earlier incidents included a breach affecting more than 500,000 people through the ICRC and the sharing of Rohingya refugee data with Myanmar without informed consent.

Although these incidents were not caused by AI, they exposed weaknesses in humanitarian data management which AI can amplify through greater scale, speed and complexity.

AI adoption is moving faster than many organisations’ ability to establish effective governance and safeguards. The question is no longer whether humanitarian organisations will use AI, but whether they can do so without compromising the trust and safety of the people they exist to support.

The governance gap

Research shows that most humanitarian practitioners already use AI tools, yet few organisations have formal policies governing such use. Staff may use commercial AI platforms to summarise case notes, analyse supporter data or prioritise applications for assistance. Without clear guidance, sensitive information can be transferred to external systems with limited oversight, potentially crossing borders or being retained by third-party providers.

Fundamentally, this is a governance challenge. The risk materialises through people, processes and organisational culture long before it reaches the IT department. Existing approaches to safeguarding, risk management and data protection already provide a strong foundation for managing AI-related risks.

AI governance is a safeguarding issue

In humanitarian settings, AI governance should be viewed through a safeguarding lens. The key question is not whether the technology works, but whether its use could expose people in humanitarian crises to more harm. For many organisations, a misuse of humanitarian data can harm individuals as directly as failures in physical safeguarding.

Particular risks relating to humanitarian data include:

• Humanitarian data is often highly sensitive data and could cause serious harm if exposed.
• People receiving humanitarian support often have limited opportunities to give meaningful consent.
• AI-generated inferences can derive sensitive characteristics, such as health status, ethnicity or religion, from seemingly harmless information.
• AI is increasingly used to automate decisions to prioritise aid, detect fraud or assess vulnerability. Errors often disproportionately affect groups underrepresented in training data, while those affected may have no practical way to challenge decisions.

Regulation alone is not enough

Legal frameworks provide useful guidance. But many people receiving humanitarian support live in places where protections may be limited or difficult to enforce. Responsibility therefore rests with leaders and trustees to ensure the principle of “do no harm” extends to AI adoption and governance.

Taking a proportionate approach to AI

The answer is not to reject AI. Used responsibly, it can improve disaster response, legal support and operational efficiency. However, organisations need safeguards that reflect the sensitivity of humanitarian data.

Priorities include:

• Governing staff use of approved AI tools.
• Classifying sensitive data and extending impact assessments to AI.
• Minimising data collection and retention.
• Maintaining human accountability and assigning board oversight of AI to specific staff.

Trust must remain at the centre

Humanitarian work depends on trust. Data breaches, inappropriate data sharing and opaque automated decisions can quickly erode confidence and discourage people in humanitarian crises from seeking assistance.

Organisations that succeed with AI will not necessarily be those that adopt it fastest, but those that govern it responsibly, understand where harm could occur and maintain clear human accountability.

Understanding your organisation’s current AI use and associated risks is often the most valuable first step to take. Organisations seeking to strengthen their AI governance should begin by assessing how AI is already being used across programmes, operations and support functions.

Contact Maritz Cloete at [email protected] to discuss what effective AI governance means for your organisation and identify the practical steps needed to gain control, manage risk and use AI with confidence.