Most of the organizations we talk to are not asking whether to use AI. They are asking how to use it without creating a problem they did not have last year.
Here is the one thing we want every owner and managing partner to understand before Copilot goes live. Copilot does not have its own access. It has yours. Whatever a person can open in SharePoint, OneDrive, Teams or their mailbox, Copilot can find, read and summarize for them. That is the whole product.
So the risk is not the AI. The risk is the sharing you have already done and forgotten about.
What we find, almost every time
When we run a permissions review before a Copilot rollout, the same things show up in organization after organization:
- A finance or HR folder shared with “Everyone” years ago, so a project could get done that week.
- Sharing links set to “anyone in the organization” that were meant for three people.
- A departed employee’s OneDrive, transferred to a manager, still holding things that were never meant to move.
- Client files in a Teams channel that half the company can see.
None of it is a scandal. It is how work happens. But today it takes someone deliberately going looking to find any of it. With Copilot on, a reasonable question — “summarize our compensation plans” — returns it.
The order that works
- Audit what is shared, and fix it, before the first license is assigned. This is the step most rollouts skip because it is unglamorous. It is the step that matters.
- Write the one-page policy. What is allowed, what never goes into a public tool, who approves a new one. Short enough that people read it.
- Pilot with a small group for a couple of weeks, then expand. Licenses get added when there is a reason, not all at once.
- Train people on what it is good at, what it is bad at, and the new phishing tricks it makes easier.
- Rerun the audit every quarter. Sharing drifts. The review has to be a habit, not a project.
If you are on a managed plan with us, the policy and the first audit are already part of your security baseline. If you want the whole program, from discovery through training, that is scoped separately — and the first conversation is free.
The question to ask your IT provider this week is not “should we turn on Copilot?” It is “what would it see if we did?”