An employee is preparing for a customer meeting and wants an AI assistant to summarise a lengthy proposal. They paste the document into a chatbot, get a good response, and carry on with their day.
What may never have been considered is whether the proposal was approved for the service, which account the employee used, or whether the information should have been shared outside the organisation at all. The employee has made a security decision while trying to finish an ordinary task.
I think this is where businesses need to focus. Employees have perfectly sensible reasons to use AI. If nobody explains the boundaries, people are left to figure them out themselves.
When employees choose their own tools
There is a difference between using an approved business AI service and an employee working through a personal account without company oversight. How information is handled depends on the service, its settings, and any applications connected to it.
That distinction is important when discussing ChatGPT. According to OpenAI’s published data policies, inputs and outputs from its Business and Enterprise products are not used to train models by default. Personal accounts have different data controls, including an option to disable model training. Treating every ChatGPT account as equally risky would therefore be inaccurate.
Even when model training is disabled, management still needs to understand what information employees are sharing and whether the service is authorised to handle it. An employee could upload confidential customer information or connect an AI application to company files without understanding what access they are granting.
For South African businesses, this also raises questions about compliance with the Protection of Personal Information Act (POPIA) when personal information is involved. A policy telling people to be careful is unlikely to help much when they are working against a deadline. Employees need clear guidance on which services are approved and what they can do with company information.
Give employees an approved environment
For organisations already using Microsoft 365, Microsoft 365 Copilot provides an opportunity to introduce AI within a familiar working environment. Prompts, responses, and information accessed through Microsoft Graph are not used to train foundation models. Copilot also respects the access permissions employees already have within Microsoft 365.
This allows businesses to connect AI adoption to their existing identity and information governance arrangements. Microsoft Purview can add controls to classify and protect sensitive information, including data loss prevention policies, when the appropriate capabilities are licensed and configured.
Employees should know which AI tools they can use with company information. If someone wants to upload a customer document or connect a new AI application to company files, they should check with IT before proceeding.
The intention should be to make approved AI use practical enough that employees have a good reason to follow the organisation’s policies.
Check what Copilot can already access
There is an important consideration before Microsoft 365 Copilot is introduced more widely. Copilot works with the information a user already has permission to access. In many organisations, those permissions have accumulated over years as employees changed roles, departments collaborated on projects, and SharePoint sites were shared with larger groups.
Someone who moved departments months ago may still have access to files from their previous role, and Copilot can surface that information because those permissions are still in place.
This is one reason Microsoft recommends reviewing overshared information and unnecessary access before introducing Copilot more widely. This work requires deliberate attention. Purchasing Copilot licences does not automatically correct old permissions or ensure that sensitive information is properly classified.
When I assess an organisation’s readiness, I want to understand what people can currently access, whether that access is justified, and where existing controls need attention. Discovering those weaknesses early is already useful.
Test AI under normal working conditions
Businesses can learn a considerable amount about safe AI adoption without committing immediately to a large deployment.
Through Work Smarter in 30 with IPT, eligible organisations can evaluate Microsoft 365 Copilot Business with 25 users over 30 days. The programme allows employees to use Copilot in familiar work while the business assesses where it is useful and what preparation may still be required.
I would pay attention to how employees actually use the technology during that period. Their experience can reveal whether they need more guidance, whether information is accessible appropriately, and where governance controls need improvement before adoption expands.
Businesses should also be able to explain their AI policies in the context of work employees recognise, rather than expecting everyone to interpret a technical security document.
People will continue looking for easier ways to complete their work. I would rather give them an approved environment, clear rules, and the support to use AI properly than leave them making information-sharing decisions without guidance.
IPT can help businesses review their Microsoft 365 environment, address readiness concerns, and determine whether they qualify for Work Smarter in 30. The aim is to give employees useful AI capabilities while keeping appropriate control over the information the business depends on.
