12 Oct Your Staff Are Already Using AI. The Question Is: Are They Using It Safely?
AI has arrived in the workplace.
Actually, let’s correct that.
AI has already arrived in your workplace.
Your staff are using it to write emails, summarise documents, create proposals, research ideas, analyse information and generally get through their work faster.
And, for the most part, that’s a good thing. At IT Guys, we’re certainly not going to tell businesses to stay away from AI. Used properly, it is one of the biggest productivity opportunities we’ve seen in years. But there’s another side to the conversation that businesses need to start taking seriously: what information are your employees putting into AI tools, and what happens to that information afterwards?
That’s why, for businesses already using Microsoft 365, we believe Microsoft Copilot deserves serious consideration. Not simply because it’s AI, but because it’s AI designed to work within the Microsoft environment your business already uses.
The AI conversation has changed
A year or two ago, the question we heard was:
“Should our business be using AI?”
Today, that question is almost irrelevant. Employees are using AI whether the business has an official AI strategy or not.
Someone needs help replying to a difficult customer email? AI. A 30-page document needs to be summarised? AI. Rough notes need to become a proposal? AI. A spreadsheet needs to be analysed? AI. The productivity benefits are obvious. The problem starts when an employee copies confidential business information into a public AI service without understanding where that information goes or how that particular service handles it.
Think about the information your staff work with every day:
- Customer information
- Pricing and quotations
- Contracts and financial information
- HR documents and internal emails
- Business strategies and supplier information
- Your company’s intellectual property
Now imagine some of that information being copied into an AI prompt.
Suddenly, AI is not just a productivity discussion. It is a data security discussion.
“But we’re already paying for Microsoft 365…”
This is where the conversation gets interesting.
Many of the businesses we support are already heavily invested in Microsoft 365. Their email is in Microsoft 365. Their documents are in SharePoint and OneDrive. Their teams communicate through Teams. Their identities and permissions are managed within Microsoft’s ecosystem.
So our question is quite simple:
If your company information already lives inside Microsoft 365, why not investigate an AI platform designed to work within that same business environment?
Microsoft states that Copilot’s enterprise data protection applies security and privacy controls to prompts and responses. Microsoft also states that prompts, responses and organisational data accessed through Microsoft Graph are not used to train foundation models. For a business working with sensitive information, that is an important distinction.
The real advantage isn’t the chatbot
This is probably the most misunderstood part of Copilot.
If you think of Copilot as simply another box where you type a question and receive an AI-generated answer, you’re missing much of the point. Microsoft 365 Copilot can bring together AI with the emails, chats and documents a user already has permission to access, while working in familiar Microsoft 365 applications. In plain English, Copilot can work where your business already works. That is a very different proposition from constantly copying information out of your business systems, pasting it somewhere else, getting an answer and then bringing that answer back.
For us, this is where things start to become really useful. AI should not create another island of information in your business. It should become part of the tools and processes your staff already understand.
Copilot doesn’t magically fix bad security
We think this point is incredibly important.
Copilot works with a user’s existing identity and permissions. That is useful, but there is a catch: if the wrong people already have access to information in Microsoft 365, AI can make that existing problem much more obvious.
This is why businesses should not look at Copilot as simply another license to switch on. Before going all-in on AI, it is worth asking:
- Who has access to our SharePoint sites?
- Who can see sensitive folders?
- Do staff still have access to information from departments or projects they have left?
- Are sensitive documents properly classified?
- Do we know where our important company information actually lives?
AI has not created these problems. In many cases, AI simply shines a very bright light on problems that were already there.
“Can’t we just tell staff not to use other AI tools?”
You can. You can also tell everyone never to reuse a password. We all know how that usually goes. A better strategy is to give employees an approved tool that is genuinely useful, then educate them about why the company wants them to use it. People do not generally paste company information into an AI tool because they are trying to create a security problem. They are trying to get their job done.
So rather than simply saying “Don’t use AI”, businesses should start saying: “We want you to use AI, but this is the AI environment we have approved for business information, and here is why.”
That is a completely different conversation. It is positive rather than restrictive.
You may already have a useful starting point
There is an important distinction between Microsoft Copilot Chat and the broader paid Microsoft 365 Copilot experience.
When eligible users access Copilot Chat with their work account, Microsoft provides enterprise data protection. For many companies, that makes Copilot Chat a logical place to start the AI conversation. As the organisation becomes more comfortable with AI and identifies real use cases, it can then look at where broader Copilot capabilities make business sense.
The important thing is to have a plan.
AI needs a company policy, not just a company credit card
Buying AI licenses is not an AI strategy. Businesses should be thinking about:
- What information may staff use with AI?
- Which AI platforms are approved?
- What information must never be entered into an unapproved service?
- Do our existing Microsoft 365 permissions still make sense?
- How are we educating staff about AI security?
- Who is responsible for reviewing how AI is being used?
These questions do not need to turn into a 60-page corporate AI policy that nobody reads. For most SMEs, a simple set of practical rules is far better than doing nothing.
Our view at IT Guys
We have been helping businesses with IT since 2006, and we have seen plenty of technologies arrive with promises to change everything.
AI genuinely feels different. The productivity opportunity is enormous, but so is the temptation to rush into it without thinking about security, privacy and governance.
Our advice is not to be scared of AI. Quite the opposite.
Use it. Experiment with it. Let your staff learn how much time it can save them. But do it with your eyes open.
For organisations already operating inside Microsoft 365, our preference is increasingly straightforward: keep business AI as close as practical to the environment where your business data, identities, permissions and security controls already live. That is why we are encouraging our Microsoft 365 clients to take a serious look at Copilot. Not because it is fashionable. Not because every employee suddenly needs another license. And not because other AI technology is not impressive.
When AI starts touching real company information, the conversation needs to move beyond “Which AI gives me the cleverest answer?”
The better question is: “Which AI are we comfortable allowing into our business?”
That is a conversation worth having.
Not sure what your staff are doing with AI?
If your team is already experimenting with AI, or you would like to understand how Microsoft Copilot could fit into your existing Microsoft 365 environment, talk to the IT Guys. We can help you look at the practical side of AI adoption: your Microsoft 365 environment, your existing security and permissions, and where Copilot could genuinely make a difference.
No hype. No unnecessary jargon. Just a sensible conversation about using AI without unnecessarily putting your company data at risk.