Most mid-sized organisations are using AI tools daily, but few have the policies, controls and data hygiene to use them safely. What we see across our client base and what to fix first.
Generative AI has moved from experiment to everyday tool. Staff paste customer data, contracts and code into AI assistants whether or not the business has a policy.
The gap is not adoption. It is governance: who can use which tools, with what data, and how the outputs are checked before they reach a customer.
The organisations doing this well treat AI like any other business system. They start with an inventory, set clear rules, and use the controls already in Microsoft 365 before buying anything new.
Across the environments we review, AI assistants are in daily use in almost every team. In most cases there is no approved list of tools, no usage policy and no visibility of what data is leaving the business.
Businesses that had already tidied permissions, retired stale file shares and labelled sensitive data got value from AI quickly. Those that had not found the tools surfaced information people should never have been able to see.
Sensitivity labels, data loss prevention and conditional access in Microsoft 365 cover the majority of AI-related risks. Few organisations have switched them on.
