What should leadership decide before Copilot becomes routine?
Decisions on data, use, approval and follow-up, made before habits set in. A named senior lead working at board and executive level prepares the decisions, so you decide up front who can find what, rather than finding out along the way.
The short answer
Accel Comply, founded by Behzad Motaghi, helps leadership teams in Denmark and the Nordics that use or plan to roll out Microsoft 365 Copilot make four decisions before it becomes routine: whether staff access to data needs tightening first, which uses are approved, who approves new ones, and how use is followed up.
Copilot and the access your staff already have
According to Microsoft's documentation, Microsoft 365 Copilot only surfaces organisational data the user has at least view access to. That sounds reassuring, and it's exactly why something needs deciding first: folders and sites that were shared too widely years ago become easier to find when you can simply ask. Do you accept the current permissions, tidy up the most sensitive areas first, or start with fewer users while that happens? Leadership sets the priority, and your IT team assesses and makes the permission changes using Microsoft's own guidance. You get the choice set out with its cost and consequences.
Which uses are approved, and which need a yes first?
A short list of approved uses does more for a rollout than a long rulebook. It separates what everyone can do from the start, such as drafting text or summarising their own meetings where IT has switched those features on, from what needs a yes first, for example proposals that go straight to customers or work involving employee data. Staff know where they stand, and you avoid each department drawing its own line. Accel Comply proposes the list based on what you want from the licences, and it can later become part of your AI policy for employees.
Who says yes to new uses?
One person in leadership should own approval of new uses, and the route to them should be short. When sales, HR or finance want to use Copilot for something new, they need to know who to ask and what gets weighed: which data it touches, who it affects and what happens if Copilot gets it wrong. Departments then get an answer instead of waiting or going ahead on their own. Your senior lead helps set the route and works through the first agreed requests with whoever owns approval.
How to follow up on use
Follow-up comes down to three questions leadership should have answered at regular intervals: are the licences being used, what for, and has IT found or been told of cases where someone was shown data they shouldn't have seen? The answers show where licences should be reassigned, which uses belong on the list and where the tidy-up isn't finished. Accel Comply follows up with IT and pulls the answers together for leadership from the information IT makes available, so the decisions are adjusted to how Copilot is actually used.
When Copilot is rolling out across the business
The pilot group likes Copilot, and now everyone wants a licence
Before the rest get access, leadership decides how far the tidy-up of shared folders should go, which uses are approved and who says yes to new ones. The rollout runs on decisions rather than enthusiasm, and licences go to the people who get something out of them.
Copilot answers someone from a document they should never have seen
An old share that is wider than intended is one possible explanation, but IT needs to investigate before anyone knows the cause. Meanwhile the question lands with leadership: should the rollout pause? Accel Comply helps weigh it up and recommends how far the tidy-up should go and in what order.
Sales want Copilot for proposals, and nobody knows who can say yes
With one owner and a short route, sales get an answer and know what to check before a proposal goes to a customer. The new use starts without becoming an exception nobody decided on.
Accel Comply's part, and your IT team's part
What Accel Comply takes on
- The four decisions prepared for leadership: data and access, approved uses, who says yes, and follow-up
- A clear choice on current permissions, with what each option costs and means for the rollout
- A short list of approved uses and a simple route for getting new ones approved
- Follow-up with IT and a single picture for leadership of how Copilot is being used
What Accel Comply does not take on
- Technical set-up, licence administration and permission clean-up, which your IT team or Microsoft partner handles
- Copilot Studio and solutions you build yourselves
- An audit of the set-up
Leadership decides and stays accountable for how Copilot is used.
Questions about Microsoft 365 Copilot governance
What do we need to sort out before Microsoft 365 Copilot?
Four things leadership should decide before Copilot becomes routine: whether staff access to data needs tightening first, which uses are approved, who says yes to new ones, and how you follow up on use. The technical set-up belongs with your IT team and is covered in Microsoft's own documentation. Accel Comply helps leadership make those four decisions.
Can Copilot see all our data?
According to Microsoft's documentation, Microsoft 365 Copilot only surfaces organisational data the user has at least view access to. So the real question is what your staff can open today, including things that were shared too widely long ago. How much to tidy up before more people get a licence is a leadership decision, and Accel Comply proposes where to start.
What is oversharing, and why does it show up with Copilot?
Oversharing is files, folders and sites shared with more people than need them, perhaps years ago and never looked at since. Content you once had to know where to find can now turn up in an answer, because Copilot works within the access that already exists. How thoroughly you tidy up before the rollout is a trade-off between time, cost and risk that leadership should make with IT.
Is Microsoft 365 Copilot secure enough for our data?
That's two questions. How Microsoft handles and protects data in the service is set out in Microsoft's own documentation, which your IT team should read. Who in your organisation can see what, and what Copilot may be used for, is the part Accel Comply helps leadership with.
Who in our organisation should own Copilot?
Someone in leadership who can say yes or no to new uses. That could be the person who already owns decisions about data and suppliers. IT should own the technical running but not decide alone what Copilot is used for, because that's a business choice. Accel Comply helps place the ownership. Ownership of AI as a whole is covered under AI advisory for leadership.
Does this cover Copilot Studio?
No. This page is about Microsoft 365 Copilot, which staff use inside the Microsoft 365 apps they already work in, and which Microsoft's privacy documentation also calls Microsoft Copilot (not the consumer app of that name). Copilot Studio, where you build your own solutions, raises different questions about development, operation and data, and this page doesn't cover them. If you have both under way, Accel Comply can tell you where the line sits.
Related pages
Settle the Copilot decisions before everyone has a licence
Briefly describe where you are with Microsoft 365 Copilot and which questions are still open. You'll hear which of the four decisions to tackle first.