Business AI Readiness: Find Out What You Already Have

Your business may already have an AI estate

An AI estate is simply the collection of AI tools, features, accounts and workflows connected to the business. It can include a paid Copilot licence, a free personal chatbot account, an AI meeting feature switched on in a collaboration platform, a browser extension, a supplier's automated service and a team experiment that quietly became part of the daily process.

That creates two related questions. Are people using AI in ways the business has not governed? And is the business paying for tools or licences that nobody uses, that overlap, or that solve a problem nobody defined? A business can take AI risk while missing useful opportunities at the same time.

KNOW: build a useful picture before buying anything else

1. 1Ask each team what AI tools and features it uses, what work each one supports and which account owns it.
2. 2Check company-card payments, expenses, software renewals and identity-provider application records for subscriptions people may not mention.
3. 3Review AI features already included in Microsoft 365, CRM, accounting, recruitment, meeting and customer-service platforms.
4. 4Record what information enters each tool or agent: public information, internal information, personal data, customer material, confidential business information or security secrets.
5. 5Name a business owner and record whether the tool is approved, being assessed, or not approved for business use.

AI agents need a more specific inventory

Businesses are starting to create AI agents inside Microsoft 365 and Power Platform. The governance question is no longer only “Who can use Copilot?” It is also: what agents exist, who created them, what can they access, who can use them, whether anonymous users can reach them, which data or connectors they use, who owns them and whether they are still needed.

Microsoft describes enhanced admin controls for Power Platform and Copilot agents in its 2026 release plan. Planned capabilities include requiring Microsoft Entra ID authentication, allowing only approved external identity providers, prohibiting anonymous access, controlling agent sharing and enforcing policies at deployment and runtime. Microsoft currently lists general availability as September 2026. Release dates can change, and planned functionality may not be released, so check the customer's tenant before treating these controls as deployed.

GOVERN: reduce risk without stopping useful work

Good governance does not mean banning AI. It means making the safe and useful route obvious. Set approved tools and account rules, keep passwords and security secrets out of prompts, define what personal or confidential information needs extra care, and make someone responsible for each important use.

• Use a proportionate AI policy in plain English.
• Require human checking for factual, customer-facing, financial, employment, legal, health, safety and security outputs.
• Check supplier retention, training, access, transfers, subprocessors and exit arrangements for the plan actually being used.
• Train people on limitations, hallucination, verification, bias, data protection, cybersecurity, approved tools and escalation — not only on prompting.
• Keep enough evidence to explain what the system does, who approved it and how mistakes are handled.

Read the AI Governance hub →

VALUE: separate useful AI from AI waste

Do not measure value only by the number of prompts or licences assigned. A small, well-controlled use that removes a real bottleneck may be worthwhile. A widely available tool that produces no measurable benefit may not be. Consolidating, cancelling or delaying a purchase is a valid recommendation.

IMPROVE: choose the next sensible action

1. 1Stop a use that creates unacceptable exposure or has no accountable owner.
2. 2Consolidate overlapping tools or remove unused licences.
3. 3Train people where the tool is useful but the risks or limitations are not understood.
4. 4Adopt a controlled pilot where a real business process has a clear owner and measurable outcome.
5. 5Automate only after the underlying process is understood and worth keeping.
6. 6Ask an existing IT or software supplier what AI is already enabled, how permissions work and what evidence they can provide.
7. 7Obtain a formal technical, data-protection, legal or specialist review when the consequences or regulatory position justify it.

The best outcome may be to buy something, change something, train someone, review something, ask a better question or do nothing for now. Readiness is not a race to deploy more AI. It is the ability to make that decision knowingly.

Keep the picture current

Tools, terms, staff, permissions and use cases change. Review the register, policy, spending and outcomes periodically, and after a material incident or supplier change. If an EU customer, regulator or procurement team asks how AI is governed, the useful evidence is the picture you actually maintain — not a generic claim that the business is “AI compliant”.

Ask the IT Club Advisor →