Adopting AI is a governance decision first
AI has entered most organisations faster than the structures needed to manage it. The organisations handling it well are not moving more slowly.
AI has entered most organisations faster than the structures required to manage it. Interest builds quickly, use cases emerge from several directions at once, and experimentation begins before there is a clear view of how any of it should be governed. The capability is accessible and the perceived upside is immediate. What is less visible at the start is how quickly this creates divergence.
Different teams adopt different tools. Data is used in ways that are not fully understood. Outputs begin to influence decisions without a consistent view of how they were produced. The organisation appears to be moving forward, but not necessarily in one direction.
AI inherits what is already there
Microsoft 365 Copilot works within the permissions each user already has. If a SharePoint site has been shared with everyone, or a Teams channel holds sensitive material without a label, AI will surface it as readily as anything else. Stale accounts, broad groups and unmanaged guest access all carry straight through. None of this is a fault in the AI; it is the existing estate made more visible.
That is why readiness work looks a lot like identity and information governance work. Review oversharing, classify data with sensitivity labels, tidy identity, and agree who owns the outputs before switching anything on.
The questions that matter are not bureaucratic
Who owns what AI produces? What data is it operating on, and has that been thought through? Where are decisions being made about which processes AI should touch, and are they being made at the right level? These questions are about accountability rather than paperwork.
Where this is handled well, experimentation still happens, but it is bounded, and there is clarity about where AI is influencing outcomes and where human judgement remains primary. This does not slow progress so much as change its shape, replacing several disconnected initiatives with a deliberate sequence. AI will compound like any other technology investment, and the direction it takes depends on the discipline applied before the momentum builds.