Nine questions to ask before piloting AI.

AI readiness means your identity controls, data, governance and team are in a fit state to switch on an AI tool safely and judge whether it works. Most of the groundwork happens in Microsoft 365 and in written policy, and it’s best done before you buy any licences.

If you can answer yes to all nine questions below, you’re ready to pilot. If you can’t yet, the list shows where the groundwork needs to happen first.

1. 01

   Identity and access are in order

   Microsoft Entra ID (or an equivalent) is your source of truth and MFA is enforced. Privileged accounts are kept separate, and conditional access policies match the risk of the data you're about to open up to AI.

2. 02

   Data classification exists

   You know which documents are confidential, and SharePoint and OneDrive sensitivity labels are applied where it matters. AI tools shouldn't be the first system reading documents that nobody ever classified.

3. 03

   Microsoft 365 baseline is current

   Anti-phishing, audit logging, mailbox auditing and data-loss prevention are switched on. Most organisations skipped this baseline at setup, and Copilot pilots depend on it.

4. 04

   A real use case with a measurable outcome

   You've picked a specific operational job, with a measurable outcome and a control case to compare it against. Without that, you can't tell whether the pilot worked.

5. 05

   Buy-in from the operations team

   The people whose work the AI tool will change have helped scope it, and their concerns are written down. They've agreed what success looks like.

6. 06

   Governance for who can use what

   You've written a policy on which AI tools are approved and what data people can share with them. Staff are probably using unapproved tools already, so the policy should bring that use into the open.

7. 07

   Vendor due diligence done

   You know where your AI vendor stores data, what they train on, where the legal jurisdiction sits and what your liability looks like in a breach. Legal and information security have signed it off.

8. 08

   Adoption plan written

   There's a plan for training and internal comms, backed by a network of champions who help colleagues get started. Licences nobody uses still show up on the invoice.

9. 09

   Board has agreed what to do if it works

   Before the pilot starts, your board has agreed the budget for scaling it up if it succeeds. If it doesn't, everyone knows who decides to stop and on what evidence.