Nine questions to ask before piloting AI.
If you can answer yes to all nine, you’re ready to pilot. If you can’t yet, this list shows you where the groundwork needs to happen first. Written for a leadership team, not a vendor demo.
- 01
Identity and access is in order
Microsoft Entra ID (or equivalent) is the source of truth. MFA is enforced. Privileged accounts are separated. Conditional access policies match the risk of the data you're about to expose to AI.
- 02
Data classification exists
You can tell which documents are confidential, which are internal, which are public. SharePoint and OneDrive sensitivity labels are applied where it matters. AI tools shouldn't be the first system reading documents that humans never classified.
- 03
Microsoft 365 baseline is current
Anti-phishing, audit logging, mailbox auditing, data-loss prevention. The Microsoft 365 baseline most organisations skipped at setup. Copilot pilots depend on it.
- 04
A real use case, with a measurable outcome
Not 'we want to use AI'. A specific operational job, a measurable outcome, and a control case. If the pilot can't fail in a way you'd notice, it can't succeed either.
- 05
Stakeholder buy-in across the operations team
The people whose work the AI tool will change have been involved in scoping it. Their concerns are written down. They've agreed what success looks like.
- 06
Governance for who can use what
A written policy on which AI tools are approved, what data can be shared with them, and how exceptions get handled. Shadow AI is happening anyway; the question is whether it's documented.
- 07
Vendor due diligence done
Where your AI vendor stores data, what they train on, where the legal jurisdiction sits, and what your liability looks like in a breach. Signed off by legal and information security.
- 08
Adoption plan written
Training, champion networks, internal comms. A licence that nobody uses isn't an AI programme; it's an expense line.
- 09
Board has agreed what to do if it works
If the pilot succeeds, what's the budget envelope for scale? If it doesn't, who decides to stop, and on what evidence? Decide before the pilot starts.
