Copilot is the AI assistant most practices will meet first, because it lives inside the Microsoft 365 tenant they already run. That is its strength: project information stays inside your own environment, under contracts you already hold, rather than moving to a consumer app on a personal login.
It is also the source of the one risk that genuinely surprises practices. Copilot does not create new access. It surfaces existing access, at conversational speed. A fee schedule saved to a loosely shared library, a salary spreadsheet in a folder nobody remembers opening up, the commercial terms of a bid another team is running: if a user could technically reach it before, Copilot will now hand it to them fluently. A tenant with loose permissions turns a productivity tool into an oversharing problem.
The readiness review
This is why the permissions and sharing review comes before the licences. It covers where sharing links point, which libraries are open to the whole practice, what sits in folders nobody has looked at since a project closed and whether access actually matches how your projects run. Most tenants set up quickly and never revisited fail this review, which is normal and fixable.
The same pass usually tidies guest access for consultants and clients, because external sharing that was casual before Copilot becomes consequential after it.
Pilot with a small group and measure
Readiness matters more than enthusiasm. Start with a small group whose week is heavy on the tasks Copilot is genuinely good at: drafting, summarising long documents and digging answers out of mail and meetings. Measure whether the licence cost is earning its keep before you commit the whole studio, because per-seat AI licensing adds up quickly across a practice.
Where it sits in your governance
Copilot is one entry on the AI register like any other tool: a named owner, a recorded assessment and a decision on what data it may touch. That record is also the answer that satisfies a client, an insurer or a framework reviewer when they ask how AI is governed in your practice.
WIT is certified to ISO 27001 and ISO 9001 and is extending both to cover AI under ISO 42001. We handle Copilot licensing, the readiness review and a measured rollout for AEC practices.