A tender response that needs a first draft. A long meeting record that needs a summary. A project folder that takes too long to search. These are reasonable places to look for help from AI.
The decision becomes harder when “try Copilot or ChatGPT” turns into “give it these documents”. A public specification, a confidential tender and a file containing personal information are different starting points. The account used and the customer's terms matter too.
Start with one useful task. Then agree the information and working arrangement around it.
Write down the job before choosing the tool
“We want to use AI” is a request for a conversation. “We want an approved service to produce a first draft from these permitted documents, reviewed by this person” is something IT and the business can assess.
The NBS Digital Construction Report 2025 covered more than 550 respondents and identified practical uses including researching technical information, drafting and analysing project data. It gives a reason to take these requests seriously. It does not show that any particular contractor is using AI or has a security problem. NBS source.
Use a short brief:
| Decision | What to record |
|---|---|
| Intended task | The work the service will help with and what a useful output looks like |
| Information | The documents, sensitivity, owner and customer restrictions |
| Tool and account | The exact service, account type and agreed organisational settings |
| Access | Who can supply the material, retrieve an answer and share the result |
| Review | The competent person checking accuracy and approving the final work |
| Record | Approval, relevant terms and what will be kept or removed |
This is a proposal record, not a certification checklist. A missing answer is a reason to resolve that part of the arrangement.
A work account and a personal account are separate decisions
Do not approve a service by brand name alone. Check the exact product, account, contractual protections, settings and intended information. An employee signing into a personal account is not necessarily using the same service arrangement the organisation assessed.
Microsoft describes its commercial Copilot protections and how information access relates to the user's existing permissions. Those statements apply to the specified service; they are not a guarantee about every AI tool. Review the documentation for the actual experience being proposed. Microsoft data privacy and security.
Why check permissions if Copilot respects them?
Because the existing permissions may already be wrong.
An illustrative example: people from a completed project remain in a SharePoint group that can read a tender folder. A connected Copilot experience may make material within their existing access easier to find and summarise. The problem starts with the group membership. A new licence does not correct it.
That could bring confidential prices or negotiations to a wider internal audience than intended. This is a reason to check an actual workspace, not evidence that your business has that problem.
Uploading a tender document to ChatGPT is a separate decision. Check the approved workspace, permitted information and customer terms. OpenAI says ChatGPT Business and Enterprise inputs and outputs are not used to train its models by default. That does not settle retention, sharing, customer permission or every connected service. OpenAI business privacy.
Do not tell staff that everything entered into ChatGPT becomes public. Do not tell them that a work account makes every upload appropriate. Neither is a useful basis for a decision.
Check what people can already reach
An AI rollout is a useful reason to review project permissions. It is not necessary to claim the AI bypasses those permissions.
Take one relevant project space. Ask who owns it, whether the membership still reflects the work, which links remain in use and whether sensitive material has a clear audience. Include guests and access retained from an earlier role or project.
Microsoft's SharePoint guidance distinguishes controls that restrict access from controls that limit discovery. Those are different measures. Features, entitlements and configuration need checking before recommending a control. Microsoft SharePoint governance guidance.
Reducing what an AI search can discover does not, by itself, correct all underlying permissions.
A worked construction example
Illustrative example, not a customer case study: a bid team wants help producing a first draft from a customer's tender documents.
The commercial lead confirms what the customer permits. The information owner identifies material that should be excluded. IT confirms the approved service and account arrangement. A competent reviewer checks the output against the source documents before it enters the response the business approves.
If permission to upload a document is unclear, the team can resolve that question or test the workflow with suitable non-confidential material. Buying another licence does not decide the customer's terms.
The output still needs a named reviewer
Fluent text can conceal a missing qualification, an incorrect interpretation or a statement the business cannot support. Decide what needs checking before the output is used in a tender, instruction or customer answer.
For safety-critical, design or contractual work, the appropriate qualified professionals and established approval process remain essential. An AI-generated answer is not an approved engineering decision or legal interpretation.
Keep the source information accessible to the reviewer and record the approved final version. Treat significant edits and verification as part of the work, not an inconvenience after the tool has finished.
Make one useful decision this week
Choose one proposed AI workflow. Complete the brief with the person requesting it, IT and the information owner. Confirm the service and account, permitted inputs, access and review arrangements. Test the agreed workflow with suitable material before widening it.
The result may be approval, a narrower use or a different approach. Each is more useful than an organisation-wide instruction that leaves individual teams to interpret the detail.
Next step: Review your data controls. Assured Digital's Data Security & Governance diagnostic offers a broader self-review if information ownership and access remain unclear. It does not inspect your files, approve the AI use or certify compliance.
