Microsoft Copilot
In part one, I shared what this year has looked like for our product team: why governance has to sit with the people who know the content, and why it has to keep pace with Microsoft 365.
This time, I want to talk about AI. More precisely, about the journey most organisations are on with it, which looks very different from the headlines. I’ll share what the evidence says, what we hear from our own customers, and what I think it means for how you prepare.
This post is the short version. For the full stage-by-stage model, a readiness checklist and every source, read my guide: Governing the journey into AI.
Where most organisations really are
If you only read the headlines, you’d think every large company had already rolled AI out to everyone. The evidence tells a more measured story.
McKinsey’s 2025 State of AI survey found that 88% of organisations now use AI in at least one business function. Yet nearly two-thirds have not started scaling it across the organisation. Most are still experimenting.
The picture for Microsoft 365 Copilot is similar. When Gartner surveyed 132 IT leaders in 2024, 60% had started Copilot pilots. Only 6% had finished their pilots and were planning large-scale deployment, and just 1% had rolled Copilot out to all eligible employees.
That matches what our biggest customers tell us. Most are just getting started with Copilot. Many haven’t approved other AI tools, such as ChatGPT or Claude, at all. Large organisations move carefully, and there are good reasons for it.
Why big organisations move carefully
Two stories from the last few years explain the caution better than any survey.
In 2023, Samsung banned staff from using generative AI tools after engineers uploaded sensitive source code to ChatGPT. The company’s concern was simple: data sent to these tools was stored on external servers, was hard to retrieve or delete, and could end up disclosed to others.
In March 2024, the US House of Representatives banned staff from using the commercial version of Microsoft Copilot. Its Office of Cybersecurity judged it a risk because of “the threat of leaking House data to non-House approved cloud services.” Days later, the House said a government version built to a higher security and compliance standard would be reviewed, with staff able to regain access if it passed.
I find the second story the more useful one. The House paused, defined the controls it needed, and set out a path back to using AI. That is the journey most of our customers are on today.
The journey, stage by stage
From what we see across our customers, the journey into AI tends to follow four stages:
- Hold. AI tools are blocked or restricted while the organisation works out the risks. Some people use them anyway.
- Pilot. A small group gets Copilot. IT watches closely and learns what it surfaces.
- Scale. Copilot reaches the wider workforce, with policies and monitoring in place.
- Expand. Agents, other AI platforms and new use cases come in, under the same governance.
Most large organisations we speak to are somewhere between the first and third stage. The step that stops them moving forward is almost always the same.
What holds organisations back
In that same Gartner survey, 40% of IT leaders said they had delayed their Copilot rollout by three months or more because of concerns about oversharing. 64% said information governance and security risks needed significant time and resources.
The reason sits in how Copilot works. In Microsoft’s own words, “Microsoft 365 Copilot only surfaces organizational data to which individual users have at least view permissions.” Microsoft goes on to stress how important it is that “the right users or groups have the right access to the right content.”
In other words, Copilot inherits your permissions, exactly as they are today. If a sensitive file has been shared too widely, Copilot can find it for anyone who has access. Whatever access problems you already have, AI exposes them at a speed no person could match.
That’s why the journey into AI runs straight through governance. Getting permissions under control is the step that unlocks every stage after it.
What the reward looks like
It would be easy to read all of this as a reason to keep waiting. I see it the other way round. The value on the other side is real, and the evidence is building.
In 2025, the UK government ran a three-month trial of Microsoft 365 Copilot with more than 20,000 civil servants. Participants reported saving an average of 26 minutes a day, close to two working weeks per person per year. Those figures are self-reported, so treat them as a guide, but they show what’s possible when an organisation is ready.
The organisations that capture that value are the ones that can move confidently from pilot to scale. Governance is what gives them that confidence, and it starts with a simple question: do you know who can reach what in your Microsoft 365 environment today? If you’re not sure, our Copilot readiness work is a good place to start.
Where we go next
Some of you have asked whether Rencore is getting carried away with AI. It’s a fair question. We share the excitement about what AI can do, and our focus is the same as ever: helping you run Microsoft 365 securely, with clear ownership and clean access.
That matters more as Copilot rolls out, and it will keep mattering as other AI platforms arrive. Whichever assistant your people use, much of the business data it works with lives in Microsoft 365. Governing that data well is how you stay ready for each stage of the journey, and it’s where we’ll keep building, from Microsoft 365 and Copilot out to the wider AI landscape.
I go into this in more depth in my guide, Governing the journey into AI.
Join us on 21 October
The rest is better shown live. Join me, Sven and Tobias at the first Inside Rencore on 21 October at 4pm CEST (3pm BST, 10am EDT). We’ll cover:
- The Teams app and owner-led reviews, and the thinking behind them
- Global Search and custom metadata
- What’s coming in the next six months, and where we’re heading after that
- Your questions, answered by the people building the product
Wherever you are on the journey, bring the hard questions. The Q&A is the part I’m looking forward to most, and what you tell us shapes what we build next.
Register for Inside Rencore: Built in 2026. Bigger in 2027.
Tiina Rytkönen
VP of Product and Engineering, Rencore
Last updated 19 October 2026
