So, you’re ready to roll out Copilot.  You have an Information and Records Governance program in place, including your Steering Committee, Information and Records Coordinators, policies and procedures, Records Retention Schedule (RRS), licenses, and training.  As you review the rollout plan with your colleagues, you’re all doing your best to think of any challenges that could impact the overall success of the tool.  If you have just one measure to use, I’m going to suggest it’s the following:

“Would I be OK with the full organization seeing every document in our 365 environment?”

99.999% of organizations would say “no” to this question.  And, even with a robust Information and Records Governance program, there is some element of “out of sight, out of mind”.  However, that is no longer the case thanks to Copilot.  So, what are practical steps that an organization should take to prevent oversharing?

A quick technical note: When a user makes a request to Copilot, it processes the request and then generates a response with Large Language Models (LLMs). LLMs leverage content from Microsoft Graph (which includes emails, files, meetings, chats, calendars, and contacts) and optionally web content. A large subset of the Microsoft Graph data is stored in SharePoint.  (Note that Copilot gathers SharePoint content via the same method SharePoint Search gathers content).  Therefore, evaluating and taking action on 365 content is imperative prior to rolling out Copilot. 

So where do you begin?  First, if you have ever had less than full support for getting IT, InfoSec, Data Privacy, Legal, and Information Governance leadership in the same room to review and take action on unstructured content, this is a great opportunity.  Leaders in these areas must remember that the value, importance, accuracy and risk of information and data change over time – and Copilot can and will expose poorly managed content quickly. 

Second, sit down with your Records Retention Schedule (RRS) and identify content that has real value: research, strategies, specifications, standards, legal documents, etc.  Conversely, also identify records categories that represent transactional data that has no re-usable value, or even potentially harmful data such as personal information.

Third, it may be necessary to keep records around failed projects or activities, but it is not necessary to add them to your Copilot content. Use metadata, such as product names or numbers, to separate good quality or successful content from bad quality content within a specific category. 

Fourth, leverage sensitivity labels to improve Copilot. For example, a sensitivity label identifying valuable intellectual property should be included, a label identifying privacy information should be excluded.

Copilot will likely change how we manage our content in the coming years – and as with all organization-wide initiatives, stakeholders can be proactive or reactive.  Copilot will quickly show how critical it is to choose the proactive route.   

Infotechtion-ARM technology provides critical insight into your M365 content – contact us at contact@infotechtion.com for a demo or to discuss how we have helped clients prepare for successful Copilot implementations.