Free PDF · No signup · UK
Download the PDF. Print it. Bring it to your next leadership-team meeting.
What's inside
- Governance for Copilot. Named owner, approval process, training, change control, exception handling.
- Data classification + sensitivity. Purview labels, DLP, retention, auto-tagging, document library isolation, chat history audit.
- Tenant infrastructure. SharePoint sharing audit, OneDrive audit, Teams retention, conditional access, data residency, backup.
- Security controls. MFA, SSO, audit logging, privileged access carve-outs, vendor DPA, AI-specific IR plan.
- Use cases and adoption. Pilot cohort, success criteria, champions, feedback loop, retire/extend decisions, sequenced rollout.
Who this is for
UK businesses with Microsoft 365 tenants planning Copilot rollout, especially regulated firms (legal, accountancy, financial services, healthcare suppliers) where Copilot's access to existing content needs careful pre-work.
How to use this
Tick what you can evidence today. For anything you can't, that's the pre-rollout work. Run it as a leadership-team exercise (CTO/IT lead, Head of Compliance, Head of Risk) to surface where ownership of remediation actually sits.
Frequently asked
Does Microsoft Copilot really read everything users have access to?
Yes — Copilot respects existing access controls, which is what makes it powerful and risky in the same sentence. The hard part of pre-rollout is finding out what your users actually have access to today versus what you think they have.
How long does Copilot pre-rollout typically take?
For UK mid-market businesses, typically 6–12 weeks of foundations work before broad rollout. The most common surprise is SharePoint sharing — sites shared 'with everyone' that nobody remembers configuring.
Is this the same as a Microsoft Copilot Adoption Assessment?
Adjacent but different. Microsoft's adoption framing focuses on driving uptake; this checklist focuses on whether rollout is safe in the first place.
Does this checklist apply to Microsoft 365 Copilot specifically, or to other Copilot products?
Microsoft 365 Copilot specifically — the SharePoint/OneDrive/Teams considerations are M365-specific. Other Copilot variants (GitHub, Studio, Security Copilot) have different readiness profiles.
What if we've already rolled out Copilot?
The checklist still applies — run it retrospectively. The gaps it surfaces are the work that should happen now to bring an already-deployed Copilot inside the governance perimeter.
Related Arx Certa services
If the gaps this resource surfaces for your business need outside help to close:
- AI services — implementation reviews, AI policy work, vendor due diligence, and pilot scoping.
- Cybersecurity — security overlay for AI use, UK GDPR / NCSC alignment, vendor risk assessment.
- Database — data foundations work AI projects depend on.
- Infrastructure — cloud, identity, network and integration foundations.
Score your AI readiness in 4 minutes
The Arx Certa AI Readiness Scorecard quantifies the foundations this resource describes — across governance, data, infrastructure, security and use case. Free, 12 questions, personalised report.
Get your AI readiness score →