Practice position
AI assists. People decide.
Use approved systems, minimise information, check important output and keep accountable professional judgement human-led.
Name the exact product
A web assistant, Microsoft 365 integration and a supplier-built copilot may have different access, connectors and controls. Governance cannot approve the word ‘Copilot’ in the abstract; it needs the specific service and information flow.
Integration changes the risk
Access to organisational content can be useful, but permissions, document quality and over-sharing become central. A system may retrieve outdated drafts or material a user can technically access but should not reuse for the new purpose.
Pilot a defined workflow
Choose a bounded task, map what the tool can access, test output, assess staff behaviour and set a review date. Keep consequential decisions and professional accountability outside automated delegation.
Practical checklist
- Specify product and licence
- Map connectors and permissions
- Review information and retention
- Test retrieval quality and over-sharing
- Define monitoring and change control
Authoritative starting sources
Microsoft privacy documentation ↗NHS England AI information governance ↗Written by Tony D’Agostino / TD Consultancy. Reviewed . This page provides general professional education, not legal or clinical advice.