Fixed fee · 2–3 weeks · $4,500
Copilot & AI Agent Readiness Snapshot
See what Microsoft 365 Copilot and your AI tools can reach, what’s exposed, and what to fix first — before a client or regulator asks.
Who it’s for
Firms that hold confidential client data
Professional-services firms with 50–500 people on Microsoft 365 — law, accounting, engineering and consulting — that are turning on Copilot, AI agents or other AI tools.
The problem
Copilot sees what your people can see
In most firms that includes files shared too broadly years ago. Meanwhile staff use AI tools nobody approved, agents get permissions nobody reviews, and clients have started asking how you govern AI.
What we review
Five areas, one clear picture
AI inventory
Up to 5 AI tools or use cases, sanctioned and unsanctioned.
Copilot exposure
Oversharing in SharePoint, OneDrive and Teams; sensitivity labels; access to confidential client matters.
Agent permissions
What Copilot agents and connected AI apps can read, write and act on.
Vendor risk
2 AI vendors reviewed for data use, retention and contract terms.
Governance basics
AI use policy, approval path for new AI tools, and clear ownership.
What you receive
Deliverables
- Risk register ranked by impact, each item with an owner and fix
- Board-ready one-page summary
- AI acceptable-use policy tailored to your firm
- 90-day remediation roadmap
- 60-minute readout with your leadership team
How it works
Three weeks, about four hours of your time
| Week | Activity | Your time |
|---|---|---|
| 1 | Kickoff, read-only access, interviews with your IT lead and 2 practice leaders | About 3 hours |
| 2 | Configuration and permission review, vendor reviews | None |
| 3 | Findings, roadmap and leadership readout | 1 hour |
Not included
Clear scope, no surprises
- Fixing the findings (permission clean-up, label rollout, configuration changes) — quoted separately or covered by our Fractional AI Governance retainer
- More than 5 AI use cases or 2 vendor reviews
- Penetration testing, AI red teaming or model bias testing
- Legal advice or regulatory opinions
- ISO 42001 certification audit
- Licenses, software or tooling purchases
What we need from you
- A read-only admin account (such as Global Reader) for Microsoft 365
- A named internal contact
- The interviews listed above
Know what Copilot can see before your clients ask
A 20-minute call tells us both whether the Snapshot fits.