AI is changing corporate risks.
Copilot and the first AI agents are raising new questions. Every company should be considering four of them.
Who can access confidential information through Copilot?
Which AI tools are employees allowed to use?
Who is responsible for AI-driven decisions?
How do we keep usage and costs under control?
Shadow AI has been around for a long time.
Even outside of Copilot, employees use AI tools such as ChatGPT or Claude—often without supervision and often with sensitive data.
AI governance requires an understanding of both business and technology.
Business Meets Technology
We integrate management issues, processes, data, and technical controls.
Pragmatic Rather Than Theoretical
Governance must be understandable to employees and applicable in their day-to-day work.
Microsoft Expertise
We are familiar with the platforms on which AI is used, developed, and operated.
From Policy to Control
We translate rules into concrete technical and organizational measures.
Lifecycle Instead of Project
Governance continues to evolve with new use cases, risks, and technologies.
People, Process, Policy, and Technology.
AI governance brings together people, processes, policies, and technology.
People
Roles, Skills, AI Literacy
Process
Intake, Evaluation, Approval
Policy
Permitted Use, Standards
Technology
Identity, Data, Security, Monitoring
Business Requirement
Governance Rule
Technical Control
Evidence / Monitoring
Who is responsible for AI?
AI governance is not purely an IT task. IT implements technical controls. Risk appetite, permissible use cases, and responsibilities are matters for the corporate level.
Board / Management
Strategy and Risk Appetite
AI Governance
Business
IT / Security
Users
Management Issues
- What uses of AI support our strategy?
- What is permitted, restricted, or prohibited?
- Who approves and monitors?
- How do we respond to problems?
It is not the tool that determines the risk.
Questions to Consider for AI Use Cases
1. Is personal data being processed?
Check the purpose, transparency, data minimization, security, and data subject rights. Conduct an in-depth data protection review if the risk is high.
2. Are people directly affected?
Does AI make decisions about or evaluate people? Ensure human review, transparency, and fairness.
3. Does it relate to the workplace?
Examine HR, recruiting, performance evaluations, and employee monitoring with particular scrutiny.
4. Does the use case have an EU connection?
Assess the applicability of the EU AI Act and, where applicable, the GDPR based on the role, market relevance, and impact
5. Do you operate in a sensitive sector?
Healthcare, finance, insurance, government agencies, education, or critical infrastructure may trigger additional requirements.
6. What content and third-party rights are involved?
Clarify copyrights, trade secrets, contracts, licenses, data sources, and provider terms and conditions.
Note:
Before the system goes live in production, the following should be clarified: owner, purpose, data sharing, risk classification, human oversight, and monitoring.
Governance only becomes operational once rules are translated into technical terms.
This is a key differentiator for the Online Group: We align business requirements and governance rules with specific controls within the Microsoft ecosystem.
Governance with Microsoft.
Microsoft Entra
Identities, Groups, Roles, Access, and Conditional Access
Microsoft 365 Permissions
Controls which existing company information users and Copilot can access
Microsoft Purview
Sensitivity Labels, DLP, Audit, DSPM for AI, and other data and compliance controls
Microsoft Foundry
Evaluation, Monitoring, and Responsible Operation of Custom AI Solutions
Microsoft Agent 365
Securely Manage and Centrally Monitor Agents
Cost/Usage Controls
Transparency regarding usage, capacity, and costs
Copilot Studio / Power Platform
Maker roles, environments, data policies, connectors, authentication, publishing, and lifecycle
Copilot Control System
Security & Governance, Management Controls, and Measurement & Reporting
Why Cost Control Is Important
Two products, two levels of governance.
Microsoft 365 Copilot and Copilot Studio require different governance controls.
Microsoft 365 Copilot
Identity & Access · Data & Compliance · Copilot Management
Governance Focus: Who is authorized to access which existing information?
Copilot Studio / Power Platform
Maker & Environment · Data & Actions · Lifecycle & Operations
Governance Focus: Who is allowed to build, connect, publish, and operate agents?
Five Steps to Effective AI Governance.
1. Discover
Highlighting AI Applications and Use Cases
2. Assess
Assess data, process, and regulatory risks
3. Policy
Define policies, roles, responsibilities, and acceptable use
4. Implement
Implement controls in Microsoft 365, Entra, Purview, Copilot Studio, and other relevant platforms
5. Monitor
Continuously monitor usage, risks, costs, changes, and impact
How clear are your AI guidelines?
Or just get in touch with us—it's easy.
