Ask most SME leaders whether their business uses artificial intelligence and the answer is cautious. “We are looking at it.” “We have not made a decision yet.” “We want to understand it better before we commit.”

The reality in most organisations is rather different. AI is already present, often extensively, in the software and platforms the business already pays for, in the tools individual staff have adopted independently, and in the features that have been enabled by default without anyone actively choosing them.

Understanding what is already in use is the essential starting point for any sensible approach to AI governance. You cannot manage what you do not know about.

The AI tools most commonly found in SMEs

*Microsoft 365 Copilot features

Even businesses that have not purchased a Copilot licence may have AI features active within their Microsoft 365 environment. Microsoft has been progressively embedding AI functionality into existing products, in Outlook, in Teams, in Word and Excel, sometimes as opt-in features, sometimes enabled by default as part of product updates. A review of your Microsoft 365 admin settings will typically reveal AI features that nobody in the business actively enabled.

*Grammarly

Widely used across business functions for proofreading and editing, Grammarly processes the text it is asked to review. For most business use this includes emails, reports, proposals and other documents, some of which will contain client information, commercially sensitive content or personal data. Most users have not considered what Grammarly does with the text it processes.

*ChatGPT and similar large language model tools

Direct use of ChatGPT, Claude, Gemini and similar tools for work tasks is widespread in most organisations, regardless of whether any formal decision about AI adoption has been made. Staff use these tools to draft emails, summarise documents, research topics and generate content. The data they input, including frequently, client and commercially sensitive information is processed by the tool provider’s systems.

*AI features in CRM and business software

Salesforce, HubSpot, Notion, Monday.com and many other common business platforms have added AI features in recent product updates. These features may be active by default and may be processing customer data, communication records and business information in ways that were not assessed when the platform was originally selected.

*AI writing and content tools

Jasper, Copy.ai, and similar tools used for marketing content generation are AI platforms that process the briefs, brand information and content context provided to them. Where this information includes client details, campaign data or proprietary business information, the data handling implications require assessment.

*AI features in communication platforms

Zoom, Teams and other video conferencing platforms now offer AI-powered transcription, summarisation and action tracking. Where these features are active, meeting content including confidential client conversations, board discussions and commercially sensitive negotiations, is being processed by AI systems.

What this means for governance

The first implication is practical. If you do not know which of these tools are in use in your organisation, you cannot assess the data protection and confidentiality implications. A structured AI usage audit, asking staff what tools they use for work, reviewing platform settings for enabled AI features, and reviewing software subscriptions is the starting point.

The second implication is regulatory. Where personal data is being processed through AI tools, the requirements of UK GDPR apply. This includes ensuring that there is a lawful basis for that processing, that there are appropriate contractual protections with the tool provider, and that individuals whose data is processed have been informed as required.

The third implication is commercial. Client confidentiality obligations, professional conduct requirements and contractual data handling commitments may all be relevant to how AI tools are used in your organisation. Understanding whether current AI usage is compatible with these obligations requires an assessment, not an assumption. The starting point for all of this is understanding what is already happening. In most organisations, that picture is more extensive than leadership expects.

Microsoft Copilot has now been available to Microsoft 365 business subscribers for long enough that the early adopter experience is giving way to a more measured assessment of what the product actually delivers in practice, as opposed to what the marketing promised.

The picture that emerges from businesses that have deployed it, including SMEs that have shared their experience with Northstar is more nuanced than either the enthusiastic vendor narrative or the sceptical dismissals suggested. There are genuine use cases where Copilot delivers consistent, measurable value. There are others where the gap between promise and reality remains significant.

Where Copilot is genuinely delivering

*Meeting summaries and action tracking

The Teams integration that generates meeting summaries, captures action items and produces follow-up notes is consistently the most positively received feature among business users. For organisations with frequent internal or client meetings, the time saving is real and the output quality is generally adequate for the purpose.

The caveat is that this only works where meetings are conducted in Teams with recording and transcription enabled. Organisations that conduct meetings in other ways, or where participants are uncomfortable with recording, will not benefit.

*Email thread summarisation

For individuals managing high volumes of email, the ability to summarise a long email thread and extract the key points and required actions is genuinely useful. The quality is variable, it performs better on straightforward factual threads than on complex, nuanced conversations, but for the majority of business email the summarisation is adequate and time-saving.

*First-draft generation for structured documents

Copilot’s ability to generate a structured first draft of a report, proposal or presentation from a brief or an existing document reduces the blank-page problem significantly for roles that involve regular long-form writing. The drafts require meaningful editing before they are suitable for external use, but the acceleration of the drafting process is real.

Where Copilot is underdelivering

*Data quality dependency

Copilot’s ability to answer questions about your organisation, “summarise the key points from our Q3 sales reports” or “what did we agree in the last client review?” depends entirely on whether the relevant information is in your Microsoft 365 environment in a form Copilot can find and process.

Most organisations’ SharePoint and Teams environments are not organised in a way that supports this kind of retrieval. Files are poorly named, folder structures are inconsistent, and large amounts of relevant information exist in email attachments that are not indexed effectively. The result is that Copilot either cannot find the relevant information or retrieves the wrong information confidently.

*Inconsistent output quality across user types

The productivity gains from Copilot are concentrated in specific roles and tasks. For someone who spends significant time writing, summarising, and processing information, Copilot can deliver meaningful efficiency gains. For someone whose work is primarily operational, client-facing or involves physical activity, the benefit is minimal.

Licensing all users in an organisation to achieve benefits for a subset of them is not always the right commercial decision, and it is not a decision that Microsoft or an MSP with a licensing margin incentive will make on your behalf.

*The data governance prerequisite

This is the issue that Northstar most consistently flags to clients considering Copilot. The product works by accessing the information your users are permitted to access in the Microsoft 365 environment. If your permissions are not properly configured and in most SMEs they are not, Copilot can surface content that should not be visible to that user.

This is not a minor technical detail. It means that before deploying Copilot, organisations should conduct a review of their Microsoft 365 permissions, ensure that sensitive content is appropriately protected, and confirm that the information Copilot will access on behalf of each user is information they should legitimately be able to see.

The honest assessment for SMEs

Copilot is a good product that delivers real value in the right context. It is not the universal productivity transformation that Microsoft’s marketing suggests, and it is not a product that every user in every organisation will benefit from equally.

For UK SMEs evaluating Copilot, the right approach is to identify the specific roles and use cases within your organisation where the benefit is most likely to be real, pilot the product with those users before committing to broader licensing, ensure your Microsoft 365 environment and permissions are in a suitable state, and take independent advice before committing to the licensing cost. Anyone telling you Copilot is definitely right for your business without understanding your specific workflows, your data environment and your team structure is selling, not advising.