The NHS Copilot rollout exposes the governance gap behind enterprise AI ambition

AI adoption continues to accelerate across both public and private organisations. In healthcare, three-quarters of surveyed public-sector organisations are already exploring or implementing generative AI initiatives.

One of the most significant tests of AI at scale is now approaching, with NHS England announcing plans to provide Microsoft 365 Copilot to roughly half a million clinicians and support staff. This isn’t happening in a vacuum. More than a quarter of surveyed GPs are already using AI tools in their clinical practice, making broader adoption a logical next step. The goal across healthcare is to reduce administrative burdens, improve efficiency, and give staff more time to focus on patient care.

The real test is no longer whether organisations can deploy AI. It is whether their governance can keep pace once they do.

The readiness gap

The more difficult question, however, is whether the surrounding environment is ready. Sixty-eight per cent of surveyed physicians said the NHS lacks the digital infrastructure needed to introduce AI effectively. The concerns are not limited to the technology itself. Training gaps, interoperability issues, patient safety and data privacy are all important parts of the readiness picture.

At the scale at which public-sector organisations operate, AI adoption requires governance that can keep pace with both the technology and the environment around it. This must include clear policies for data access, retention, accountability and human oversight.

That gap is not unique to healthcare. Private-sector organisations face many of the same readiness questions, even when the regulatory context, systems and consequences differ. 

Why existing governance models need to evolve

Many governance practices still rely on periodic reviews, where changes to systems and data access are assessed at defined intervals. That made it easier to track risk, document decisions and respond as regulation evolved. Human decision-makers were also more visibly positioned at the centre of many workflows, making informed judgment calls. 

AI changes those operating conditions. AI systems can retrieve, combine and summarise information at a scale that makes interaction-by-interaction human review impractical. At the same time, many organisations are adopting multiple tools across operational and governance functions. Similar information may be accessed through several systems, making it harder to maintain consistent visibility into what was used, by which tool and for what purpose.

The nature of the modern workforce compounds the challenge. Today, staff join, leave and move between teams, while organisations are regularly reshaped through restructuring, mergers and acquisitions. The problem of access no longer matching someone’s role or legitimate business need is not new.  Introduce AI into that environment, and existing data sprawl and oversharing become easier to discover and more consequential.

The recurring mistakes

A few patterns repeatedly undermine otherwise well-intentioned governance efforts. Organisations often lack a clear inventory of what sensitive data exists, where it lives, who owns it and who can access it. In large, long-established organisations, where information may have accumulated across decades of systems and restructures, this picture is rarely as tidy as teams assume.  Deploying AI into an environment that has not been properly assessed can amplify operational and reputational risk. 

Governance is also frequently treated as a pre-launch checklist rather than a continuous operational function.  Teams may invest heavily in preparation, but real-world use can surface behaviours, use cases and risks that pre-launch testing could not fully anticipate.

Many organisations are also layering multiple specialised tools that do not communicate effectively with one another. An organisation might use one platform for administrative automation, another for back-office processes and a third for access governance. Each tool may perform its individual function adequately, but together they can create fragmented oversight, duplicated effort and additional sprawl that is difficult to contain. 

The confidence-reality gap

There is a striking gap between how ready organisations believe they are and what their operating environments are revealing. ShareGate’s 2026 Microsoft 365 AI Readiness Survey of IT and security leaders found that 93% of surveyed IT and security leaders were confident their Microsoft 365 governance framework could support AI responsibly. Yet 29% reported that AI tools had already surfaced sensitive internal information that they believed should not have been accessible. A further 8% were unsure whether this had occurred.

The types of data being surfaced are not abstract.  They include contracts, employee records, strategic plans and customer lists. In a healthcare setting, that could mean an employee receiving an answer grounded in sensitive information they were technically permitted to access but no longer had a legitimate reason to see. 

With Microsoft 365 Copilot, one common issue is not a broken security boundary but an existing permission model that no longer reflects legitimate business need. The real issue is that those permissions are often broader, older, or less deliberate than leadership assumes. Permissions designed for human search and manual discovery were not created with prompt-based retrieval in mind. Information that once required someone to know where to look can now be surfaced through a single prompt.

When governance tools are fragmented and oversight is inconsistent, oversharing becomes a recurring pattern rather than an isolated incident. Remediation becomes slow and costly. The distinction that matters here lies in whether governance is reactive or proactive.  Organisations that establish and continuously review the right controls before and after deployment can reduce the likelihood and impact of data exposure, while avoiding the cost of remediating problems after trust has already been affected.

Getting the foundations right

The NHS Copilot rollout will be a major test for workplace AI at scale in the UK. Its success will depend as much on the governance surrounding it as on the technology itself.

That means organisations need to move beyond surface-level readiness checks. Effective governance starts with a thorough understanding of the existing environment: what data exists, where it lives, who owns it, and who can access it.  It requires collaboration across IT, security, legal, compliance, data and operational teams, with clear accountability for the decisions each group owns. It also requires scrutiny of the broader toolset: whether platforms work together, support consistent oversight and reduce more complexity than they introduce.   

Good governance isn’t a brake on AI adoption; it’s what makes fast adoption sustainable. By identifying risk earlier rather than responding after an incident, organisations give AI deployments a better chance to deliver. Teams can focus on efficiency, service improvement and better employee experiences rather than spending their time correcting governance problems that AI has made easier to see.

The goal is not more governance for its own sake. It is the confidence to use AI responsibly at scale.