What is a Copilot readiness assessment?
A Copilot readiness assessment checks whether your business is ready for Microsoft 365 Copilot before you buy licences for everyone. It looks at licences and accounts, which files are shared too widely, your data protection position, and how you'll test whether Copilot saves time. The checklist below covers all four.
This guide is about Microsoft 365 Copilot, the paid business version that works with your own files.
What do you need before you can use Copilot?
Each person needs an eligible Microsoft 365 plan, a Copilot licence and a Microsoft Entra work account. Features that use email or calendars need an Exchange Online mailbox, and some need OneDrive. Microsoft 365 Copilot Business works with Microsoft 365 Business Basic, Standard and Premium, among other plans.
Microsoft 365 Copilot Chat with web results comes with eligible Microsoft 365 plans at no extra cost. Chat that works from your own files needs the paid licence.
What are the security risks of Copilot?
The main risk is oversharing. Copilot only shows people what they can already open, but if folders, sites or old sharing links are open to everyone, Copilot makes their contents easier to find. Wrong answers used without checking are the other risk to plan for, because Microsoft says generative AI output isn't guaranteed to be accurate.
How do you fix oversharing before Copilot?
Find the sites, folders and links shared with everyone, then limit the ones holding HR, finance or client records to the people who need them. Remove old sharing links anyone can open. While those reviews are under way, Microsoft's tools can keep chosen SharePoint sites out of Copilot's results for now.
Microsoft calls this setting up a secure and governed foundation, and recommends it strongly though it isn't required. Its tools for the job include SharePoint Advanced Management and Microsoft Purview.
Do you need a DPIA for Copilot?
If Copilot will work with emails and files that contain staff or customer personal data, plan for a data protection impact assessment (DPIA). The ICO, the UK's data protection regulator, says that in the vast majority of cases, using AI involves processing likely to be high risk. Your data protection lead makes the call and records it.
The DPIA template for AI projects covers what to write down.
The Copilot readiness checklist
This is the same checklist as the Word file, in five parts.
Copilot readiness checklist
Work through it with whoever runs your Microsoft 365, before Microsoft 365 Copilot reaches more than a small test group. It isn't legal advice.
- Business
- [Your business]
- Checked by
- [Name, role]
- Date
- [DD/MM/YYYY]
1Licences and accounts
- Each test user has an eligible Microsoft 365 plan and a Copilot licence
- Everyone signs in with a work account, not a personal one
- Mailboxes are in Exchange Online, if Copilot will use email or calendars
- OneDrive is set up for each test user
2Permissions and oversharing
- You've found SharePoint sites and Teams shared with everyone in the business
- Sites holding HR, finance or client records are limited to the people who need them
- Old sharing links that anyone can open have been removed
- Sensitive documents carry sensitivity labels, if you use them
- Sites still under review are kept out of Copilot's results for now
3Data protection
- Your data protection lead has decided whether you need a DPIA
- Your AI policy covers Copilot, and staff have read it
- You know where Copilot processes your data, and it fits your rules
- You've decided how long Copilot chat history is kept
4People
- A small test group is chosen, with one job each to try
- Someone checks Copilot's work before it's used or sent
- The test group knows Copilot can be wrong and what to check
- There's one person to ask, and to tell when something goes wrong
5The first test
- You've timed each job as it's done now
- The test runs for four weeks on everyday work
- You'll compare the time taken and the quality at the end
- You've agreed what would make you roll it out further, or stop
Free to use and change, with no email needed.
How should you run a Copilot pilot?
Give a small group one job each that comes up every week, and time those jobs before they start. Run the pilot for four weeks on everyday work, with someone checking every output. Compare the time and the quality at the end, then decide whether to roll it out, change the approach or stop.
How much does a Copilot licence cost?
On 05/10/2026, Microsoft listed the Microsoft 365 Copilot Business add-on from £13.80 per user a month paid yearly, or £19.32 paid monthly, excluding VAT. The £13.80 is an offer for purchases up to 31/12/2026, against a usual £16.10. Microsoft 365 Copilot for enterprise is £23.10 paid yearly, or £24.26 monthly.
Both sit on top of an eligible Microsoft 365 plan. Prices change, so check Microsoft's page before you buy.