Sample deliverables
Illustrative governance and Copilot readiness packages, alongside AI proof-of-concept and readiness handovers. These examples use invented material and contain no client data or measured client results.
Illustrative example · AI proof of concept
Internal guidance assistant
Find answers in approved internal documents, with links to the relevant source.
Representative scope and handover format. No client data or measured results.
A question, an answer, and its source
This worked example shows the expected response format. The answer below is written to demonstrate the interaction; it is not output from a live assistant.
- A team member asks
- How do I request an AI tool?
- Illustrative answer
- Send your IT contact the tool name, intended task, and type of data you plan to use. Wait for approval before entering business information. AI-use policy · Section 2
Synthetic policy excerpt created for this example.
AI-use policy
Section 2 · Requesting a new tool
Before using a new AI tool for work, send your IT contact a request containing the tool name, the task you want to use it for, and the type of data involved. Your IT contact will review the request. Do not enter business information into the tool until the request has been approved.
Use case and boundary
An internal guidance assistant searches approved organizational documents, cites the source passage, and states when the supplied material does not answer the question. It supports finding guidance; it does not make decisions or take actions on behalf of the organization.
Inputs
Synthetic example policy documents. Real project data, access permissions, and the documents in scope are agreed separately. This example is an illustrative handover format; it does not represent a deployed assistant or a downloadable code package.
Proposed evaluation cases
These cases illustrate an evaluation plan. They have not been run and are not measured results.
Supported question
Which process should I follow to request an approved AI tool?
Cite the relevant passage in the supplied example AI-use policy and answer only from that passage.
Missing answer
What is our budget for a new AI tool?
State that the supplied documents do not contain the answer. Do not invent a budget.
Conflicting sources
Who approves a new tool when two supplied policies name different owners?
Flag the conflict, cite both passages, and ask for clarification instead of silently choosing an owner.
Handover outline
- Source code and setup notes
- Repository contents, configuration requirements, and instructions for running the prototype in the agreed environment.
- Evaluation cases and limitations
- Questions to test, expected behavior, evidence to collect, and known gaps such as missing or conflicting source material.
- Operating assumptions
- Approved document access, model and hosting choices, usage assumptions behind running-cost estimates, and responsibilities for maintaining the source material.
- Next-step recommendation
- A decision supported by evaluation evidence, unresolved constraints, and the separately scoped work required before production.
Example recommendation format
Proceed / revise / stop, with the evidence and constraints behind the recommendation.
This describes the format of a recommendation, not an assessment of the illustrative assistant.
Invented organization and scenarios. No client data or measured client results.
Illustrative governance pack
A fictional operations team uses a writing assistant and a meeting-summary tool. This example shows how an inventory, rules, approvals, and review records can fit together. It is not a completed framework assessment.
AI inventory excerpt
Writing assistant: draft public product descriptions from approved notes. Owner: operations lead. Customer records and credentials are excluded from the example use case.
Acceptable-use excerpt
Use approved tools for approved tasks. Check factual statements against a source and have the designated owner review a draft before publication.
Approved-tool list
Writing assistant: approved for public product descriptions in a managed work account. Meeting-summary tool: pending privacy and retention review. Record the owner, approved task, account type, and review date.
New-tool request
Record the proposed task, information involved, tool owner, vendor terms to review, and approval decision. A request is not permission to begin using the tool.
Rollout and review plan
The operations lead publishes the rules, the IT owner maintains the approved-tool list, and the privacy lead resolves the meeting-recording questions. Record target dates and a 30-day review point.
Synthetic sharing scenario. No tenant scan, client finding, or measured result is presented.
Illustrative Copilot readiness package
A fictional team wants to pilot Copilot with one SharePoint library. The example separates a sharing question from a remediation decision and a limited pilot recommendation.
Review scope
One fictional SharePoint library, its members, sharing links, and proposed pilot group. Other sites, OneDrive accounts, Teams workspaces, and tenant configuration are outside this example.
Findings by sensitivity
Example: a draft pricing document is accessible to a broader staff group than its owner intended. Record the content owner, current access, intended audience, and sensitivity, then rank the finding against the others in scope.
Remediation sequence
Confirm the intended audience with the owner, agree an access change, then have the responsible administrator apply and verify it. Review available interim controls against current licensing; do not treat them as a replacement for fixing permissions.
Pilot boundary
Proposed pilot: an agreed group and library after the scoped access questions are resolved. Other sites and libraries remain outside the review, not implicitly cleared by it.
Go/no-go record
Illustrative recommendation: defer the pilot until the content owner confirms the access change and the team has a route for reporting unexpected content. Record unresolved risks, decision owner, and the next review point.
Readiness package
A readiness sprint can include the documents listed below. We agree which documents to prepare before work begins.
Executive summary
A one-page summary of findings, gaps, and recommended actions.
Cyber & privacy baseline review
A review of existing controls and policies, with gaps and priorities identified.
AI usage inventory & acceptable-use policy
A list of AI tools in use, the data they handle, and rules for using them at work.
Risk register
Identified risks, their priority, and the person responsible for each.
Incident-response & breach-readiness plan
Response steps, assigned responsibilities, and contacts for a security incident or data breach.
Vendor-questionnaire answer bank
Draft answers to security questions, with references to supporting evidence.
30/60/90-day action plan
Prioritized actions for the next 30, 60, and 90 days, with owners and target dates.
Supporting evidence
Policies, records, and other documents referenced in the review and questionnaire answers.
20-minute introductory call.