If you’re like most business leaders I talk to, you’re experimenting with AI and thinking of it as something to tackle properly later. The reality is your staff are almost certainly using it already. They’re drafting emails, summarising documents, researching, writing proposals, building presentations and analysing data with it. Some of that is Microsoft Copilot. Some of it is tools you’ve never approved, never checked and may not even know about.
That’s why two recent guides from the National Cyber Security Centre (NCSC) caught my eye. The NCSC is the Government’s lead cyber security agency, and through its Own Your Online programme it has published practical advice on managing the security risks of AI and managing data security when using AI.
What I like is that it doesn’t say “don’t use AI”. It accepts what most of us already know: AI can bring huge benefits. The challenge is knowing where it’s being used, what data is going into it and whether the right guardrails are in place.
The question most businesses can’t answer
When we talk to clients about AI, we often start with one simple question: “Where is AI already being used in your business?” Very few leadership teams can answer it confidently.
Most can tell you they’ve bought Copilot licences. Some have run training, and some have written a policy. Very few know:
- which AI tools their staff actually use
- whether company information is going into public AI tools
- which teams are getting the most out of AI
- whether their Microsoft 365 setup is ready for AI at scale
- what risks need sorting before AI use grows
The NCSC guidance raises many of the same concerns, especially around governance, security, visibility and protecting data.
AI isn’t just a technology project
Getting AI right is a mix of people, process, data, security, governance and technology. That’s why we use a simple AI journey framework: before investing heavily, understand where you are, check you’re ready, identify the risks and build a practical roadmap. There’s more on that in Where do you start with AI?
What we’re seeing in NZ businesses
The good news: staff are experimenting, many businesses are already getting value, and leadership teams are keen. The not-so-good news:
- little visibility of how AI is being used
- unapproved “Shadow AI” tools popping up
- uncertainty about data security and privacy
- no governance or policy in place
- no clear plan for where AI goes next
None of this is unusual. It’s exactly why you need a baseline before rolling AI out further.
A Business AI Assessment
The Business AI Assessment, offered through Kinetics Group, answers three questions: Where is AI being used? Is it safe? What should we do next? It looks at:
- Business: your goals, risks, current AI use, approved tools and governance.
- Data: Microsoft 365 security, sharing, sensitivity labels, DLP and Copilot readiness.
- Users: a staff survey, device data, usage patterns, Shadow AI, Copilot adoption and training needs.
You get a practical report for your leadership team showing where you stand, the key risks and a prioritised list of recommendations. In short, visibility, and visibility is where good governance starts.
The best time to check was yesterday
The big message in the NCSC guidance is that AI isn’t something to avoid, it’s something to understand. The businesses getting the most from it aren’t always the fastest movers. They’re the ones that put the foundations in first. They know where AI is used, understand the risks, have clear governance and a roadmap, and can scale with confidence because they’ve done the groundwork.
If you’re exploring AI, thinking about Claude or Microsoft Copilot, or just wondering how much AI is already being used in your business, now’s a good time to find out.
Not sure how AI is being used in your business today? Book a free health check, or call us on 0800 688 768.