Quick answer: Naming an approved AI product is not the same as describing an AI policy. Document which experience employees use, the information it can access, permitted work, connected tools, human review, and who approves changes. Evaluate the actual configuration rather than the product name.
Watch the video
AI Nightmares, Episode 1: Stacy, Steve and Shanee discuss AI use and risk
Related discussion with Stacy
I asked Steve what it means when a bank answers a question about its AI policy by saying it uses the Copilot available in its Microsoft environment. The answer identifies a tool. It leaves several operating questions open.
Be precise about the product and the environment
Microsoft’s current product documentation describes organizational-data access and existing permission controls. Product protections matter. They do not tell another person which use cases your institution permits, how your tenant is configured, or which connected agents your administrators allow.
Avoid describing Copilot as just a browser extension. Microsoft offers distinct experiences and configurations. Begin with the specific product, organizational account, enabled features, and approved use case.
Write down what employees may do
- Approved tasks: what work can the tool support?
- Data boundaries: what may be supplied, retrieved, retained, or shared?
- Access: which people and connected services can see the information?
- Review: who checks an output before it informs a customer communication or operational action?
- Exceptions: what should an employee do when the tool produces an uncertain or inappropriate result?
- Changes: who evaluates a new feature, connector, model option, or use case?
These are recommended operating questions. They are not a claim that a particular six-part policy is a regulatory requirement.
Test the policy against an actual task
Illustrative example: An employee wants help drafting a response based on an internal document. Ask whether that task is permitted, whether the account has appropriate document access, whether the content belongs in the selected service, and who reviews the draft. The policy should help the employee make that decision before the prompt is entered.
Ownership makes the policy usable
Assign an owner for the approved-tool inventory and a route for questions. A policy that names a product but leaves staff to interpret data boundaries independently is harder to use consistently. Keep the policy connected to procurement, security, employee training, and the actual controls in the environment.
For vendor changes after onboarding, read Vendor AI After Due Diligence.
Frequently asked questions
Does using Microsoft Copilot mean our policy is complete?
No. Product protections are one input. The institution still needs to define permitted work, data boundaries, ownership, and review for its actual configuration.
Should we assume all Copilot experiences handle data identically?
No. Identify the specific experience, account, enabled capabilities, and contractual context, then check the documentation that applies.
What is the first practical step?
Inventory the AI experiences in use and describe one permitted task end to end, including inputs, access, review, and output handling.
Sources
Continue the conversation
For help translating your product and sales process into a bank-ready decision, explore working with Stacy. For ongoing practical guidance, subscribe to Selling Fintech.
Adapted from Stacy Bishop’s original posts and newsletter with AI-assisted editing. Cover portraits were generated from Stacy’s reference photographs. Illustrative exercises are labeled.
