TL;DR

NHS England intends to give Microsoft 365 Copilot to roughly 500,000 clinical and support employees, one of the largest workplace AI deployments attempted in Britain. Survey figures published by governance vendor ShareGate suggest the surrounding controls may not be ready. Some 93% of the IT and security leaders polled backed their own Microsoft 365 governance as capable of handling AI responsibly — but 29% had already seen AI tools pull up confidential material nobody should have been able to reach, and another 8% did not know either way.

The argument, made by ShareGate’s Richard Harbridge and worth weighing accordingly, is that the failure is rarely a broken security boundary. It is that permissions granted for an era of manual searching behave differently once anything can be retrieved by asking. Information that previously required knowing where to look now surfaces from a single prompt.

The readiness picture

Among doctors polled, 68% judged the health service short of the digital foundations an effective AI rollout would need, citing training gaps, interoperability, patient safety and privacy. More than a quarter of GPs already use AI tools clinically, so the rollout formalises something under way rather than starting it.

Three failure patterns recur: no dependable record of which confidential material exists and who can reach it; governance treated as a launch checklist instead of a continuous function; and multiple specialist tools that do not talk to each other, producing fragmented oversight.

Looking forward

An organisation reshaped by decades of restructuring, with staff constantly joining, leaving and moving between teams, will have access rights that stopped matching roles long ago. That is not an NHS peculiarity — it describes most large UK employers, and the 3 August Lancashire County Council Copilot rollout raised the same question at smaller scale. The half-million-seat version simply makes the answer visible faster. Auditing who can currently reach what is unglamorous work, and it is cheaper before deployment than after.