Enterprise Productivity Copilot

The enterprise is enabling a productivity copilot for employees to help draft emails, summarize documents, summarize meetings, generate internal content, and answer questions based on user-accessible enterprise information.

Improve employee productivity by reducing time spent drafting, summarizing, searching, and preparing routine internal communications.

[ ] Copilot
[ ] Internal LLM application
[ ] RAG system
[x] AI-enabled SaaS
[x] Embedded vendor AI
[ ] Agent
[ ] AI-enabled workflow automation
[ ] Customer-facing AI
[x] Employee-facing AI
[ ] Developer AI tool
[ ] Security operations AI
[ ] Decision-supporting AI
[ ] Action-capable AI

Pilot

Name: Head of Digital Workplace
Function: Technology / Workplace Services
Responsibility: Owns business outcome, user adoption, acceptable use, and productivity impact.

Name: Collaboration Platform Owner
Function: IT Platforms
Responsibility: Owns configuration, tenant settings, integrations, access controls, and support.

Name: Enterprise Data Governance Lead
Function: Data Governance
Responsibility: Reviews enterprise data exposure, classification, retention, and sensitive data handling.

Name: SaaS Vendor Manager
Function: Procurement / Vendor Management
Responsibility: Owns vendor relationship, contract review, vendor evidence, and feature enablement tracking.

Name: Security Operations Lead
Function: Cybersecurity
Responsibility: Coordinates investigation and containment if copilot causes data exposure, unsafe output, or policy violation.

Tier 2: Internal productivity with enterprise data

The copilot is employee-facing and primarily supports productivity tasks. It may process internal enterprise data, user-accessible files, emails, meetings, and chats.

It does not directly make decisions, approve actions, modify records, or trigger workflows in this pilot scope.

Risk may increase to Tier 3 if outputs are used for business decisions or official records, and to Tier 4 if tool/action capability is enabled.

[x] Internal enterprise data
[x] Confidential data possible
[x] Vendor processing
[x] Broad user population
[x] Output may be reused in internal communications
[ ] Formal decision impact
[ ] Tool/action capability
[ ] Customer-facing exposure
[ ] Regulated decisioning

User prompts
User-accessible documents
User-accessible emails
User-accessible chats
Meeting transcripts
Calendar context
Internal files
Generated outputs
Usage metadata

The copilot should only access information the user is already authorized to access.

The copilot must not be used to process secrets, credentials, private keys, regulated data, legal privileged content, or highly sensitive customer or employee data unless explicitly approved.

Highest expected classification: Internal / Confidential

Restricted or regulated data is not approved for pilot use.

[x] User permission inheritance reviewed
[x] Sensitive data guidance provided
[x] Prohibited input types defined
[x] Vendor processing reviewed
[x] Retention settings reviewed
[ ] DLP integration enabled
[ ] Sensitive prompt blocking enabled
[ ] Formal data leakage testing completed

Employee drafting
Employee summaries
Internal analysis
Meeting follow-ups
Email wording
Document preparation
Informal user judgment

Copilot output is advisory and draft-only.

Users remain responsible for reviewing, validating, editing, and approving any output before relying on it or sharing it.

[x] Output labeled as AI-generated or draft where possible
[x] User guidance states that outputs must be reviewed
[x] High-impact decision use is prohibited during pilot
[x] Customer commitments are prohibited
[x] Legal, HR, finance, security, and regulated decisions require separate review

Draft text
Summarize content
Answer questions
Generate internal content
Assist with meeting summaries

Approve decisions
Send external communications without user review
Modify enterprise records automatically
Grant or revoke access
Trigger production workflows
Execute code
Perform financial transactions
Perform security enforcement actions

Current status: No autonomous action capability approved.

If plugins, extensions, workflow actions, or API tool use are enabled later, the use case must be reassessed as Tier 4.

General drafting requests
Internal meeting notes
Internal non-sensitive documents
Public information
Non-sensitive internal summaries
Routine productivity requests

Passwords
API keys
Private keys
Secrets
Access tokens
Customer regulated data
Employee sensitive data
Legal privileged content
Payment card data
Health data
Production credentials
Confidential merger/acquisition information
Material non-public financial information

Moderate

[x] Acceptable use guidance published
[x] Prohibited inputs defined
[x] User training planned
[x] Sensitive data warning included in guidance
[ ] Automated prompt blocking implemented
[ ] Prompt injection testing completed

Draft email
Document summary
Meeting summary
Internal content draft
Internal Q&A response
Brainstorming output

Users must review all outputs before use.

AI-generated summaries must not be treated as authoritative records unless reviewed and approved by the responsible human owner.

AI output must not be used for legal, HR, financial, security, customer-impacting, or regulated decisions without additional review.

Incorrect summary
Missing context
Hallucinated detail
Overconfident tone
Sensitive information included in output
Output copied into official record without review

[x] User review required
[x] Output use restrictions defined
[x] High-risk use prohibited during pilot
[ ] Output quality sampling implemented
[ ] Formal correction process defined

Vendor AI is involved.

[x] Vendor AI assessment
[x] Data processing review
[x] Retention review
[x] Training/reuse review
[x] Admin configuration review
[x] Logging/evidence review
[x] Incident support review

templates/ai-vendor-assessment-template.md

The copilot may assist employees, but employees remain accountable for reviewing and validating outputs before use.

The business owner remains accountable for approved enterprise use of the copilot.

The technical owner remains accountable for configuration and access controls.

The vendor owner remains accountable for vendor risk review and evidence collection.

Users must review generated text before sending, publishing, uploading, or relying on it.

Managers remain accountable for business decisions.

Specialist teams remain accountable for legal, privacy, security, HR, finance, compliance, and customer-impacting decisions.

Inventory record
Risk assessment
Vendor assessment
Configuration record
User guidance
Approved user population
Data processing review
Retention/training/reuse review
Incident escalation path
Pilot approval record

Usage metadata logging required.

Full prompt and output logging should be avoided unless privacy, legal, and data governance approve the approach.

Where prompt or output content is logged, sensitive data protection and access restrictions must be applied.

Vendor prompt/output retention details still under review.
Vendor log export capability is partial.
Sensitive prompt detection is not yet automated.

[x] Inventory record created
[x] Business owner assigned
[x] Technical owner assigned
[x] Vendor owner assigned
[x] Risk tier assigned
[x] Vendor assessment started
[x] User guidance drafted
[ ] Vendor retention confirmed
[ ] Vendor training/reuse confirmed
[ ] Admin settings reviewed
[ ] Pilot user group approved
[ ] Incident escalation tested
[ ] Evidence package created

[ ] Permission inheritance review
[ ] Sensitive data handling review
[ ] Vendor logging review
[ ] User guidance review
[ ] Output quality sampling
[ ] Incident escalation test
[ ] Feature disablement test

Sensitive data entered into prompt
Confidential data exposed in output
User relies on incorrect summary
Vendor retention issue identified
Copilot generates inappropriate or unsafe content
AI output used for prohibited decision

Disable copilot feature for affected users
Restrict pilot population
Remove access to sensitive data source
Preserve available logs
Notify business owner
Notify data/privacy/legal/security depending on incident type
Contact vendor support if vendor evidence is required
Update user guidance
Pause rollout until remediation

Incident contained
Evidence preserved
Root cause understood
Configuration or guidance updated
Required approvals obtained
Pilot users notified if needed
Retest completed where required

Approved for limited pilot with conditions.

1. Vendor training/reuse settings must be confirmed before broader rollout.
2. Vendor retention settings must be documented.
3. User guidance must be published before pilot starts.
4. Pilot must exclude restricted or regulated data use.
5. Incident escalation path must be defined.
6. Feature disablement path must be tested before expansion.

Use case: Enterprise Productivity Copilot
Pattern: AI-enabled SaaS / Embedded vendor AI / Employee-facing copilot
Risk tier: Tier 2 for pilot
Business owner: Head of Digital Workplace
Technical owner: Collaboration Platform Owner
Vendor owner: SaaS Vendor Manager
Data boundary: User-accessible internal data only; restricted/regulated data excluded
Decision impact: Advisory/draft only
Tool/action capability: Not approved in pilot
Key controls: Inventory, ownership, vendor review, data guidance, output review, logging approach, incident path
Pilot decision: Approved with conditions