Fresh from ESPC (perhaps the most impactful edition yet) the message was unmistakable. As AI adoption surges, organizations are struggling to keep pace, and governance has emerged as the essential foundation for success.
As sponsors, we spent the week talking with IT leaders, architects, partners, and community experts. And while the event was full of great sessions and demos, the greatest value came from the conversations: unfiltered, practical, human. Across dozens of discussions, four themes surfaced consistently, and all of them point to a simple truth:
If organizations want to benefit from AI, they must first regain control of their content, processes, and governance.
Below is what we heard, what it means, and what you can do now, in the next 30–90 days, to build AI-ready foundations. At the bottom, you will find a ready-to-use 90-Day AI Readiness Roadmap one pager for download to get you started today.
1. Governance is no longer a “nice to have”. It’s mission-critical.
With AI agents, automation, and Copilot becoming embedded in the daily workflow, organizations are suddenly aware of a growing anxiety:
Who controls what the AI can see, do, trigger, or share?
Leaders shared similar worries:
- “Agents are acting on our behalf, but we don’t have oversight.”
- “Our permissions are too open, and now AI exposes everything.”
- “We don’t have a framework for approving or monitoring AI-initiated actions.”
AI doesn’t just read published documents; it reads everything it has permission for. If your Microsoft 365 environment is already overshared, duplicated, or misclassified, AI amplifies the problem.
What to do next
In the next 30–60 days:
✅ Run a permissions audit across SharePoint, Teams, and OneDrive.
✅ Reduce “Everyone” and “Everyone except external users” permissions.
✅ Enforce least privilege access by default.
✅ Enable auditing for AI-related actions and workflow triggers.
In 60–90 days, define an AI governance policy:
✅ Who can create agents
✅ Who approves workflows
✅ What actions require review
✅ What data is off-limits
✅ Create a sensitivity labeling baseline (even if simple).
These steps don’t require major rearchitecture, Yet, they bring clarity and control fast.
2. AI is evolving too fast, and organizations are overwhelmed.
A recurring theme at ESPC was exhaustion. Customers said:
- “Every week there’s a new Copilot, a new feature, a new agent.”
- “We can’t evaluate tools fast enough.”
- “We don’t even have time to understand what we already have.”
Even vendors admitted the pace is challenging.
We’re entering a period where being “caught up” is impossible. Instead, organizations need a strategy that adapts continuously rather than reacting to each new release.
What to do next
Stabilize, don’t chase:
✅ Pick one or two AI use cases to pilot first (e.g., enterprise search, meeting recap automation).
✅ Evaluate tools based on data readiness, not what's new.
✅ Create a small internal AI Council (IT, security, HR, business leaders).
✅ Document an “adoption threshold” (When do we adopt a new feature? Who assesses risk? What must be true? Permissions, labeling, training?)
This prevents AI from becoming a firehose you can’t control.
3. Content chaos continues, and AI can’t fix it.
Many leaders confessed that their biggest blocker isn’t the technology, it’s their own content. They said:
- “Our files are all over the place.”
- “We don’t have time to clean or tag anything.”
- “Metadata? We never invested in it.”
- “Our content structure is from 2017.”
This isn’t new. But now, with AI depending on high-quality, well-structured content, the stakes are higher. This means AI trained on incorrect, outdated, duplicated, or poorly permissioned content produces bad outcomes. That undermines trust.
What to do next
Quick wins (can start tomorrow):
✅ Identify stale sites and archive them.
✅ Clean up duplicate libraries and folders.
✅ Establish ownership for departments (who manages which content).
✅ Create a simple tagging standard (5–8 metadata fields max).
Longer-term:
✅ Build a content lifecycle: creation > review > archive > deletion.
✅ Automate classification where possible.
Think of it this way:
If your content is chaotic, AI becomes chaotic.
If your content is clean, AI becomes powerful
In the end, the greatest value of ESPC wasn’t in product announcements, it was in the people. The honest conversations, shared uncertainty, always meaningful. What stood out was a collective willingness to learn and move forward, even without all the answers.
Digital transformation is a human journey, not a technology checklist. AI will only succeed when organizations build shared understanding, shared responsibility, and shared governance. Culture must evolve alongside capability.
If your organization is preparing for this next chapter, we’ve created a practical resource to help you get started. Download your 90-Day AI Readiness Roadmap to take the first steps toward a more governed, secure, and future-ready digital workplace.
