AI Assistant and Copilot Rollout Guide

How to use this document

• What it is for. This is a base guide for rolling out general-purpose AI assistants and copilots (for example, Microsoft 365 Copilot, Gemini for Google Workspace or ChatGPT Enterprise) and AI features built into software you already license: which accounts to use, who gets licenses, how to prepare data and permissions before connecting the assistant, how to roll out in waves and how to measure usage, idle licenses and costs.
• Who should own it. The AI lead, with IT as the system owner of each assistant, and with information security and the data protection officer (or the country's equivalent role). Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. Decide which assistants and plans you roll out (section 3), the user segments and their priority (section 4), the data scope of the pilot (section 5), the number of days without use before a license is reassigned (section 10) and the consumption budget (section 11).
• Module selection. Choose the level (Basic, Standard or Reinforced) in "Module selection" and keep the P2 module only if you build your own assistants connected to your data.
• Fields to complete. Replace the bracketed text and complete the tables in sections 4, 9 and 11 with your data. Product names are examples; they do not imply a recommendation.
• Review. Have information security validate sections 5 and 6, and have legal or your advisor review the vendor's contract terms (data use, retention and location) before wave 1.
• Approval and use. Have the AI lead approve it, record the approval in "Version history" and use it as a checklist for each wave.

Module selection

Organization's situation	Sections to keep
Basic level (under ~50 people, commercial assistants only, no special-category data)	Sections 1 to 13 without the paragraphs marked [STANDARD LEVEL] or [REINFORCED LEVEL]; a single wave after a pilot; aids A to F
Standard level	The whole core plus the [STANDARD LEVEL] paragraphs
Reinforced level (regulated sector, special-category data or assistants connected to high-risk systems)	The whole core plus the [STANDARD LEVEL] and [REINFORCED LEVEL] paragraphs
P2: own assistants connected to internal data through APIs or RAG	Also section 5.5 [MODULE P2]

Delete the sections and paragraphs that do not fit your situation.

AI Assistant and Copilot Rollout Guide

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Guide owner	[OWNER]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Contact	[AI GOVERNANCE EMAIL]

1. Purpose and scope

1.1 This guide sets out how [ORGANIZATION NAME] rolls out general-purpose AI assistants and copilots to its staff, so that value is measured, data is not exposed to people who should not see it and costs stay under control.

1.2 It applies to:

a) general-purpose generative AI assistants licensed for staff;
b) copilots and AI features built into productivity suites, CRM, ERP, customer service or development platforms, when they are turned on;
c) connectors, plug-ins and agents offered by those assistants;
d) [MODULE P2] the organization's own assistants connected to its data through APIs or retrieval-augmented generation (RAG), under section 5.5.

1.3 The rules for staff use are in the "Responsible AI Use Policy (Including Generative AI)". The decision on which tool to buy follows the "AI Tool Adoption Policy" and the "AI Tool Selection and Evaluation Guide". This guide starts once the tool has been chosen.

1.4 Assistants with agent features that send, buy, change records or run code are also governed by the "AI Agent Policy: Autonomy, Memory and Permissions". Coding assistants are governed by the "AI Coding Assistant Policy".

2. Rollout principles

2.1 Register first. No assistant, AI feature turned on, connector or agent is made available to staff until it is recorded in the "AI System Inventory", with its deployment profile, its risk level and its system owner.

2.2 Enterprise accounts only. The organization's data is used only with managed enterprise accounts (section 3).

2.3 Data ready before connecting. An assistant that searches a person's email, documents and channels finds everything that person can open, even if they do not know it. Permissions are reviewed before connecting, not after (section 5).

2.4 In waves. The rollout starts with a pilot on a clean data scope and is extended in waves with entry and exit criteria (section 7).

2.5 Measure and adjust. Licenses are assigned, measured and reassigned according to actual use (sections 9 and 10), and consumption costs have a budget and alerts (section 11).