Preparing your data and permissions before you switch on AI

Why preparation matters more than the tool

When an AI assistant answers a question using your company's documents, it is only as accurate as those documents. If the shared drive holds five versions of the price list, three of them obsolete, the assistant may quote the wrong one with complete confidence. If an old staff handbook still describes leave rules that changed two years ago, staff asking the assistant will get the old answer.

Permissions matter just as much. Most small businesses have shared folders more widely than they intended, often because it was quicker at the time. Before AI, an over-shared payroll spreadsheet sat unnoticed in a folder nobody opened. With an assistant that searches everything a user can access, a simple question about salaries might bring it straight to the screen.

Step one: find out what you have

Start with an inventory of where documents live: SharePoint sites, Teams, OneDrive, Google shared drives, an old file server, Dropbox, email attachments. For each, note roughly how much data there is, what it is for and who looks after it. Most businesses find at least one location nobody really owns.

Then look at the shape of the data. Admin reports in Microsoft 365 and Google Workspace can show sites and drives with external sharing, files shared with everyone in the organisation and sharing links that anyone can open. Specialist tools can go deeper, but even the built-in reports are a useful starting point.

Step two: archive and delete

Agree retention rules with the business owner and, where relevant, your accountant or lawyer. Many records need keeping for a set period, but they do not all need to sit in the everyday workspace. Move closed projects, former clients and old years into an archive area that the AI tool is not pointed at, or exclude it from search where the platform allows. Delete genuine junk: duplicates, abandoned drafts and personal files that should never have been stored there. Pay particular attention to documents that look authoritative but are outdated, such as old price lists, policies, templates and procedures. Mark the current version clearly or remove the old ones, so both people and AI find the right answer.

Step three: fix the permissions

Work through the sensitive areas first: HR, payroll, finance, management, legal and any client data with special requirements. Make sure only the right group can access each, rather than individuals added one at a time over years. Remove company-wide and anyone-with-the-link sharing from anything confidential. In Microsoft 365, check Teams and SharePoint site membership, because adding someone to a team gives them access to its files. Set a simple rule for the future: access is granted to groups that match roles, not to individual people, and each sensitive area has an owner who reviews membership every few months. That keeps the clean-up from unravelling once everyone is busy again.

Step four: label what is sensitive

Depending on your licence, Microsoft 365 and Google Workspace offer ways to label or classify files, for example as confidential, and some AI tools respect those labels by limiting what they will surface or share. Even without advanced licences, consistent folder names and a clear structure help. A small set of labels that staff understand is better than an elaborate scheme nobody uses. Check what your chosen AI tool can be told to ignore. Some can be restricted to particular sites or excluded from certain content, which is a useful extra layer while the clean-up continues.

Step five: pilot and watch

Roll the AI tool out to a small group first, ideally people from different teams. Ask them to try questions that should not return sensitive results, such as salaries, performance reviews or client financials, and to report anything surprising. Each surprise points to a permission still too broad. Fix it, then expand the rollout. After launch, keep the habits going: new folders created with the right permissions, leavers removed promptly, archived material moved out regularly. Data preparation is not a one-off task done for the AI project; it is the ordinary housekeeping that makes both people and AI tools more useful.

It helps to give each team a small, regular task, such as a fifteen-minute tidy of their own area at the end of each quarter: archive finished work, delete duplicates, check who is in the team and that the current templates are clearly marked. Spread across everyone, the effort is light, and the data stays in a state where an AI assistant gives answers people can rely on.