From AI Readiness to Responsible Innovation: Building the Foundation for What Comes Next
AI adoption is moving quickly from experimentation into everyday business operations. Microsoft 365 Copilot, AI agents, AI Skills and AI-powered development are changing how organizations find information, automate processes and interact with organizational knowledge.
But one of the biggest questions facing technology leaders isn't whether AI can create value. It's whether their organizations are ready to scale it.
That question was at the centre of SnapOn Software's AI Readiness & Strategy Masterclass: Governance, Agents and Innovation, an in-person executive roundtable bringing business and technology leaders together to explore the opportunities—and practical realities—of enterprise AI.
Hosted by Alexandra Fajgenbaum, Head of Operations at SnapOn Software, the event featured Gokan Ozcifci, Microsoft Regional Director, MVP and SharePoint AI Architect, and Peter Baddeley, Director of Sales & Client Solutions at SnapOn Software. The sessions moved from the rapidly evolving Microsoft AI ecosystem into the data lifecycle, governance and security foundations required to support it.
“We are entering a new era of technological transformation, much like the Industrial Revolution or the emergence of the internet. While change can be daunting and the full potential of AI is difficult to predict, our focus must be on innovating as much as possible while building the right foundations for data security, governance and responsible adoption.”
— Alexandra Fajgenbaum, Head of Operations, SnapOn Software
The Pressure to Move Fast—Without Moving Carelessly
The opening discussion placed AI within a much longer history of technological transformation—from the Industrial Revolution and public internet to cloud computing, generative AI and today's shift toward agentic AI.
The scale and speed of the current transformation are creating pressure for organizations to act. The presentation highlighted that 88% of surveyed organizations reported using AI in at least one business function in 2025, while global corporate AI investment more than doubled during the year. The message to attendees was straightforward: move quickly, not carelessly.
That creates what the session described as an executive tension.
On one side, organizations want to move faster, experiment, automate and introduce AI copilots. On the other, they still need to address regulation, auditability, data residency, human accountability and vendor risk.
The question is no longer simply whether an organization is using AI. It is whether the environment underneath that AI is ready to support it at scale.
From AI Agents to Agentic AI
Gokan Ozcifci’s session, From Agent to Agentic AI: Building an Effective AI Strategy, explored how organizations can move beyond experimenting with AI and start thinking more strategically about where different AI capabilities fit within Microsoft 365.
A key part of that is recognizing that not every AI agent solves the same problem. Gokan broke Microsoft’s ecosystem into three broad agent families: SharePoint Agents, grounded within a specific site and its information; built-in Copilot Agents, which can draw on broader Microsoft 365 and Microsoft Graph knowledge; and Copilot Studio Agents, designed for greater orchestration, external systems and more complex automated actions. Choosing between them should start with the business need—where the information lives, where users need to interact with the agent, what it will cost to operate and how it will be governed over time.
This also means understanding the relationship between information and action. Gokan described SharePoint as the information layer, where organizational documents, knowledge, permissions and context live, while agents represent the action layer—using that information to reason through tasks, automate processes and connect with other systems. As organizations give AI more ability to act, the quality and governance of the information underneath it becomes increasingly important.
One practical example is SharePoint AI Skills, which can turn repeatable work into reusable AI processes. Rather than employees repeatedly recreating prompts, organizations can capture processes such as contract checks, intake triage, metadata cleanup or FAQ updates as Skills that can be shared and governed within SharePoint. Existing controls including retention, sensitivity labels, audit and version history continue to apply.
As Gokan summarized it:
“A prompt dies with the chat. A skill is an asset you own.”
The broader takeaway was to start with the use case, not the technology. The goal isn't to introduce the most sophisticated agent or create as many AI Skills as possible, but to identify where AI can solve a real business problem and build it on information and processes that can be managed over time.
When Building Gets Easier, Governance Becomes More Important
AI is also lowering the barrier to building applications.
Microsoft 365 and Power Platform's AI-assisted development capabilities can turn natural-language requirements into working interfaces, data models and logic. That can help business teams move from an idea to a functional application much faster.
For IT, however, easier creation changes the problem.
As the presentation put it, organizations should expect volume, not complexity: potentially many more small applications, with the bottleneck moving from building them to reviewing and governing them.
That requires guardrails around data policies, connectors, development environments and application lifecycle management.
The session explored several layers of Power Platform governance, including connector-level data loss prevention policies, separating development, testing and production environments, and Managed Environments that provide stronger controls around sharing, usage insights, solution quality and security.
The principle is simple: making technology easier to build doesn't make governance less important. It makes governance more important.
What Happens When You Have 100 AI Agents?
As agent adoption grows, organizations also face a new management challenge: keeping track of the agents themselves.
The presentation introduced Agent 365 as a control plane for agent management, covering registry and discovery, identity and access, security and compliance, and usage and cost visibility.
That includes giving agents identities, applying least-privilege principles, assigning accountable human sponsors, extending security and compliance monitoring to agent behaviour, and understanding usage and costs across the environment.
The accompanying event booklet posed a useful test:
Imagine your organization has 100 AI agents one year from now.
Could you identify who owns every one? What each agent can access? What actions it can perform? Who is using it? Which should be retired?
The first question you can't confidently answer may be where your governance work needs to begin.
AI Readiness Doesn't Start With AI
Peter Baddeley's session shifted the discussion from what AI can do to the environment it depends on.
Organizations are already using AI for meeting summaries, data analysis, document creation and email drafting. But the presentation asked three very different questions:
Has out-of-date data been archived?
When did you last conduct a permissions review?
How are employees already using AI?
Those questions get to the heart of AI readiness.
Microsoft 365 environments accumulate information over years. Teams are created, SharePoint sites grow, employees change roles, guests retain access, permissions drift and outdated information remains searchable.
AI can make that information dramatically easier to find and use.
“AI readiness is about more than adopting new technology. Organizations need a practical roadmap that allows them to realize the benefits of AI while ensuring their data is secure, well-governed, and accessible to the right people. Our goal was to give attendees actionable insights they can take back to their teams and start putting into practice immediately.”
— Peter Baddeley, Director of Sales & Client Solutions, SnapOn Software
The Cost of Getting Governance Wrong
AI readiness is also a risk and compliance conversation. As organizations make more information accessible through Copilot and AI agents, gaps in security, permissions, data quality and governance can carry significant financial and operational consequences.
During the session, Peter highlighted the scale of potential regulatory penalties across different jurisdictions. Under PHIPA, organizations can face fines of up to $500,000, while Quebec's Law 25 can carry penalties of up to $25 million or 4% of global turnover. Internationally, the presentation highlighted potential penalties of €20 million or 4% of global turnover under GDPR and €35 million or 7% of global turnover under the EU AI Act.
But the potential cost of weak governance extends beyond regulatory fines. Peter also shared several real-world examples of what can happen when security, data and AI controls fall short. The presentation cited a Jaguar Land Rover cyberbreach estimated to have cost the UK economy $1.9 billion, a Canada Life breach that exposed personal data belonging to 70,000 individuals, and an incident involving West Midlands Police in which away fans were banned from a match based on a fictitious Microsoft Copilot result.
These examples point to a broader issue as AI becomes more embedded in business processes. Organizations aren't only responsible for securing the systems AI operates within; they also need confidence in the quality of the information AI is using, who can access it, how activity is audited and where human accountability remains necessary.
That makes governance part of the foundation for scaling AI—not something to address after adoption has already accelerated.
Your Data Lifecycle Becomes Your AI Foundation
One of the most practical parts of the discussion focused on the four stages of the data lifecycle: creation, collaboration, retention and disposal.
At creation, organizations may already face duplicate information, sensitive data entering environments without the appropriate protections and employees using shadow IT.
During collaboration, access points multiply and permissions can drift as employees change roles.
Retention creates another challenge: organizations need to understand why information is being retained, how long legal or regulatory requirements require it to remain, and how retained information will remain protected, searchable and auditable.
Finally, disposal should not simply be treated as cleanup. Keeping unnecessary data can increase risk, while incorrectly deleting required information can be equally damaging. Disposal therefore needs policy, documentation and auditability.
This is why AI readiness is so closely connected to data lifecycle management. AI operates on the environment organizations give it.
Governance Doesn't Have to Look the Same Everywhere
There also isn't one governance model that works for every organization.
The session compared three approaches.
A centralized model gives a central IT or governance team responsibility for policies and enforcement. A delegated model gives business units and workspace owners more responsibility within defined guardrails. A hybrid model combines central policy with delegated execution to balance control and agility.
The appropriate model depends on the organization's structure, risk profile and operating environment. What matters is that accountability is deliberate rather than assumed.
This was also reflected in a comment from Asher Jaffri, CTO of the Town of Erin, who discussed how the municipality is already using AI in production for areas including road pavement assessments and building inspections.
“The industry is changing at a lightning pace, and the core fundamentals don't change much. It is guarding, governance, integrity, security, and responsibility.”
— Asher Jaffri, CTO, Town of Erin
Attendee interview excerpt
His example reinforced an important part of the day's conversation: AI can already support practical business and public-service outcomes, but innovation doesn't remove the need for accountability around the information and systems supporting it.
Seeing AI-Powered Governance in Action
The conversation wasn't limited to theory.
During the session, attendees saw a demonstration of AI-powered governance using SnapOn Software's ProvisionPoint, including onboarding a workspace with Copilot and triggering a review process through Microsoft Teams to determine whether unused information should be archived or deleted.
It demonstrated what lifecycle governance can look like when policies move beyond documentation and become part of everyday Microsoft 365 processes.
That matters because sustainable AI governance isn't just about setting rules. Organizations need ways to apply those rules consistently as new workspaces, information, users and eventually AI agents enter and leave the environment.
Building the Data Foundation: SnapOn Software's Data Management Bundle
The themes discussed throughout the roundtable—visibility, controlled creation, ownership, permissions, activity monitoring and lifecycle management—are also the foundation behind SnapOn Software's Data Management Bundle.
The bundle brings together solutions that address different stages of the information lifecycle and help organizations create a more governed Microsoft 365 foundation for AI.
SOS Intake focuses on how information enters the organization. It provides structured, secure intake forms with capabilities including file uploads, conditional logic, automated workflow approvals, audit trails and routing into systems such as SharePoint, NetSuite or Salesforce. By standardizing data capture from the beginning, organizations can reduce manual re-entry and create more consistent information for downstream processes.
ProvisionPoint focuses on the governance of Microsoft 365 workspaces. It provides standardized provisioning, ownership and permission controls, policy enforcement and lifecycle oversight. Organizations can establish governed boundaries around Teams and SharePoint environments and apply controls for archiving, expiration and deletion rather than allowing unused workspaces to accumulate indefinitely.
Audit provides visibility into what happens after information is created and shared. It tracks activity across SharePoint, Teams, OneDrive and Exchange to support security monitoring, governance, compliance and investigation. As AI increases the speed at which organizational information can be discovered and used, understanding who accessed what—and what happened next—becomes increasingly important.
Together, these capabilities support a broader lifecycle:
Collect information intentionally → govern where it lives → understand how it is accessed and used → review, retain or dispose of it appropriately.
That creates a stronger foundation not only for Microsoft 365 governance, but for the Copilot, AI Skills, applications and agents that increasingly depend on that environment.
Explore SnapOn Software's solutions
A Practical Starting Point: The First 120 Days
For organizations unsure where to begin, the event closed with a practical 120-day roadmap to governance ROI built around four steps:
1. Audit what you have.
Build visibility into the existing environment before introducing more complexity.
2. Engage your data owners in review.
Governance cannot sit entirely with IT. The people responsible for business information need to help determine what remains relevant, who should have access and what can be removed.
3. Design your rules and policies.
Establish the controls that should govern information, workspaces, permissions and lifecycle decisions.
4. Implement new data collection processes.
Apply governance earlier in the lifecycle so organizations aren't continually trying to clean up information after the fact.
From Readiness to Responsible Innovation
The opportunity ahead isn't simply to deploy more AI.
It's to identify where AI can create meaningful business value while making sure the information, security and governance foundations underneath it are ready to scale.
For some organizations, the next step might be an AI agent or reusable AI Skill. For others, the priority may be reviewing permissions, cleaning up outdated information, establishing ownership, strengthening Power Platform controls or introducing more consistent lifecycle governance.
The roundtable left attendees with several questions worth bringing back to their own organizations:
What information would we be uncomfortable having Copilot surface today?
Which repetitive process could become an AI Skill or agent?
If employees can build apps and agents dramatically faster, are our governance processes ready?
What should an AI agent never be allowed to do without human approval?
If we had 100 agents tomorrow, could we tell you who owns every one?
And perhaps the most important:
What are we calling an AI problem that is actually a data or governance problem?
The final message of the masterclass looked beyond the technology itself. AI has the potential to augment what people can do, delegate defined work to intelligent systems and eventually transform how organizations operate. But making that transition responsibly requires the infrastructure underneath AI to evolve with it.
About the Author
Peter Baddeley
