AI readiness is data readiness

From the desk of the MD, Johan Lamberts.

---

• Speed is the wrong question – enterprise AI has jumped to full-workforce Copilot rollouts and most boardrooms are asking how fast they can follow, when that is not what decides the outcome.
• AI readiness is data readiness – an organisation is exactly as ready for Copilot as its data foundation is governed, no matter how many seats it switches on.
• Copilot only amplifies what you already hold – it brings no knowledge of its own, reading what it can reach and inheriting the permissions already in place, so it magnifies a governed estate and an ungoverned one alike.
• Microsoft says so itself – its own deployment guidance is to remediate oversharing and govern data access before rollout, because an AI is only as good as the data beneath it.
• The winners prepared the ground – coming out ahead means governing the foundation before you switch anything on, which in South Africa, POPIA makes a matter of accountability, not just performance.

Enterprise AI has stopped being an experiment. In the space of a year it has moved from cautious pilots with a handful of users to full-scale rollouts across entire organisations. Global firms are now enabling Microsoft’s Copilot for tens, and in some cases hundreds and thousands of staff at once. Professional services firms, banks, insurers – the pace has changed, and it is still accelerating.

South Africa is no longer watching from the outside. On 24 June, Investec – the specialist bank and wealth manager, dual-listed on the Johannesburg and London exchanges – announced it had switched Microsoft’s AI assistant on across its entire workforce of around 8 000 people, spanning its South African, UK and international operations.

The bank says more than 800 AI agents are already in use, and puts the time reclaimed at over 350 000 hours a year. Investec describes it as the first full-workforce Copilot deployment publicly announced by a South African organisation. It is a genuine milestone, and it will not be the last.

The question now sitting in most local boardrooms is a simple one: how quickly can we do the same?

That is the wrong question.

The conversation almost always starts in the same place – licences, seats, how fast the rollout can be scheduled. Those are procurement questions, and they are the easy part. They assume the hard work is buying and deploying the tool.

The harder question, and the one that actually determines the outcome, is whether the data underneath is governed enough to let an AI read it. Not how many people you switch on. What those people’s AI can reach once you do.

AI readiness is data readiness. An organisation is exactly as ready for Copilot as its data foundation is governed – and no readier.

There is a prize here, not only a risk. The organisations that govern the foundation first will pull ahead of the ones still counting seats – theirs will be the AI a business can actually act on.

Copilot’s danger and its promise share one mistake: treating it as a source of knowledge in its own right. It is not. It arrives knowing nothing about your business, and reads only what it can reach – your documents, your mailboxes, your databases and the permissions around them. 

Microsoft is unusually blunt about this in its own documentation. Copilot, it states, “only accesses data that an individual user is authorised to access”, and “doesn’t access data that the user doesn’t have permission to access”. If an employee can open a sensitive file today, their Copilot can read, summarise and quote from it tomorrow – faster, and across far more content, than any person would ever trawl by hand.

The technology is, rightly, an amplifier – and an amplifier makes everything louder, the signal and the noise together.

Point it at a governed estate and it compounds good decisions. Point it at 15 years of accumulated access sprawl – the service account with rights no one remembers granting, the folder shared with the whole company in 2014 – and it will hand the wrong thing to the wrong person at machine speed, in fluent prose, with a citation that makes it look authoritative.

The AI cannot tell the difference. It was never asked to.

The second failure is quieter than a breach. An AI grounded on poor data does not fall over; it answers confidently, and wrong.

Again, Microsoft says so itself. “Your AI is only as good as your data,” its data governance team wrote last year. Feed a model incomplete, duplicated or mislabelled information and it returns incomplete, duplicated or mislabelled answers – with none of the hesitation a human expert would show.

On its own Power BI assistant, Microsoft is more specific still: without proper data preparation, it warns, Copilot can produce “generic, inaccurate or even misleading outputs”.

Copilot does not weight information by how recent or correct it is; a superseded policy, an abandoned draft, a duplicated record are all fair game if they look relevant. A finance team that asks for last quarter’s numbers and unknowingly gets them from a superseded workbook has not been helped – it has been misled, politely and instantly, with a confidence no spreadsheet ever offered.

None of this is theoretical. The evidence is coming from the field, not from sceptics.

South Africa’s own numbers make the point first. World Wide Worx’s SA Generative AI Roadmap 2025 found that 67% of large local enterprises now use generative AI, up from 45% a year earlier – but fewer than one in seven have an organisation-wide strategy for it, and only 13% have proper guardrails in place.

Adoption has run well ahead of governance, into what the study calls a regulatory and ethical vacuum.

The international evidence points the same way. A widely cited – and much debated – MIT study last year found that roughly 95% of enterprise generative AI initiatives delivered no measurable return, and traced the failures not to the models, which are genuinely capable, but to how poorly the tools were wired into the work around them.

McKinsey puts firmer numbers on the same gap: almost nine in 10 organisations now use AI, yet only about 6% report a material impact on the bottom line.

Gartner has reported that data oversharing pushed around 40% of organisations to delay their Copilot rollouts by three months or more, and counts permission sprawl among the leading security risks of the technology.

The pattern is consistent. Where AI disappoints, the model is rarely the problem. The foundation underneath it is. And where AI delivers, the same foundation is the reason – the estate is the lever either way.

Which makes the most common response – buy more licences, widen the rollout, drive harder for adoption – exactly backwards. You cannot buy your way out of a data problem by deploying more of the tool that exposes it.

Microsoft has read the same evidence, and its own deployment guidance is sequenced accordingly. Its blueprint for a secure Copilot rollout sets the order plainly: remediate oversharing, put guardrails in place, then meet your regulatory obligations. Before value, before rollout, fix the permissions. Prune the stale content. Govern the estate. Only then switch on.

In South Africa, the argument sharpens to a legal edge.

Under POPIA, an organisation remains the responsible party for how personal information is processed and who may see it. That accountability does not transfer to a vendor, and it certainly does not transfer to a machine. “The AI surfaced it” is not a defence anyone will want to test in front of the Information Regulator.

An assistant that can retrieve, summarise and redistribute personal information across the whole estate in seconds does not lower that obligation. It raises it. Handled well, though, the discipline that keeps you compliant is the same discipline that makes the AI worth trusting.

Microsoft has committed to in-country processing for its AI tools in South Africa, even if the timeline for it has slipped. That is welcome. But residency was never the hard part. Governance is.

There is a tempting shortcut, and it deserves a straight answer. Microsoft ships controls – Restricted SharePoint Search chief among them – that let you switch Copilot on for a pilot while hiding the content you have not yet secured. Used well, they are worth having.

But Microsoft’s own documentation is clear that Restricted Search “isn’t a security boundary” and is not meant for long-term use. The independent specialists are blunter: it is a curtain, not a wall – a way to buy time, not a substitute for the work.

Leave the curtain up and you have paid for an assistant, then blindfolded it.

Nor is the answer to freeze everything until the data is perfect. It never will be, and Copilot earns real value long before it is – in drafting, in summarising, in catching up on a thread.

The discipline is narrower and more practical than boiling the ocean: govern the data each use case actually touches, before you turn that use case on. Sequence the readiness to the rollout, rather than treating one as a gate before the other.

So what does the work actually buy you? An assistant the whole organisation can trust – one that answers from current, permitted, well-modelled data, so people can act on it without checking behind it. Decisions you can defend, to a board or to the Information Regulator. Speed without the second-guessing.

And a lead that compounds: while others stall in remediation or quietly lose faith in a tool that keeps getting things wrong, the organisation that prepared the ground keeps pulling ahead. That is what the work earns.

It comes from the unglamorous work, done in the right order. Govern access down to what each person genuinely needs. Classify and clean the data the AI will actually reach, so that what it retrieves is current, correct and permitted. Modernise the platform underneath. None of it makes the launch announcement; all of it decides whether the launch creates value or exposure.

This is the work Ascent does, and it is worth being clear about where the company sits. Ascent provides the Copilot licensing – that part is straightforward. The value is in what comes before it: a governed data foundation, built on a properly modelled and secured platform, so that when the AI is switched on it reads from something trustworthy.

Microsoft now brands its own data platform “the AI-ready data foundation”, which is exactly the point. The licence is the easy part. The foundation is the difference between an assistant you can rely on and one you have to check behind.

Modernise, optimise, protect – then, and only then, amplify.

I have spent close to 30 years watching organisations invest heavily in the visible layer and underinvest in the foundation beneath it.

Artificial intelligence has not broken that habit – but it has, for the first time, made the foundation pay off in plain sight. The firms that did the quiet work now hold something their competitors cannot quickly copy: an AI they can trust.

The pace of adoption is not going to slow, and I would not want it to – the opportunity is real, and it is arriving here in earnest. Speed without a governed foundation is not readiness; it is exposure with a faster interface. But speed on top of a governed foundation is precisely the advantage this moment is offering.

That preparation is the whole game. Start there, and the rest follows.