Nobody's a guru. The honest ones say so.

Every conversation about AI right now is a conversation being had inside uncertainty. Nobody on either side of the table knows exactly what the tools will be capable of in six months. Nobody knows which of today's feature announcements will still exist a year from now, which will have been rebranded, and which will have been quietly replaced by something newer. Anyone claiming otherwise is selling, not thinking.

That uncertainty is the problem, and also the point. If you can't predict the ceiling, you stop trying to — and you spend your energy on the foundation instead. Foundations are boring. They're also the only thing you control. A business with clean data, sorted permissions, and an honest policy posture can pick up whatever AI ships next and get value out of it. A business without those things can't, no matter how many licenses it buys.

This is why the first conversation we have about AI almost never starts with AI. It starts with the data the AI is going to read.

Microsoft Purview is a capable, well-documented toolset. A competent administrator can stand up sensitivity labels, retention policies, and data loss prevention rules in a few weeks. The portal isn't the bottleneck. The bottleneck is upstream of the portal — in the work of deciding, in plain English, what your organization considers confidential, how long you're willing to keep things, who is allowed to see what, and what happens when any of those rules get broken.

That decision work isn't a technology problem. It's a leadership problem. It belongs to the people who understand the business's risk tolerance, its regulatory exposure, its client commitments, and its appetite for trade-offs between speed and control. The audience for a readiness conversation is the C-suite and the data security lead — not the IT admin who will eventually implement the decisions.

That's also why we start every engagement with a questionnaire rather than a workshop. Twenty minutes of structured questions, completed by the business before we meet, gives us both the shape of the gaps and a clean agenda for the working session that follows. Without the questionnaire, we end up in a room waiting for someone to email the IT team and ask whether DLP is turned on. With it, we spend the session on the hard part — turning business intent into policy language that holds up.

A readiness engagement is deliberately compact. We've watched too many businesses commit to twelve-month AI programs that never produce a Copilot license. The point of this work is to get the posture right quickly, then let the business move — not to keep ourselves in the room.

The arc is four steps, and they happen in order for a reason.

One — the readiness questionnaire. Short. Completed async, by the business, before we meet. Twenty minutes of questions that surface where the organization's data lives, who can see it, how long it's kept, and which parts of that are known versus assumed.

Two — the working session. Half day or full day, depending on scope. We start with a tabletop — four realistic scenarios that make the risk visible in the room instead of hypothetical in a briefing. We move from there to the policy work: translating the business's intent into defensible language for classification, retention, access, and acceptable use. The output is policy language the business will actually enforce.

Three — the remediation roadmap. Based on the gaps the questionnaire and tabletop surfaced, a prioritized plan for closing them before any AI tooling is enabled. Quick wins up front, longer work sequenced behind. Realistic dates, not aspirational ones.

Four — phased rollout. With the posture in place, the AI deployment itself is almost anticlimactic. Start with a low-risk group, measure what actually gets used, expand from there. The governance work done in steps one through three is what makes step four uneventful — which is exactly what you want.

Every readiness engagement produces a stack of tangible things. A classification taxonomy written in the business's own language. Retention and DLP policies that reflect actual risk tolerance instead of vendor defaults. A remediation roadmap with owners and dates. A tabletop result the executive team has actually been through. A phased Copilot rollout plan with clear criteria for expansion.

Those artifacts matter. But the deliverable the business actually hired us for is less visible. It's the shift in what you can say yes to, and how fast. Before the engagement, every AI conversation stalls on "we should probably figure out the governance first." After, governance is figured out — and the next AI capability that ships, whatever it is, can be evaluated on its own merits instead of as a governance project wearing a feature costume.

That's the real deliverable. The confidence to leverage AI without inheriting the risks that come with it. A posture that doesn't have to be rebuilt every time Microsoft ships something new. The permission, finally, to move.