Blog

Is your business ready for winter?

Wed, 07 Oct 2026 00:00:00 +0000

It is now the last quarter of 2026 which means that winter is rapidly approaching and with the arrival of winter, it sometimes brings extra challenges that we are not always expecting.

Winter disruption rarely arrives as a single, manageable problem. Severe weather can close roads, delay deliveries and prevent staff from reaching the workplace. A local power cut may take systems offline, while a broadband outage can stop a cloud-dependent team in its tracks. If fuel becomes scarce or expensive at the same time, even routine operations can quickly become difficult.

El Niño may add further uncertainty this winter, particularly through indirect effects on global food, energy and supply chains. However, its precise influence on UK weather is difficult to predict, and current national forecasts indicate that Great Britain should have sufficient electricity supply. The sensible response is not panic; it is proportionate preparation for the local outages, transport problems and supplier failures that can happen in any difficult winter.

Your winter business-readiness checklist

1. Power and premises

What would you do if the power went down for several hours—or several days?
Identify the systems that must remain available and how long their battery backup will last.
Check whether uninterruptible power supplies are maintained and sized for essential equipment.
Decide which services should be shut down safely during an extended outage.
Confirm how staff will enter, secure or leave the building if alarms, access controls, lifts or lighting fail.
Keep torches, charged power banks and printed emergency contacts available.

2. Internet, phones and access to systems

What would you do if severe weather took down your internet connection?
Arrange a secondary connection, such as a different broadband provider or managed mobile failover.
Test whether employees can work securely from another location or through mobile data.
Make sure key phone numbers can be diverted and that customers can still reach you.
Identify essential files or procedures that need secure offline access.
Check that multi-factor authentication will still work if a staff member loses access to their usual device or mobile signal.

3. People and communications

Set clear rules for office closure, remote working and travel during warnings or dangerous conditions.
Maintain an up-to-date contact list and agree how urgent messages will be sent if email is unavailable.
Identify deputies for essential roles and avoid relying on one person for critical knowledge or approvals.
Consider the needs of staff with caring responsibilities, disabilities or long journeys.
Run a short exercise so everyone knows where to find the continuity plan and who makes decisions.

4. Suppliers, stock and deliveries

What would you do if weather disrupted your supply chain?
Map the suppliers, couriers and components that your most important services depend upon.
Ask critical suppliers about their own continuity plans and expected lead times.
Qualify alternatives in advance rather than searching during a crisis.
Review minimum stock levels for essential items, while avoiding unnecessary over-ordering.
Agree how you will prioritise customers if stock, transport or staff capacity becomes limited.

5. Fuel, travel and logistics

Identify which journeys and deliveries are genuinely business-critical.
Plan for fuel shortages, poor road conditions and public transport disruption.
Allow key employees to work remotely where practical and safe.
Make agreements with alternative couriers or local partners before demand peaks.
Keep vehicles maintained and ensure drivers have clear escalation procedures.

6. Data, cyber security and recovery

Confirm that backups are automatic, protected and kept separately from live systems.
Test restoring a file or system; a backup is only useful if recovery works.
Keep devices patched and protected, including laptops used away from the office.
Warn staff that criminals may exploit disruption with fake delivery, payment or emergency-support messages.
Document how to report a cyber incident when normal channels are unavailable.

7. Customers, cash flow and insurance

Prepare website, social media and voicemail messages for closures or delays.
Decide what service levels you can realistically maintain and communicate changes early.
Review cash reserves and the effect of delayed sales, deliveries or customer payments.
Check business interruption, equipment and premises insurance, including exclusions and notification requirements.
Store policy details and claims contacts somewhere accessible during an outage.

Turn the checklist into a plan

Assign an owner to each action, set a completion date and record the workaround in plain language. Then test the plan with a simple scenario: the office has no power, the internet is unavailable and a key supplier cannot deliver for 48 hours. The exercise will quickly reveal hidden dependencies and outdated contact details.

What does this mean for your business?

Every organisation has different risks, but every organisation benefits from knowing how it will keep communicating, protect its data and continue serving customers when normal arrangements fail. The Silver Cloud Business can help you review your IT resilience, cloud services, communications, remote-working arrangements, backups and disaster-recovery plans—then turn any gaps into practical improvements.

Do not wait for disruption to test your plan. Call The Silver Cloud Business on 01722 411999 to discuss how prepared your business is for winter.

How to Protect Your Business from AI-Powered Cyberattacks

Tue, 29 Sep 2026 00:00:00 +0000

A practical guide for business owners who want stronger security without creating unnecessary complexity

Artificial intelligence has not invented cybercrime, but it is making familiar attacks faster, cheaper and more convincing. Criminals can use AI to personalise phishing messages, imitate a trusted person’s voice or image, scan systems for weaknesses and automate large numbers of attacks. At the same time, businesses can expose themselves by adopting AI tools without controlling what data they receive or what systems they can access.

There are further examples of AI breaching systems, with the latest high profile incident being the Australian Government Website being hacked by OpenAI who only notified the Australians three months after the security breach.

The answer is not to avoid AI. It is to combine sound cyber-security basics with a few controls designed for AI-era risks. The following steps will give most organisations a strong starting point.

Make identity harder to steal

Require multi-factor authentication on email, cloud services, banking, remote access and administrator accounts. Where available, prefer phishing-resistant options such as passkeys or security keys. Give each person only the access needed for their role, remove dormant accounts promptly and keep administrator accounts separate from everyday work.

Verify money and access requests out of band

A convincing email, phone call or video meeting is no longer proof of identity. Set a written rule that supplier bank-detail changes, urgent payments, password resets and requests for sensitive data must be checked through a second, trusted channel. Staff should call a known number from company records rather than one supplied in the message. Use dual approval for high-value or unusual transactions.

Update staff training for AI-enabled scams

Old advice that focuses on spelling mistakes is no longer enough. Train people to question unexpected urgency, secrecy, changes in payment instructions, unusual sign-in prompts and requests to bypass normal processes—even when a message looks polished. Run short, regular exercises covering email phishing, text messages, QR codes and voice or video impersonation. Make reporting easy and reward quick escalation rather than blaming honest mistakes.

Patch, back up and monitor

AI can help attackers find exposed systems more quickly, so prompt patching matters. Keep an inventory of devices, software and cloud services; enable automatic updates where appropriate; and prioritise internet-facing systems. Maintain encrypted backups that are separated from the main network, test restoration regularly and protect backup administration with strong authentication. Turn on logging and alerts for unusual sign-ins, large downloads, new forwarding rules and privilege changes.

Put guardrails around business AI tools

Keep a register of approved AI services and define what employees may enter into them. Do not paste customer records, contracts, credentials, source code or commercially sensitive information into an unapproved public tool. Review suppliers’ security, data-retention, training-data and incident-notification terms. Disable unnecessary plug-ins and integrations, restrict an AI assistant’s permissions, and require human approval before it can send messages, change records, run code or trigger payments.

Test AI systems as if their inputs may be hostile

If your business uses AI to read emails, websites, documents or customer submissions, assume that external content may contain malicious instructions. Test for prompt injection, unsafe tool use and leakage of confidential data. Separate trusted instructions from untrusted content, validate outputs before action, log important AI activity and provide a reliable way to stop or override automated behaviour. If you train or fine-tune models, control who can alter training data and monitor for unexpected changes in results.

Prepare for the incident before it happens

Create a short incident-response plan that names decision-makers, technical contacts, legal and communications support, insurers and reporting routes. Include steps for isolating affected accounts or devices, preserving evidence, contacting customers and restoring operations. Practise a scenario involving a deepfake payment request or a compromised AI assistant, then fix any gaps the exercise reveals.

A 30-day action plan

Week 1: List critical systems, data, suppliers and AI tools; name one person accountable for cyber risk.
Week 2: Enable strong multi-factor authentication, remove unused accounts and patch exposed systems.
Week 3: Introduce call-back checks and dual approval for sensitive changes; publish a simple AI-use policy.
Week 4: Test a backup restoration and run a short incident exercise with leadership, finance and IT.

What does this mean for your business?

There is no single product that can stop every AI-enabled attack. The strongest defence is layered: secure identities, disciplined approval processes, well-trained people, maintained technology, controlled AI use and a rehearsed response. Start with the highest-risk accounts and transactions, measure progress each month and treat cyber resilience as part of normal business management—not just an IT task.

If you would like for information call The Silver Cloud Business on 01722 411 999 and we can help you build an AI resilience plan.

References and further guidance

UK National Cyber Security Centre, “AI and cyber security: what you need to know”.
UK Government and National Cyber Security Centre, “Cyber security guidance for business”.
Information Commissioner’s Office, “Five steps to protect your organisation from AI-powered cyber threats”.
National Institute of Standards and Technology, “Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile”

Do you know where your business data is?

Wed, 23 Sep 2026 00:00:00 +0000

A lot of people are using AI these days; some people are even using it to help them with their work, but are staff using AI in your business with your knowledge or are they using it under the radar? As we covered in last week's article, a lot of AI models use data to train on, what if a member of staff is using your company data and it's inadvertently being used to train AI which in turn could aid your competitors or leak your business data?

I'm going to go down memory lane, bear with me; a few years ago, we took a frantic call from a business that had suffered a serious data leak. Not because of a hacker. Not because of ransomware. Not because someone inside the company was trying to do harm.

It happened because a well-meaning member of staff wanted to carry on working from home. To make that easier, they uploaded company data into their own free personal Dropbox account. The intention was helpful. The outcome was catastrophic.

The data was now outside the company’s control, outside any proper business agreement, and outside the terms intended for that domestic service. Worse still, it was not protected to the standard the business needed. The result was a major data loss, reputational damage, and a very painful lesson: convenience can be dangerous when it bypasses proper controls.

The same risk has a new name: AI

Fast forward to today and the same pattern is happening again. This time, the tool is not personal cloud storage. It is artificial intelligence.

Staff are using AI tools to write emails, analyse spreadsheets, summarise documents, create proposals, polish reports, draft HR content, troubleshoot technical issues and speed up everyday work. In many cases, they are doing it with good intentions. They want to be faster. They want to be more productive. They want to help the business.

But if they are pasting customer information, contracts, financial data, internal processes, technical details, passwords, source code, sales figures or strategy documents into tools the business has not approved, then your confidential information may already be leaving the building.

Helpful does not always mean safe

The danger is that many employees do not realise what happens after they type or upload information into an AI platform. Some tools may store prompts. Some may use submitted data to improve or train their models. Some may be operated outside the UK. Some may have terms that are suitable for personal experimentation, but not for handling sensitive business data.

The risk is not always malicious. In fact, that is what makes it so dangerous. Your team may believe they are doing the right thing, while accidentally exposing commercially sensitive information to a system the business has not assessed, secured or approved.

Imagine a member of staff asking a free AI tool to summarise a confidential client proposal. Or to rewrite a disciplinary letter. Or to analyse a spreadsheet containing customer records. Or to explain a technical configuration that reveals how your systems are built. In each case, the employee is not trying to leak data. But the data may still be exposed.

Shadow AI is the new shadow IT

For years, businesses have worried about shadow IT: staff signing up for apps, storage services or software without telling the company. AI has made that problem bigger, faster and harder to see. It takes seconds to open an AI tool in a browser. It takes seconds to paste in confidential information. And once that data has gone in, you may have no easy way to get it back.

That creates serious questions for business owners:

Do you know which AI tools your staff are using?
Do your staff know what information they must never enter into AI?
Have you checked the terms, privacy settings and data handling policies of those tools?
Do you have an AI usage policy that is actually understood by your team?
Can you prove that client, employee and business data is being handled properly?
Is your data being processed whilst maintaining GDPR compliance?
Is your business data being used to train the AI model which exposes it to the public domain?

If the answer is “no” or “I’m not sure”, then this is not a future problem. It is a current risk.

AI needs rules, not guesswork

AI can be incredibly useful. Used properly, it can improve productivity, reduce admin, speed up research and help teams work smarter. The answer is not necessarily to ban AI completely. A ban often drives the behaviour underground, where it becomes even harder to manage.

The better approach is to put proper controls in place. Decide which tools are approved. Set clear rules on what can and cannot be entered. Train staff using real-world examples. Review supplier terms. Configure business-grade services correctly. Monitor for risky behaviour. Make AI part of your cyber security and data protection strategy, not an uncontrolled side project.

Most importantly, make sure your people understand the issue. In the same way that uploading business data to a free personal storage account can create a serious data breach, pasting business data into the wrong AI tool can expose information you are legally, commercially and morally responsible for protecting.

Be careful, try not to be too helpful when using AI tools

Let me ask you a simple question. "Would you like to improve this tool to help others?" This sounds like an innocent question, and most people, by their very nature would think "yes, I want to help this tool improve for others" so they select yes, BUT what this question actually means is " we need your permission to use all the data you upload to train the AI model and it could expose your data to the world". If the question were worded as the latter explaining the data will be exposed to the world, then everyone would select no, this is why they are very careful with how they word the question. Be warned.

What does this mean for your business

If your staff are using AI without your knowledge, your business may already have a data protection problem waiting to surface. The good news is that this can be managed with the right policies, tools, training and technical controls. As your MSP, we can help you understand where AI is being used, identify the risks, put sensible guardrails in place and make sure your team can benefit from AI without putting your business data at risk.

At the very least you should have an AI usage policy for the business just so staff know the business stance on using AI.

If you need help, call us on 01722 411999.

Are You Using AI or is AI Using You

Wed, 16 Sep 2026 00:00:00 +0000

Be Careful What You Share with AI - How to Keep Your Business Data Safe

Artificial intelligence can be a powerful productivity tool, but careless use can create serious data protection and commercial risks.

AI tools are becoming part of everyday business life. They can help draft documents, summarise information, analyse data and speed up routine tasks. Used well, they can save time and improve decision-making. Used carelessly, however, they can expose confidential information, customer data, intellectual property and commercially sensitive material.

Many people do not realise that some AI services may use prompts, uploaded files, chat history or user feedback to improve their systems, depending on the provider’s terms and settings. That means information entered into an AI tool could leave the control of your organisation and create risks around confidentiality, data protection and regulatory compliance. The UK Information Commissioner’s Office states that organisations using AI must consider accountability, transparency, security and data minimisation when personal data is involved.

Why this matters

Business data is valuable. It may include client records, staff information, contracts, pricing, designs, financial forecasts, legal advice, tender submissions or incident reports. If this information is copied into an AI tool without proper safeguards, it could be retained by a third party, accessed outside your approved environment, or used in ways your organisation did not intend.

The risk is not only commercial. If personal data is involved, an accidental disclosure could place the business in breach of data protection obligations. Regulators expect organisations to understand what data they process, why they process it, who can access it and how it is protected. AI does not remove those responsibilities; it can make them more complex.

Common mistakes businesses make with AI

Pasting confidential emails, contracts or reports into public AI tools.
Uploading spreadsheets containing personal, financial or client information.
Assuming that every AI product has the same privacy and retention settings.
Allowing staff to use unapproved AI tools without guidance or training.
Failing to check whether AI-generated outputs contain inaccurate, biased or confidential information.
Using AI outputs in regulated decisions without human review and proper records.

Tips to keep your data safe

Do not enter sensitive information into public AI tools. Treat prompts like external disclosures unless you have checked the provider’s contractual terms, privacy settings and data retention policy.
Use approved business accounts only. Enterprise AI tools often provide stronger controls than free consumer versions, including administration, access management and data protection settings.
Classify your data before using AI. Decide what data is public, internal, confidential or highly restricted, and set clear rules on what can and cannot be used with AI systems.
Remove or mask personal and confidential details. Where possible, anonymise, pseudonymise or summarise information before asking an AI tool to process it.
Check supplier terms carefully. Understand whether your data may be retained, reviewed, used for model training, transferred internationally or shared with subcontractors.
Carry out a risk assessment. For higher-risk uses, especially where personal data is involved, consider a Data Protection Impact Assessment and document the safeguards you have put in place.
Train your staff. Make AI awareness part of your cyber security and data protection training so employees understand the practical risks.
Review AI outputs before use. AI can produce convincing but incorrect information, so human checking remains essential.
Create an AI use policy. Set out approved tools, permitted uses, prohibited data types, escalation points and review processes.

AI should support your business, not expose it

The answer is not to avoid AI altogether. The answer is to use it deliberately, safely and with the right controls. Businesses that put clear rules in place now will be better positioned to benefit from AI while protecting customers, staff, intellectual property and reputation.

If you are unsure whether your current AI use is safe, now is the time to review it. Speak to your IT, compliance or data protection adviser, check your contracts and make sure your team knows what information must never be placed into an AI system.

How does this affect my business

Every business using AI needs to understand what data is being entered, where that data goes, and whether the tool is suitable for the information being processed. A simple review of your AI use, staff guidance and supplier settings can reduce the risk of data leakage, protect your commercial position and help demonstrate that you are taking compliance seriously.

If you would like help reviewing how your business uses AI safely, contact us on 01722 411 999.

Bye bye Microsoft Publisher, it was nice knowing you

Thu, 03 Sep 2026 00:00:00 +0000

Microsoft Publisher is retiring in October 2026. Here is what your business needs to know—and what to do before your .pub files become difficult to access.

For decades, Microsoft Publisher has been the familiar choice for newsletters, leaflets, brochures, labels, business cards and other desktop-publishing jobs. It has been straightforward, flexible and included with many versions of Microsoft Office. But all good things must come to an end.

Microsoft has confirmed that Publisher will reach end of life in October 2026. Microsoft 365 subscribers can use Publisher until 1 October 2026, but will no longer be able to access the application after that date. Support for the perpetual version of Publisher ends on 13 October 2026, alongside Office LTSC 2021 and Office 2021. The safest business deadline is therefore 1 October 2026: complete your migration before then rather than relying on an unsupported installation.

After retirement, Microsoft 365 subscribers will not be able to open or edit Publisher files in Publisher. Your .pub files will not simply disappear, but keeping them without a supported way to use them creates a serious accessibility and continuity risk—particularly when an old price list, template, certificate or marketing item suddenly needs updating.

Why businesses should act now

Publisher files are often scattered across laptops, servers, archived user folders, OneDrive, SharePoint and Teams-connected document libraries. Some may be obvious; others may sit untouched for years until they are urgently needed. Waiting until the last minute makes it harder to identify an owner, choose the right destination format and check that the converted output still looks correct.

Publisher will no longer be included with Microsoft 365 after the retirement date.
Unsupported software will not receive the protection or technical support expected by a modern business.
Complex layouts, fonts and graphics may not convert perfectly without review.
Historic documents may need preserving, while working templates need an editable replacement.
A rushed migration can lead to missing files, broken layouts and lost business information.

How to prepare: a practical Publisher retirement checklist

Find every .pub file. Search PCs, file servers, network shares, OneDrive, SharePoint, Teams libraries, backups and archive locations.
Assign an owner. Record which person or department understands the purpose of each file.
Classify the content. Mark each publication as active, reusable, historic, duplicate, obsolete or subject to a retention requirement.
Choose the destination. Decide whether the file should become a PDF, Word document, PowerPoint presentation or a design rebuilt in another supported application.
Back up the originals. Preserve an untouched copy of important .pub files and any linked images, logos or fonts before conversion.
Convert in manageable batches. Start with business-critical and regularly updated material rather than attempting everything at once.
Check the result. Compare pages, text flow, fonts, images, hyperlinks, margins, print settings and accessibility with the original.
Test the new workflow. Confirm that the content owner can edit, save, share and print the replacement without Publisher.
Stop creating new Publisher files. Move new work to a supported platform now so the backlog does not continue to grow.
Set a completion date before 1 October 2026. Leave time for exceptions, redesign work and user training.

Which application should replace Publisher?

PDF—for finished documents that only need to be viewed, shared or printed

PDF is usually the best preservation format for completed publications because it maintains the visual appearance and is widely supported. It is not, however, a practical master format where text, prices, dates or images must continue to change.

Open the publication in Publisher.
Select File > Save As and choose a destination folder.
Select PDF as the file type and save it.
Open the PDF and compare it with the original, including every page.
Use an appropriate quality setting for online distribution, office printing or commercial print.

Microsoft Word—for text-led documents that need future editing

Word is well suited to notices, forms, letters, simple newsletters, labels and documents where written content matters more than free-form page design. Microsoft’s suggested editable route is to convert the Publisher file to PDF and then open that PDF in Word. Expect to tidy complex layouts and check graphics carefully.

Export the Publisher file as a PDF.
Open Microsoft Word.
Select File > Open and choose the PDF.
Accept the prompt that Word will convert the PDF into an editable document.
Review page breaks, columns, text boxes, images, fonts and spacing.
Save the result as a .docx file and test printing and sharing.

Microsoft PowerPoint—for posters, signs, flyers and visual layouts

PowerPoint provides flexible placement of text and images and can be a practical replacement for single-page or slide-like content. Rather than trusting an automatic conversion, rebuild a clean reusable template and validate its physical page size before printing.

Create a presentation with the required page orientation and dimensions.
Copy the approved wording and source images from the original publication.
Rebuild the layout using editable PowerPoint objects.
Add branding to the template or slide master where appropriate.
Export a PDF and run a test print before approving the replacement.

Microsoft Designer or a specialist publishing tool—for highly visual work

Modern design tools may suit social graphics, promotional artwork and quick branded content, while layout-critical catalogues, complex brochures and commercial-print projects may justify a specialist desktop-publishing application. Test representative files before committing, confirm licensing and data-handling requirements, and retain the original assets used to create each publication.

Do not confuse preservation with migration

A PDF may successfully preserve the appearance of an old brochure, but it does not automatically give you an easy-to-edit replacement for next year’s brochure. For every file, ask two questions: Do we only need to view this? and Will we need to edit or reuse it? The answer determines both the target format and the amount of rebuilding required.

What does this mean for my business?

Publisher’s retirement is not just a software change; it is a data-discovery and business-continuity project. If you do not know where your .pub files are stored, who owns them or which ones remain operationally important, now is the time to find out.

The Silver Cloud Business can help. We can search your data repositories—including suitable PCs, servers and Microsoft 365 storage—for Publisher files, help you understand what is there, prioritise business-critical content and plan a controlled move to a supported product before it is too late.

Call The Silver Cloud Business on 01722 411999 to discuss a Publisher discovery and migration review. We can help you turn an approaching deadline into a planned, documented transition—without leaving important business content stranded in an obsolete format.

Preparing Your Business for AI: An AI Readiness Guide

Wed, 02 Sep 2026 00:00:00 +0000

A practical approach to adopting AI securely, responsibly and successfully across your organisation

Artificial intelligence can help staff work faster, improve customer service and make better use of the information a business already holds. However, adopting AI for everyone is not simply a matter of buying licences and switching the technology on. AI can search, summarise and combine information at a speed and scale that exposes weaknesses in permissions, data governance and working practices that may previously have gone unnoticed.

A successful AI programme therefore starts with the business, its people and its data. The objective should be to create a controlled environment in which approved tools deliver measurable value without exposing confidential information, personal data, intellectual property or client records.

1. Establish leadership, ownership and acceptable use

Nominate a senior owner for AI and create a small steering group involving business leadership, IT, information security, data protection and representatives from the teams that will use AI. Define which outcomes matter, such as reducing administration, improving response times or helping staff find information, and agree how success will be measured.

Publish an AI acceptable-use policy covering approved services, permitted data, human review and prohibited activities.
Create a simple approval process for new AI tools, browser extensions, agents, connectors and integrations.
Define accountable owners for each use case and record its purpose, data sources, users, supplier and risk rating.
Set clear rules for customer-facing content, automated decisions and any use involving personal or sensitive information.

2. Discover and classify the information AI could access

Build an information map covering Microsoft 365, line-of-business systems, shared drives, cloud storage, email, collaboration platforms and archives. Identify where personal data, commercially sensitive material, HR records, financial information, credentials and client data are stored. Assign owners and retention requirements, remove redundant data and introduce sensitivity labels where appropriate.

Why this matters: an AI assistant may make information dramatically easier to find, but it does not correct an unsafe permissions model. Content that was technically accessible but difficult to discover can become available through a straightforward natural-language request.

3. Review permissions and reduce oversharing

Carry out a structured permissions audit before connecting AI to business data. Review SharePoint sites, Teams, OneDrive, shared mailboxes, network folders and business applications. Pay particular attention to organisation-wide access, “anyone” links, the “Everyone except external users” group, inherited or broken permissions, guest access, stale accounts and sites without an active owner.

Apply least privilege: staff should have access only to information required for their role.
Replace broad sharing links with named users or controlled groups.
Review privileged roles, service accounts and third-party application permissions.
Remove obsolete content and access left behind by former employees, suppliers or completed projects.
Introduce recurring access reviews rather than treating remediation as a one-off exercise.

4. Assess every AI supplier and service

Do not assume that a free or inexpensive AI service is suitable for business use. The commercial model may depend on retaining prompts, uploaded files or conversation history and using them to improve services or train models.

Even where an opt-out exists, it may depend on the account type, settings or contract. Staff accepting consumer terms on behalf of themselves can unintentionally disclose company or client information outside approved controls.

For each supplier, establish in writing:

Whether prompts, outputs and uploaded data are used for model training or service improvement.
Where data is processed and stored, how long it is retained and how it can be deleted or exported.
Whether administrators can control accounts, sharing, connectors, agents and audit logs.
Which subprocessors are involved and what contractual, privacy and security assurances apply.
How the service handles encryption, incident notification, business continuity and account termination.
Whether the intended use requires a data protection impact assessment, contractual review or client approval.

5. Find and control shadow AI

Shadow AI occurs when employees adopt AI tools, agents, meeting assistants, browser extensions or personal accounts without the knowledge or approval of the business. This may already be happening before a formal AI project begins.

Risks include uncontrolled data transfer, excessive application permissions, poor authentication, unrecorded automated actions, intellectual-property leakage and suppliers that cannot meet the organisation’s legal or contractual obligations.

Survey staff in a constructive, non-punitive way to understand what they use and why.
Review sign-ins, enterprise applications, OAuth consent, browser extensions, network or cloud-security logs and expense claims.
Maintain an approved AI catalogue and give staff a quick route for requesting alternatives.
Block or restrict high-risk services where proportionate, while explaining the approved options.
Revoke unknown integrations and investigate any exposure of confidential or personal information.

6. Put technical guardrails around approved AI

Use business-grade services under centrally managed accounts. Enforce multi-factor authentication, conditional access, least-privilege administration and controlled app consent. Apply data loss prevention, sensitivity labels, retention controls, audit logging and alerting. Limit agents and connectors to approved systems, credentials and scopes; test what information they can retrieve and what actions they can take.

Treat an autonomous or semi-autonomous agent as a privileged digital worker. Give it a named owner, a defined purpose, the minimum data and permissions required, spending or transaction limits where relevant, complete logging, and a reliable method to stop or revoke it.

7. Start with controlled, valuable use cases

Select a small pilot group and begin with repeatable tasks that have clear value and manageable risk: drafting routine communications, summarising approved documents, finding internal procedures or assisting with meeting notes. Establish a baseline, define expected benefits and monitor quality, time saved, adoption, support demand and incidents.

Require human verification of outputs. AI can produce inaccurate, incomplete or fabricated answers, and plausible wording should never be mistaken for evidence. High-impact decisions, legal or financial advice, customer commitments, security changes and publication of sensitive material should remain subject to competent human approval.

8. Train staff and create safe working habits

Training should cover more than prompting. Staff need to understand information classification, approved tools, privacy, copyright and intellectual property, hallucinations, bias, social engineering, secure sharing and how to report a mistake. Use role-based examples and provide reusable prompt patterns that avoid unnecessary personal or confidential data.

9. Prepare for incidents and ongoing assurance

Update incident-response procedures to include accidental prompt disclosure, unsafe output, compromised AI accounts, malicious integrations, agent misbehaviour and supplier incidents. Staff should know whom to contact and should preserve the relevant prompt, output, tool, account and time without redistributing sensitive content.

Review the AI register, permissions, suppliers, logs, policies, training needs and business benefits regularly. Terms, features and risks change quickly, so approval should never be permanent by default.

What does this mean for your business

AI readiness is not about preventing innovation. It is about making sure the organisation understands its information, chooses trustworthy services and gives staff a safe, productive route to use them. Before deploying AI to all staff, your business should consider the following steps:

Appoint an AI owner and agree the outcomes you want to achieve.
Discover and classify the data your organisation holds.
Audit file, folder, site, mailbox and application permissions.
Identify any AI services, agents or extensions already being used.
Create an approved-tools list and an AI acceptable-use policy.
Review supplier terms, privacy, training, retention and data-location commitments.
Implement identity, data-protection, logging and application-control guardrails.
Pilot a small number of low-risk, high-value use cases.
Train staff to use AI safely and verify its outputs.
Measure value, review risk and improve controls continuously.

The Silver Cloud Business can help. Our AI Readiness service can assess your Microsoft 365 and / or server environment, review permissions and data exposure, help to identify shadow AI, evaluate proposed platforms, develop practical policies and create a phased roadmap for secure adoption.

Call us on 01722 411 999 to discuss an AI Readiness Assessment and make sure your organisation is ready to gain the benefits of AI without exposing the data it depends on.