What is an AI governance framework?

An AI governance framework is a simple structure that helps an organisation use AI safely. It sets out who owns what, the basic rules to follow and how to prove things are working. A good framework is short and practical rather than a long checklist. It also gives you a path to improve over time, starting with the basics and building up. The Tenzing Agent Governance Framework is designed for organisations using Microsoft tools and fits alongside your existing security and risk work.

Why is AI governance important?

AI is already being used in most organisations, often in ways nobody has fully mapped. Without governance, sensitive information can end up in the wrong place and nobody can explain later how a decision was made. Governance helps you avoid those surprises. It also makes it easier to say yes to new AI ideas because the safety net is already there. In short, it protects the business and helps it move faster at the same time.

Who governs AI in an organisation?

AI governance is usually a team effort. Security, IT, Legal, Risk and the people running AI projects all have a part to play. The important thing is to have one named person who pulls it together so it does not fall between the cracks. In most organisations that is the head of security or a senior IT leader, working with a small group that meets regularly. Without a clear owner, AI governance tends to become nobody's job.

What is Microsoft AI governance?

Microsoft AI governance is how you keep AI use safe across the Microsoft tools your organisation already runs. It covers Microsoft 365 Copilot, Copilot Studio agents, Power Platform and Azure AI Foundry. The idea is the same as general AI governance: clear ownership, simple rules and evidence that things are working. The difference is that the controls are applied to the Microsoft platform you already pay for.

How do you govern AI agents?

Start by knowing what you have. Every AI agent should have a named owner and a clear purpose, and someone should check it before it goes live. Then think about the basics. Only trained people should be building them. Agents should only reach the information they really need. And you should be able to switch one off quickly if something goes wrong. Over time you can add more formal reviews and monitoring. Our Agent Governance Framework sets out how to build this up step by step.

Shadow AI is when people at work use AI tools that IT and security do not know about. It usually starts innocently. Someone pastes company information into a free chatbot to speed up a task or builds a small AI helper using tools they already have. The problem is not the person. It is that nobody is checking what data is going where. That is how sensitive information ends up in places it should not. Our article on managing shadow AI with Microsoft tools shows how to bring it into the open.

What is shadow AI usage?

Shadow AI usage is any AI activity happening outside the tools your organisation has officially approved. That could be someone using a personal chatbot account for work or a colleague building a small AI helper that nobody in IT has seen. It usually means people are keen and just want to get things done. The answer is not to ban the tools. It is to give people a safe, approved way to use AI so they do not have to go around the rules to be productive.

How do you govern Copilot Studio agents?

Treat Copilot Studio agents like any other important system. Each agent should have a named owner, a clear purpose and a record of what data it can reach. Before an agent goes live, someone should review who can use it and what it can do. After launch, keep it on a list so you can monitor it and switch it off quickly if needed. Our Agent Governance Framework sets out the specific controls for Microsoft environments.

What is Copilot governance?

Copilot governance is the set of rules, ownership and controls that keep Microsoft 365 Copilot safe and useful. It covers who can use Copilot, what data it can access, how prompts and responses are handled, and who is accountable when something goes wrong. Good governance means the business can use Copilot with confidence while security and risk stay comfortable.

Is Microsoft Copilot secure for business?

Yes. Microsoft 365 Copilot uses the same security controls as the rest of Microsoft 365. It only shows each person the information they already have permission to see. The real question is whether your Microsoft 365 environment is tidy underneath. If old files are shared too widely or permissions have drifted over the years, Copilot will find that content quickly. So the security work is less about Copilot itself and more about the housekeeping around it. Our Copilot Readiness Assessment checks exactly that.

What is Copilot oversharing?

Copilot oversharing happens when Copilot finds and surfaces files that people did not realise were widely accessible. Copilot respects the permissions already in Microsoft 365. If a sensitive file has been over-shared, Copilot can find it just as a search engine or curious colleague could. The fix is not to blame Copilot. It is to tidy up permissions and sensitivity labels so files are only visible to the right people.

How do sensitivity labels protect Copilot?

Sensitivity labels tell Copilot how to handle different types of content. A file marked as confidential can be encrypted, watermarked or blocked from certain actions. When labels are applied consistently, Copilot sees the same boundaries as everyone else. It will not share a confidential file with someone who should not see it, provided the label and permissions are set correctly. Labels are one part of the picture; permissions and access reviews matter too.

How secure is Microsoft 365 Copilot?

Copilot uses the same protections as the rest of Microsoft 365, including strong encryption and strict data boundaries. Your prompts and answers stay inside your organisation and are not used to train the wider AI models. The biggest risk is not Copilot itself. It is what is already sitting in your Microsoft 365 files. If access has drifted or sensitive documents are shared too widely, Copilot will find them fast. Getting those basics right is what makes Copilot safe to roll out.

How do you get ready for Microsoft 365 Copilot?

Getting ready for Copilot comes down to three things. First, tidy up your data so sensitive files are not shared more widely than they should be. Second, make sure logins and access rights are up to date, especially for admins and guests. Third, agree the simple rules for how people should use AI at work and who signs off new AI tools. Most organisations stumble on the first two. Our Copilot Readiness Assessment gives you a clear score and a plan to close the gaps.

What is AI risk management?

AI risk management is simply how you spot and deal with the things that could go wrong when using AI. Some of those risks are technical, like sensitive data leaking or an AI tool doing something it should not. Others are more everyday, like nobody being sure who is in charge or not being able to explain a decision later. The good news is you do not need a separate process. AI risks can sit alongside your existing risk reviews so they get the same attention as anything else.

What is the NIST AI Risk Management Framework?

The NIST AI Risk Management Framework is a well-known guide from the US National Institute of Standards and Technology. It helps organisations think about AI risk in four simple steps: govern it, map it, measure it and manage it. It is a good starting point because it works with any technology. What it does not do is tell you how to apply it to a specific platform like Microsoft 365. That is where our Agent Governance Framework helps by turning those ideas into practical steps.

How does AI change cyber security?

AI changes both sides of cyber security. Attackers use it to make phishing emails more convincing and to move faster than before. Defenders use it to spot and respond to threats sooner. On top of that, AI brings new things to protect inside your own business, such as chatbots and AI agents that need the same care as any other important system. You do not need to rebuild your security team from scratch. You just need to widen what they look after to include AI.

When implementing responsible AI governance, what should organisations prioritise?

Focus on three things first. One, make sure someone is clearly in charge of AI so it is not left to chance. Two, put a few basic guardrails in place so AI tools cannot reach information they should not or run without oversight. Three, keep a simple record of what you are doing and why, so you can answer questions from auditors or the board with confidence. Get those right and the more advanced parts of governance become much easier to add later.

How does Purview help with AI governance?

Microsoft Purview gives you visibility and control over the data AI tools can access. It helps you discover sensitive data, apply sensitivity labels automatically, enforce retention policies and monitor risky activity. For AI governance, Purview answers questions like: where is our sensitive data, who can access it, and is it being used in ways we did not expect? It turns good intentions into evidence.

What is Microsoft Purview for AI?

Microsoft Purview for AI is the use of Purview's data security and compliance tools to protect AI workloads. It includes sensitivity labels, data loss prevention, insider risk management and eDiscovery. In plain terms, it helps you find sensitive data, label it correctly, stop it leaking into AI tools and prove you are in control.

Do sensitivity labels stop Copilot from seeing sensitive data?

Yes, when they are applied correctly. A sensitivity label marks a file as confidential, internal or public. Copilot respects those labels along with the underlying permissions. If someone does not have permission to open a file, Copilot will not show it to them. The catch is that labels only work if they are accurate and up to date. Many organisations have labels in place but have not applied them consistently across old files.

How do you prevent AI tools from oversharing files?

Three things. First, find the sensitive data you already have and label it. Second, review who can access it and remove permissions that are no longer needed. Third, keep checking regularly because permissions drift over time. Copilot and other AI tools will only surface what people already have access to. Get the access right and the oversharing problem largely disappears.

What is an AI governance framework?

An AI governance framework is a simple structure that helps an organisation use AI safely. It sets out who owns what, the basic rules to follow and how to prove things are working. A good framework is short and practical rather than a long checklist. It also gives you a path to improve over time, starting with the basics and building up. The Tenzing Agent Governance Framework is designed for organisations using Microsoft tools and fits alongside your existing security and risk work.

Why is AI governance important?

AI is already being used in most organisations, often in ways nobody has fully mapped. Without governance, sensitive information can end up in the wrong place and nobody can explain later how a decision was made. Governance helps you avoid those surprises. It also makes it easier to say yes to new AI ideas because the safety net is already there. In short, it protects the business and helps it move faster at the same time.

Who governs AI in an organisation?

AI governance is usually a team effort. Security, IT, Legal, Risk and the people running AI projects all have a part to play. The important thing is to have one named person who pulls it together so it does not fall between the cracks. In most organisations that is the head of security or a senior IT leader, working with a small group that meets regularly. Without a clear owner, AI governance tends to become nobody's job.

What is Microsoft AI governance?

Microsoft AI governance is how you keep AI use safe across the Microsoft tools your organisation already runs. It covers Microsoft 365 Copilot, Copilot Studio agents, Power Platform and Azure AI Foundry. The idea is the same as general AI governance: clear ownership, simple rules and evidence that things are working. The difference is that the controls are applied to the Microsoft platform you already pay for.

How do you govern AI agents?

Start by knowing what you have. Every AI agent should have a named owner and a clear purpose, and someone should check it before it goes live. Then think about the basics. Only trained people should be building them. Agents should only reach the information they really need. And you should be able to switch one off quickly if something goes wrong. Over time you can add more formal reviews and monitoring. Our Agent Governance Framework sets out how to build this up step by step.

Shadow AI is when people at work use AI tools that IT and security do not know about. It usually starts innocently. Someone pastes company information into a free chatbot to speed up a task or builds a small AI helper using tools they already have. The problem is not the person. It is that nobody is checking what data is going where. That is how sensitive information ends up in places it should not. Our article on managing shadow AI with Microsoft tools shows how to bring it into the open.

What is shadow AI usage?

Shadow AI usage is any AI activity happening outside the tools your organisation has officially approved. That could be someone using a personal chatbot account for work or a colleague building a small AI helper that nobody in IT has seen. It usually means people are keen and just want to get things done. The answer is not to ban the tools. It is to give people a safe, approved way to use AI so they do not have to go around the rules to be productive.

How do you govern Copilot Studio agents?

Treat Copilot Studio agents like any other important system. Each agent should have a named owner, a clear purpose and a record of what data it can reach. Before an agent goes live, someone should review who can use it and what it can do. After launch, keep it on a list so you can monitor it and switch it off quickly if needed. Our Agent Governance Framework sets out the specific controls for Microsoft environments.

What is Copilot governance?

Copilot governance is the set of rules, ownership and controls that keep Microsoft 365 Copilot safe and useful. It covers who can use Copilot, what data it can access, how prompts and responses are handled, and who is accountable when something goes wrong. Good governance means the business can use Copilot with confidence while security and risk stay comfortable.

Is Microsoft Copilot secure for business?

Yes. Microsoft 365 Copilot uses the same security controls as the rest of Microsoft 365. It only shows each person the information they already have permission to see. The real question is whether your Microsoft 365 environment is tidy underneath. If old files are shared too widely or permissions have drifted over the years, Copilot will find that content quickly. So the security work is less about Copilot itself and more about the housekeeping around it. Our Copilot Readiness Assessment checks exactly that.

What is Copilot oversharing?

Copilot oversharing happens when Copilot finds and surfaces files that people did not realise were widely accessible. Copilot respects the permissions already in Microsoft 365. If a sensitive file has been over-shared, Copilot can find it just as a search engine or curious colleague could. The fix is not to blame Copilot. It is to tidy up permissions and sensitivity labels so files are only visible to the right people.

How do sensitivity labels protect Copilot?

Sensitivity labels tell Copilot how to handle different types of content. A file marked as confidential can be encrypted, watermarked or blocked from certain actions. When labels are applied consistently, Copilot sees the same boundaries as everyone else. It will not share a confidential file with someone who should not see it, provided the label and permissions are set correctly. Labels are one part of the picture; permissions and access reviews matter too.

How secure is Microsoft 365 Copilot?

Copilot uses the same protections as the rest of Microsoft 365, including strong encryption and strict data boundaries. Your prompts and answers stay inside your organisation and are not used to train the wider AI models. The biggest risk is not Copilot itself. It is what is already sitting in your Microsoft 365 files. If access has drifted or sensitive documents are shared too widely, Copilot will find them fast. Getting those basics right is what makes Copilot safe to roll out.

How do you get ready for Microsoft 365 Copilot?

Getting ready for Copilot comes down to three things. First, tidy up your data so sensitive files are not shared more widely than they should be. Second, make sure logins and access rights are up to date, especially for admins and guests. Third, agree the simple rules for how people should use AI at work and who signs off new AI tools. Most organisations stumble on the first two. Our Copilot Readiness Assessment gives you a clear score and a plan to close the gaps.

What is AI risk management?

AI risk management is simply how you spot and deal with the things that could go wrong when using AI. Some of those risks are technical, like sensitive data leaking or an AI tool doing something it should not. Others are more everyday, like nobody being sure who is in charge or not being able to explain a decision later. The good news is you do not need a separate process. AI risks can sit alongside your existing risk reviews so they get the same attention as anything else.

What is the NIST AI Risk Management Framework?

The NIST AI Risk Management Framework is a well-known guide from the US National Institute of Standards and Technology. It helps organisations think about AI risk in four simple steps: govern it, map it, measure it and manage it. It is a good starting point because it works with any technology. What it does not do is tell you how to apply it to a specific platform like Microsoft 365. That is where our Agent Governance Framework helps by turning those ideas into practical steps.

How does AI change cyber security?

AI changes both sides of cyber security. Attackers use it to make phishing emails more convincing and to move faster than before. Defenders use it to spot and respond to threats sooner. On top of that, AI brings new things to protect inside your own business, such as chatbots and AI agents that need the same care as any other important system. You do not need to rebuild your security team from scratch. You just need to widen what they look after to include AI.

When implementing responsible AI governance, what should organisations prioritise?

Focus on three things first. One, make sure someone is clearly in charge of AI so it is not left to chance. Two, put a few basic guardrails in place so AI tools cannot reach information they should not or run without oversight. Three, keep a simple record of what you are doing and why, so you can answer questions from auditors or the board with confidence. Get those right and the more advanced parts of governance become much easier to add later.

How does Purview help with AI governance?

Microsoft Purview gives you visibility and control over the data AI tools can access. It helps you discover sensitive data, apply sensitivity labels automatically, enforce retention policies and monitor risky activity. For AI governance, Purview answers questions like: where is our sensitive data, who can access it, and is it being used in ways we did not expect? It turns good intentions into evidence.

What is Microsoft Purview for AI?

Microsoft Purview for AI is the use of Purview's data security and compliance tools to protect AI workloads. It includes sensitivity labels, data loss prevention, insider risk management and eDiscovery. In plain terms, it helps you find sensitive data, label it correctly, stop it leaking into AI tools and prove you are in control.

Do sensitivity labels stop Copilot from seeing sensitive data?

Yes, when they are applied correctly. A sensitivity label marks a file as confidential, internal or public. Copilot respects those labels along with the underlying permissions. If someone does not have permission to open a file, Copilot will not show it to them. The catch is that labels only work if they are accurate and up to date. Many organisations have labels in place but have not applied them consistently across old files.

How do you prevent AI tools from oversharing files?

Three things. First, find the sensitive data you already have and label it. Second, review who can access it and remove permissions that are no longer needed. Third, keep checking regularly because permissions drift over time. Copilot and other AI tools will only surface what people already have access to. Get the access right and the oversharing problem largely disappears.

Insights & Resources

Q: What is AI governance?

AI governance is how an organisation keeps its use of AI safe and under control. It covers who is in charge, what the rules are and how you check things are working. Think of it as the guardrails around AI so people can use it with confidence. Responsible AI and AI ethics are the ideas behind it. Governance is how you put those ideas into practice day to day. For a full plain-English explainer, read our guide: What Is AI Governance?

Guide

What Is AI Governance?

A practical guide for business leaders. What AI governance is, why it matters and how organisations build the confidence to adopt AI safely, securely and successfully.

July 20, 2026

Guide

Six Findings from Six Months of Copilot Readiness Assessments

Six months of Microsoft Copilot readiness assessments across dozens of organisations reveals six patterns that show up almost every time. Data protection gaps, unclear AI accountability, policies without enforcement and the emerging challenge of agent governance are shaping how enterprises should approach Copilot adoption.

July 10, 2026

Guide

Microsoft Copilot Governance: A Practical Guide

A practical guide to Microsoft Copilot governance, covering strategy, data, security, adoption and monitoring, and the Microsoft controls that give organisations the confidence to deploy Copilot safely.

June 17, 2026

Guide

Copilot Oversharing: How It Happens and How to Prevent It

Learn what Copilot oversharing is, why it happens, and how organisations can prevent sensitive information being surfaced through Microsoft Copilot.

May 13, 2026

Guide

Purview for AI: What It Does and How to Use It

How Microsoft Purview supports AI governance, Copilot security, data protection and compliance, and how organisations can use it to adopt AI with confidence.

April 15, 2026

Guide

Getting Shadow AI under control

Shadow AI is now one of the biggest operational risks facing organisations. Learn how to regain control of AI usage without slowing innovation, using the Microsoft capabilities you already own.

March 3, 2026

Guide

How to Deploy Generative AI Securely: The Strategy for Confident Adoption

A practical leadership guide for secure, scalable AI adoption based on real-world best practice.

February 16, 2026

Guide

Quick Guide: How to Get Copilot for Microsoft 365 Ready with Governance Controls

Before enabling Copilot for Microsoft 365, organizations must secure sensitive data and implement governance controls. This guide shows how to use Purview DSPM for AI, SharePoint Advanced Management, and compliance policies to reduce risk and enable responsible AI.

January 12, 2026

Guide

How to Deploy Generative AI Securely: The 3 Critical Areas Every Organisation Must Assess

Ensuring you have these three facets sorted will ensure success and peace of mind

November 20, 2025

Guide

Aligning Copilot Deployment to Zero Trust Principles

A simple guide to demystify the risks and tactics to mitigate them when deploying Copilot for Microsoft 365.

September 13, 2025

Guide

A Practical Guide to AI Security: From Visibility to Data Protection

Learn how to assess AI usage, govern AI applications, and secure sensitive data with Microsoft Purview and Defender for Cloud Apps.

July 10, 2025

On-demand Webinar

Stop Silent AI Risk: See It and Control It with Microsoft Security

AI usage is growing across every organisation. Teams are using it to work faster and improve quality. As usage increases the risk increases. Many organisations are finding that sensitive data is already moving into AI systems they did not approve or monitor. Without visibility you cannot govern. **Without governance AI becomes a silent risk multiplier.** We are seeing Shadow AI tools, unmanaged plugins, unclear data paths and policies that no longer reflect how people work. Most organisations know they need to act. The starting point is not always clear. This session will show how to **gain visibility, reduce risk and build practical guardrails** using **Microsoft Security tools**. The guidance is based on what we see every week when helping Microsoft customers get control of AI usage in their own environments. **Spaces are limited. This session includes complimentary 1:1 DSPM for AI setup guidance so each organisation receives individual guidance. Early registration is recommended.** We will cover: • Real **state of AI usage and risk** in 2026 • **Risk patterns we commonly uncover** in organisations • Microsoft tools that **provide immediate visibility and control** • **Practical steps to enable secure AI** in your organisation In order to provide actionable and tangible outcomes for attendees, **every organisation that attends will receive complimentary 1:1 DSPM for AI setup guidance.** This includes guided configuration steps and a follow up review of your findings so you know what actions to prioritise. *Please note: Configuration remains in your environment and under your control. Tenzing will provide the guidance.*

Watch →

On-demand Webinar

Shadow AI is here: How to regain control and enable AI securely

Shadow AI is now present in almost every organisation, and most leadership teams underestimate the scale of it. Staff are already using unsanctioned AI tools to draft content, process sensitive information, and accelerate daily work. The result is growing exposure to data loss, confidentiality breaches, and regulatory scrutiny, even in firms that believe they have strong controls in place. Blocking AI entirely is not a solution. It pushes staff further toward unapproved tools and increases risk. The real opportunity is to provide clear guardrails, safe alternatives, visibility of usage, and practical governance that keeps people productive. This session will give you a clear understanding of the risks of inaction, what good AI governance looks like in practice, and a simple, actionable approach to get control of Shadow AI in your organisation. Attendees will walk away with a practical checklist they can apply immediately, along with resources to benchmark their current readiness. Agenda: • The Reality of Shadow AI and what it means for your business • How to regain control and keep your business moving fast • The essential checklist to reduce risk & enable secure AI transformation • Resources to support your next steps • Q&A with our experts

Watch →

Common Questions

What people ask us most

Straight answers to the questions security and AI leaders search for most often.

AI governance basics

Governing AI agents and shadow AI

Microsoft Copilot security and readiness

Frameworks and risk

Purview and AI data protection

Assess your AI security maturity in 2 minutes

Take our quick self-assessment to understand where your organisation stands and get a personalised roadmap.

Start Assessment

Insights & Resources

What people ask us most

What is AI governance?

What is an AI governance framework?

Why is AI governance important?

Who governs AI in an organisation?

What is Microsoft AI governance?

How do you govern AI agents?

What is shadow AI?

What is shadow AI usage?

How do you govern Copilot Studio agents?

What is Copilot governance?

Is Microsoft Copilot secure for business?

What is Copilot oversharing?

How do sensitivity labels protect Copilot?

How secure is Microsoft 365 Copilot?

How do you get ready for Microsoft 365 Copilot?

What is AI risk management?

What is the NIST AI Risk Management Framework?

How does AI change cyber security?

When implementing responsible AI governance, what should organisations prioritise?

How does Purview help with AI governance?

What is Microsoft Purview for AI?

Do sensitivity labels stop Copilot from seeing sensitive data?

How do you prevent AI tools from oversharing files?

Assess your AI security maturity in 2 minutes