AI readiness for small practices
Secure AI & Copilot Readiness Assessment
Get time back without putting client data at risk. Secure AI built safely inside your own Microsoft 365.
A written review of what AI could reach in your Microsoft 365, whether Copilot is ready to switch on, and the first projects worth doing.
The problem: you know AI should be saving time, but you’re not sure where to start, or whether it’s safe
- Staff are already pasting client information into AI tools nobody has vetted.
- Copilot would show people files they were never meant to see.
- You have watched demos, but nobody has shown you the hours it saves your practice.
Only 37% of small firms in PA, NJ and DE use AI, against 46% nationally (Philadelphia Fed, Sep 2026). Getting started safely is the hard part, and permissions are where it starts.
What's included
Security comes first, because Copilot only shows people what they can already open. Then we look at where your staff’s hours go.
- A scan of your Microsoft 365 for data exposure: SharePoint, OneDrive and Teams oversharing, guest access, sensitivity labels and DLP, Conditional Access, MFA and audit logging.
- A Copilot licensing go or no-go, so you know whether to buy before you buy.
- An inventory of the AI tools your staff already use, and the gaps in your AI policy.
- A walk through how your work flows from first call to final invoice, to find where staff time goes.
- A ranking of your top automation opportunities by value.
Deliverable
You receive a written report. It contains:
- A risk score for your Microsoft 365 as AI would see it.
- A remediation plan, in the order the fixes should be done.
- Your automation opportunities, ranked.
- A first-project proposal, so you can decide what to build next with the evidence in hand.
Built for regulated small practices
The references below are context for a conversation, not legal advice. Confirm your obligations with your own counsel or compliance lead.
CPA and tax practices
Get tax season’s re-keying off your admins’ desks, without client data going anywhere it shouldn’t.
The IRS expects tax and accounting professionals to keep a Written Information Security Plan (IRS Publication 5708). AI use belongs in that plan.
Law firms
Use AI in the practice without risking privilege or a hallucinated citation.
The PA Bar and Philadelphia Bar’s Joint Formal Opinion 2024-200 stresses confidentiality and verifying AI output. Governance comes first.
Insurance agencies
Answer quote requests and renewals faster, in the systems you already use.
GLBA-style customer data duties apply, and Pennsylvania’s insurer AI guidance (Notice 2024-04) shapes what carriers will ask agencies about.
Healthcare-adjacent practices
Fewer phone tags and no-shows, with HIPAA safeguards designed in from the start.
We sign a BAA. PHI stays in your Microsoft 365 tenant or your own BAA-covered AI account, never in consumer plans.
Pricing
Pricing is fixed and agreed before any work starts. We'll walk through it on the consultation.
FAQ
We already have an MSP.
Good, and I’m not here to replace them. Your MSP keeps the lights on: devices, patches, backups. This sits on top of that: finding the work AI can take off your staff and building it safely. I’m happy to work with them. They keep their contract, and I hand them clean documentation of anything I build.
Isn’t AI unsafe?
Most of the risk is real, but it usually isn’t the AI itself. It’s what the AI can reach and where staff are already pasting things. Microsoft says Microsoft 365 Copilot only surfaces data a user already has at least view permission to (Microsoft Learn), so if your folders are wide open, Copilot makes that visible. That’s why the assessment starts with a security scan of your Microsoft 365 and an inventory of the AI tools people already use.
Can’t we just use ChatGPT?
Lots of practices do, and it’s useful for drafting. Two questions matter: which accounts are staff using, and what’s going into them? Personal accounts are the shadow-AI problem. And a chat window doesn’t change a process: someone still re-keys, copies and chases. More than 70% of regional AI adopters saw no change in costs or sales (Philadelphia Fed, Sep 2026). The tool alone rarely moves the number.
Isn’t Copilot enough?
It might be, and if it is, I’ll tell you. Copilot is good inside documents and email. It doesn’t run a multi-step process on its own, like reading an intake form, updating your system and chasing the missing items. And it’s only as safe as your permissions. Part of the assessment is a straight Copilot go or no-go: how many licences, which oversharing to fix first, and which tasks it will actually help with.
Can you guarantee results?
I can’t guarantee a number, and you should be wary of anyone who does. What I commit to is the method: we write down today’s baseline before I build, the scope is delivered at a fixed price, and afterwards we measure and you see the result, good or bad.
Start with what AI can reach today
Book time and we will look at your Microsoft 365 together: permissions first, then where the hours are.