AI tools are only as good as the information they work from, and only as safe as the access they are given. That is the heart of AI data readiness: making sure the files, folders and permissions an AI tool can reach are current, organized and limited to the right people. Get that right, and AI gives your team faster, more reliable answers. Skip it, and even a good tool can give wrong answers or show someone a file they were never supposed to see.
The AI Strategy Blueprint by John Byron Hanby IV makes a point every business owner should hear: when AI gives a confident wrong answer, the cause is often the data, not the model. Here is a practical checklist for getting your business data ready for AI, written for small and midsize businesses rather than large IT departments.
Why your data matters more than the tool
Most business documents were written for people. A person reading an old price list knows it’s out of date. A person who finds three versions of the same policy knows to ask which one is current. AI tools don’t have that judgment. They work with what they can find, and when the information is incomplete or conflicting, they can fill the gaps with something that sounds right but isn’t.
Access is the other half. Many AI assistants work across your email, files and shared folders. Microsoft explains that Microsoft 365 Copilot only shows people data they already have permission to access. That is good design, but it also means any folder shared too widely becomes much easier to find.
1. Sort your information into four simple levels
You don’t need a complex data program. Start by agreeing on four categories and which kinds of AI tools are allowed for each:
- Public: information already on your website or in marketing materials. Most approved AI tools are fine here.
- Internal: everyday business information that isn’t meant for outsiders, such as procedures and internal emails. Use approved business AI tools only.
- Confidential: client files, contracts, pricing and financial results. Use only tools approved in writing for this kind of data, with access limited to the people who need it.
- Restricted: health information, payment card and bank details, Social Security numbers, payroll and HR records. Keep these out of AI tools unless a specific, approved setup exists for them, and always have a person review the results.
The exercise itself is useful. Most teams find a few types of information they had never really classified, and it’s better to sort that out before an AI tool starts reading it.
2. Clean up who can see what
Over the years, most businesses build up sharing problems: a folder opened to “everyone” for a one-time project, a former employee’s files still shared company-wide, a salary spreadsheet sitting in a general team folder. People rarely stumbled onto these before. An AI assistant that searches everything a user can access may surface them in seconds.
Before you turn on an AI assistant across your business:
- Review company-wide and “anyone with the link” sharing in Microsoft 365 or Google Workspace.
- Lock down folders that hold HR, payroll, financial and executive information.
- Remove access for former employees, vendors and contractors who no longer need it.
- Check guest access to Teams, SharePoint and shared drives.
3. Retire outdated and duplicate files
If your shared drive holds last year’s price list next to this year’s, or five versions of the employee handbook, an AI tool may pull from the wrong one. Pick one current home for the documents people rely on most, such as pricing, policies, procedures and service descriptions. Move old versions into a clearly labeled archive, and name current files so it’s obvious they’re current.
This step improves accuracy more than almost anything else, and it helps your team even without AI.
4. Give AI the smallest set of data it needs
An AI tool doesn’t need your entire file server to help with one task. For a first project, the book suggests working from a small, representative set of documents, often somewhere between five and twenty, instead of loading everything at once. For example, a proposal assistant might only need a handful of strong past proposals and the current price list.
Less data means fewer wrong answers to sort through, less information exposed if something goes wrong, and a faster way to tell whether the tool is actually helping. Our guide to AI implementation for small business explains how to set up a small, time-limited pilot.
5. Read the vendor’s data terms before you sign up
Free and personal AI accounts often have very different data terms from business plans. Before your team uses any AI tool for company work, find clear answers to these questions:
- Is our data used to train the vendor’s models?
- Who owns the information we enter and the results the tool produces?
- Where is our data stored, and for how long?
- Can we delete our data, including when we cancel?
- Can we control which employees use the tool and see what they’re using it for?
If you can’t get straight answers, that tool shouldn’t be on your approved list.
6. Watch for hidden instructions in documents and web pages
This one is newer, and worth knowing about. Some web pages, emails and documents contain hidden text written for AI tools rather than for people, such as instructions to promote a product, ignore earlier rules or share information. Security researchers call this prompt injection. It matters most when an AI tool can take actions on its own, like sending email or updating records.
The practical defenses are simple: keep a person in charge of anything an AI tool sends or changes, limit what each tool can access, and be cautious about letting AI act on content from outside your company without review.
7. Make sure you can recover
AI tools and automations can make mistakes quickly. A misconfigured automation can rename, move or overwrite a lot of files before anyone notices. Make sure your Microsoft 365 or Google Workspace data is backed up separately and that you have actually tested a restore. Our Microsoft 365 backup page explains what to look for.
A quick AI data readiness checklist
- Agree on four information levels and which AI tools are allowed for each.
- Review and tighten sharing on folders with HR, financial and client information.
- Remove access for people who no longer need it.
- Choose one current home for key documents and archive old versions.
- Start each AI project with the smallest set of documents it needs.
- Confirm the vendor’s terms on training, ownership, storage and deletion.
- Keep a person reviewing anything AI sends or changes.
- Test that you can restore your files.
If you want a deeper framework to work from, the NIST AI Risk Management Framework is a free, widely used reference for managing AI risk.
Frequently asked questions
What does “AI data readiness” mean for a small business?
It means the information an AI tool can reach is current, organized and only available to the right people. In practice, that comes down to clean file permissions, one current version of key documents, clear rules about sensitive data and approved tools. It is less about technology and more about good housekeeping.
Do we need to clean up all our files before using AI?
No. Start with the files a specific AI project will touch and the folders that hold your most sensitive information. You can improve the rest over time. Trying to clean everything first is a common reason AI projects never start.
Is Microsoft 365 Copilot safe to use with our files?
Copilot is designed to respect your existing permissions, so it only shows people information they can already access. The risk is that many businesses have permissions that are looser than they realize. Reviewing sharing settings before rollout is the most important safety step.
Why does AI sometimes give confident but wrong answers?
AI tools generate answers from the information they’re given and from general patterns they have learned. When your documents are outdated, duplicated or missing context, the tool may fill the gaps with something that sounds plausible. Cleaner source documents and a person reviewing important answers reduce this risk.
Which information should never go into an AI tool?
At a minimum: passwords and sign-in codes, payment card and bank numbers, Social Security and other government ID numbers, and health information, unless a specific setup has been approved for it. Most businesses add client information covered by confidentiality agreements and HR records to that list. Write the list down and share it with your team.
How long does it take to get our data ready for AI?
It depends on how many users, systems and shared folders you have and how long they’ve built up. For many small businesses, the most important steps can be completed in a few weeks, especially if you focus first on sensitive folders and the documents your first AI project will use.
Get your data ready before you roll out AI
SupportMax helps businesses assess where AI can help and whether their data and security are ready, prepare Microsoft 365 Copilot with the right permissions and data access, and give teams clear rules for safe AI use. Start with our free AI Readiness Assessment, learn more about our AI services, or schedule a consultation. Prefer to talk? Call 310.331.8119.
