Yes. Copilot works inside your own Microsoft environment, which is the safer place to start, and it still reads whatever your staff can reach. Foundations sets the rules and corrects the permissions so that what Copilot can see is what it should see.
Be ready to switch AI on, safely.
Before you widen AI across your business, you need to know your data is in order, your people know the rules, and you can show your board, your insurers and your customers that you have done your due diligence. AI Foundations puts that in place for a small or medium-sized business, so you can move with confidence instead of crossing your fingers.
AI Foundations:
The groundwork that makes AI safe to use.

Staff are already using AI
Your people are very likely pasting company information into free AI tools like ChatGPT today. AI Foundations sets clear rules for what can go where, so that everyday use stops being a quiet exposure.

Nobody owns the risk
Without a policy, a tool register and a named route for incidents, AI risk sits with no one until something goes wrong. We give it an owner and a paper trail.

You cannot prove you are in control
Buyers, insurers and regulators are starting to ask how you govern AI. AI Foundations gives you the evidence to answer them before they think to ask.
Each of these is groundwork, and groundwork is exactly what we do before anyone builds.
31%
of UK employers have a formal AI policy (CIPD)
62%
of staff already use AI tools nobody approved
1 in 3
of AI users get clear professional guidance at work (Google, UK research)
A complete, plain-language base for responsible AI.
We work to ISO 42001, the international standard for responsible artificial intelligence, so everything we set up is built to count towards certification later if you choose to go there. It also sits naturally alongside our IT compliance and risk management service, extending the same controls-and-evidence discipline to AI.
- A responsible AI policy written for your business, in language your team will read.
- Data classification: simple traffic-light tiers that tell everyone what may go into which tool.
- An approved tool register and a risk register, so AI use is recorded and reviewed.
- A clear incident route, so people know what to do the moment something looks wrong.
- A staff briefing and policy sign-off, so the rules are understood, not just written.
- Your own governance portal, where the policy, the registers and the evidence live.
We do not call it safe until it is.

Alongside the core setup we scope any make-safe work your assessment turns up: tidying data stores, correcting permissions, closing the gaps that would make wider AI risky, the same ground our cyber security and threat protection service works every day. The scope and the cap are agreed before any work starts, and you choose who does it, our team, yours, or both. One rule holds the promise honest: widening AI beyond your first users waits until that make-safe work is done. That is the point of Foundations, not the small print.
Every step counts towards what comes next.
AI Foundations is designed so that each artefact, the policy, the registers, the evidence, is a finished input to ISO 42001 alignment. If you go further, you build on this; you do not redo it. The natural next steps are Microsoft Copilot, done safely, and AI Assured to keep it that way.

Common questions
Do we need this if we only use Microsoft Copilot?
How long does it take?
What do we have at the end?
Can we not just download an AI policy template?
Start with a conversation, not a contract.
Book a free AI Discovery Call. We will show you where your quick wins are, what to address first, and how AI Foundations would set you up to switch AI on safely. There is no obligation to go further.
Book a meeting with our AI leadDave Coleman, EPX IT's AI leadContact us
Keep exploring the AI hub.

The AI hub home
Putting AI to work in your business, safely

Where do you stand?
Take the free two-minute AI readiness quiz

Microsoft Copilot
Set up properly and actually used

Prompts and use cases
Ready-to-use Copilot prompts for real jobs

AI Assured
Monthly monitoring for shadow AI and oversharing

Regulated industries
AI for law firms, accountants and healthcare

How we use AI ourselves
Nearly 90 hours a month back, measured on our own business