Why Copilot Isn't Your AI Strategy

“We already have Copilot”

It’s the most common thing we hear in early conversations and it’s a fair thing to say. The licences are paid for, the tool is already inside the apps your team uses every day and someone in IT has probably run a training session.

So let’s be clear about one thing first: Copilot is a good tool. We use general AI assistants ourselves. If your team isn’t using one, they should be.

But having Copilot and having an AI strategy are not the same thing. The gap between them is where most of the unresolved feeling about AI in business comes from.

What Copilot is built for

Copilot is built to help an individual with their own work. Draft this email. Summarise that meeting. Tidy up this paragraph. Find the document I half remember. It does these things well and it does them for everyone, which is exactly the point.

That is also the limit. A tool designed to work for everyone has to work the same way for everyone. That's a strength for personal productivity. It's a limit for any work that depends on how your business does things: your risk threshold, what a good report looks like to your clients or the three clauses your partners always check first.

Where it stops

In practice, with Copilot as most businesses deploy it, we see the same five gaps.

Your process isn’t a Microsoft 365 feature. The real work in a business like yours moves through case management systems, finance systems, your CRM, spreadsheets, email and occasional PDF someone has scanned sideways. A general assistant sits in one corner of that and waits to be asked.

It starts from a blank prompt. Every use depends on the person remembering what to ask and how to ask it. Two colleagues doing the same task will get two different results and neither will reliably match your standard.

The output is a draft in a chat window. Somebody still has to copy it out, put it in the right template, check it against the right standard and file it. The tool saved some typing. The process hasn’t changed.

There’s a record, but not a process record. Copilot stores interaction data such as prompts, responses and citations, and admins can review or retain some of it through Microsoft 365 controls. That is useful for basic visibility, but it is not the same as a full workflow audit trail showing which business process ran, on which documents, with what approval steps and what the human reviewer decided. If a client or regulator asks, “show me”, that is still a difficult answer to give. We wrote about this in The Question Nobody Else Asked.

You can’t easily tune it. If the output is consistently slightly off, the usual fix is longer prompts and hope. More control is possible, but that means building something, which brings us to the obvious objection.

But what about Copilot Studio?

Fair question. Microsoft has been closing some of these gaps. Copilot Studio lets you build custom agents, connect them to other systems and add governance. If your IT team has the time and appetite, you can get a long way.

But notice what that is. It’s no longer “we already have Copilot”. It’s a platform you now have to build on. Someone has to choose the process, write down how your business actually does it, connect it to your systems, test it against real documents, design the review step and the logging and keep it all working as the models and your own standards change.

The licence covers the tooling. It doesn’t cover that work, and that work is the strategy. Whether it’s done in Copilot Studio, by us or by someone else matters less than not assuming the licence already did it.

The question your clients will ask first

For professional services firms, the sharpest worry usually isn't output quality. It's confidentiality.

Copilot respects the permissions model that already exists in Microsoft 365. That is a sensible design choice, but it also means it will surface anything someone already has access to, including the folder that was never tidied up. Messy permissions were always a risk. An AI assistant makes them visible and fast.

If you hold client-confidential material, the question isn’t only “is the tool secure?” It’s “who can see what, what is the AI allowed to touch, and can we show that under UK GDPR and our professional duties of confidentiality?” A purpose-built system can be scoped to specific documents and data from the start, rather than inheriting whatever the wider environment happens to allow. If you’re regulated, check what your sector body expects before any AI touches client material, whichever route you take.

What the difference looks like

This is hypothetical, but a familiar one. Picture a business that reviews supplier contracts before signing them.

With a general assistant, a team member pastes in a contract and asks, “Anything risky in here?” They get a sensible, generic answer. It’s useful. It’s also different every time, it doesn’t reference your own playbook, and nothing is recorded.

A custom system does the same job differently. The contract arrives, gets checked against your clauses and your thresholds and comes back as a structured summary in your format with the unusual wording flagged for a human to review. It logs what it looked at and why. The reviewer’s judgement is still the final step. It just starts from the right place every time.

Same underlying technology. Very different outcome. We’ve written before about why general AI can feel like a hire car: perfectly good for getting around, but not built for your journey.

What a strategy actually looks like

A strategy isn't a tool. It's a handful of decisions:

1. Pick the few processes that matter. Not everything. The repeatable, high-volume or high-risk tasks where consistency and a paper trail pay for themselves.
2. Write down how your business does them. Your standards, thresholds and templates. This is the part most businesses have never documented and the AI can't use what isn't written down.
3. Keep a human in the loop. Decide where review happens and what the reviewer sees, so judgement stays with your people.
4. Measure it. Time saved, errors caught, consistency between reviewers. If you can't show it's working, you can't improve it or justify it.
5. Sequence it. Start with one process, prove it, then move to the next.

Copilot can sit alongside all of this. It just can't do any of it for you.

What custom costs

Let's be straight about the trade-offs. A custom system costs more upfront than a licence. It needs designing, building, testing and connecting to your existing systems. And it isn't set-and-forget. Models change, your documents change, your standards change, and someone has to own it afterwards.

That's why it isn't the answer to everything. For a task that's low-risk, one-off or genuinely fine with a generic answer, it isn't worth it. It's worth it where the same process runs again and again, where being slightly wrong is expensive, or where you need to show your working.

It's also why we don't just hand over a build and leave. We design and build custom AI and we maintain and support it afterwards, so you don't need an in-house team to keep it running.

A simple test

When you’re deciding where Copilot is enough and where it isn’t, ask three questions about the task:

1. Is it one person helping themselves, or the same task repeated across the team?
2. Does it need to follow your firm’s way of doing it, or is a sensible generic answer fine?
3. Would you need to show what happened afterwards?

If the answers are “one person”, “generic is fine” and “no”, use Copilot and don’t think about it again. If they lean the other way, you’ve found a process and processes are where custom AI earns its place.

Mixed answers are common. A task that’s repeated across the team but where generic is fine usually just needs a good shared prompt in Copilot. A task that’s done by one person but needs an audit trail is worth a closer look. When in doubt, start with the third question, because “show me” is the one that’s hardest to answer after the fact.

It’s also worth saying that some tasks need neither Copilot nor custom AI. Our post on when not to use AI still stands.

It isn’t either/or

Nothing here is an argument against Copilot. The sensible position for most businesses is both: general assistants for individual productivity and purpose-built systems for the handful of repeatable processes where consistency, control and a paper trail matter.

The mistake is treating the first as a substitute for the second and then wondering why the results feel thin.

If you’re not sure which side of the line your work falls on, that’s a good conversation to have before anyone builds anything. We’re happy to have it. Reach out.

Not magic. Just momentum.

Ben Walker - Inzen