AI in the tools you already use at work

AI that comes to you

The AI most people use at work isn't a separate website. It's a button in the apps they already open every day.

Most UK organisations run on one of two office suites: Microsoft 365 or Google Workspace. Both now have AI built in, usually in a side panel next to your email or document, where it can work with what's in front of you. For many people, that's where everyday AI use will actually happen.

Microsoft 365: Copilot Chat and Microsoft 365 Copilot

Microsoft uses the name Copilot for several different things, which causes a lot of confusion. At work, there are two you're most likely to meet.

Microsoft 365 Copilot Chat is included with most work and school Microsoft 365 accounts at no extra cost. It's a secure AI chat that answers from the web and from content you give it, such as a file you upload or text you paste in. It also appears inside Word, Excel, PowerPoint, Outlook and Teams, where it's aware of whatever you have open. So in Word it can summarise the document you're looking at. In Outlook it can summarise a long email thread or help you draft a reply. In Excel it can answer questions about the spreadsheet in front of you. Exactly what you see depends on how your organisation has set things up.

Microsoft 365 Copilot is the paid version, licensed per person by your employer. The big difference is reach. With a licence, Copilot can draw on your wider work data: your emails, calendar, chats, meetings and the files you have access to across your organisation. That's what lets it answer questions like "What did we agree about the office move?" by searching your mailbox and Teams chats, or recap a Teams meeting you missed. It also comes with more advanced agents and priority access when the service is busy.

A useful rule of thumb: Copilot Chat mostly works with what you show it, while the paid Microsoft 365 Copilot can go and find things across your work.

One more twist. If you have Microsoft 365 Personal or Family at home, you'll also see Copilot in Word and Outlook there. Same icon, different rules. That's a personal account, and it doesn't come with the workplace protections described in the next section.

Google Workspace: Gemini

If your organisation uses Google Workspace, Gemini is now included in its business and enterprise plans. You'll find it in a side panel in Gmail, Docs, Sheets, Slides, Drive and Chat, plus "Help me write" for drafting emails and documents, note-taking in Google Meet, the Gemini app itself and Gemini Notebook (the tool you may know as NotebookLM, covered in Thing 6). As with Microsoft, your organisation's administrators decide which features are switched on, so you may not see all of them.

On a personal Google account, Gemini inside Gmail and Docs generally needs a paid Google AI plan. Again, the personal and work versions look similar but run under different terms.

Meeting tools and AI notes

Meetings are one of the fastest-growing places for workplace AI. Teams, Google Meet and Zoom can all produce AI meeting notes, summaries and lists of actions, though what's included depends on the plan your organisation pays for. There are also separate AI note-taker apps that join a call as an extra "participant" and send everyone a summary afterwards.

These can be genuinely useful, especially if you struggle to take notes while also taking part. But they raise questions the other features don't. Everyone in the meeting is being recorded or transcribed, not just you. Some people may not realise, or may not be comfortable with it. And an AI summary can miss a nuance, attribute a comment to the wrong person or turn "we might look at that" into a firm action. If you use AI notes, tell people at the start, and treat the summary as a draft that someone who was there should check. Thing 8 looks more closely at speech and transcription.

Work account or personal account?

The same AI can follow very different rules depending on which account you're signed in with.

This is probably the single most important idea in this Thing. When you use an AI tool through your organisation's account, it usually runs under a business agreement between your employer and the vendor. When you use the free version with a personal account, it runs under consumer terms. The interface may look almost identical. What happens to your information can be very different.

What workplace protections usually mean

Both Microsoft and Google make similar promises for their workplace AI. Microsoft calls its version "enterprise data protection". In broad terms, for work accounts:

• your prompts and the AI's responses aren't used to train the underlying AI models
• your information stays within your organisation's account and is covered by the same security and data protection terms as your email and files
• the AI respects your existing permissions, so it can only reach content you're already allowed to see
• your organisation's own rules apply, such as how long records are kept

Microsoft shows when these protections are on with a green shield at the top of Copilot Chat, next to the New Chat button. Google sets out its commitments in its Workspace privacy hub and says your content isn't human reviewed or used to train its models outside your organisation without permission. Personal accounts are different. As you saw in Thing 15, free consumer tools may keep your conversations and may use them to improve their models unless you switch that off.

Who can see your prompts?

Here's the part people often don't expect. Workplace protections keep your information away from the vendor's model training and from other organisations. They don't make your prompts private from your employer.

In Microsoft 365, for example, Copilot prompts and responses are logged and stored so your organisation can audit them, apply its retention rules and search them if it needs to, such as during an investigation or a request for information. Google lets administrators control how long Gemini conversations are kept. A sensible way to think about it is that anything you type into a work AI tool is a work record, much like a work email. Don't type anything into it that you'd be uncomfortable seeing in an email.

The habit that matters most

Put those two points together and you get one simple habit. Work information goes into work tools that your organisation has approved, and nowhere else. Pasting a work document into a free personal chatbot because it's quicker takes that information outside your organisation's protections entirely. Even if nothing bad happens, it's very likely to break your organisation's policy and possibly data protection law.

What the AI can reach

Workplace AI respects your permissions. The trouble is that many of us can see more than we realise.

Earlier in this programme, the AI only knew what you typed or uploaded. Workplace AI can reach much further, particularly the paid versions. Microsoft 365 Copilot can search your mailbox, calendar, chats, meeting transcripts and files. Gemini in Workspace can pull in relevant content from your Gmail and Drive. That's what makes these tools powerful, and it's why it's worth understanding what they can see.

Permissions and oversharing

Both Microsoft and Google say their AI only retrieves content you already have permission to access. That sounds reassuring, and it's an important safeguard. But think about how permissions work in a real organisation. Over the years, a lot of files get shared with "everyone in the organisation" because it was easier. Old project folders stay open long after the project ends. Someone shares a spreadsheet with a whole department when they meant to share it with one person.

Before AI, most of this oversharing went unnoticed because nobody went looking. An assistant that searches everything you can access changes that. Ask a broad question and it may surface a document you never knew you could open, such as a pay review spreadsheet in the wrong folder. The AI hasn't broken any rules. It has simply made an existing problem visible.

Microsoft's own guidance to organisations stresses tidying up overshared content before switching Copilot on, which tells you how real the issue is. As an individual, you can help in three ways:

• if the AI shows you something you clearly shouldn't be able to see, don't use or share it, and tell your IT or information governance team
• check the sharing settings on files and folders you own, and narrow them where you can
• be careful with broad prompts like "find everything about our restructure", and ask for what you actually need

Agents and actions

Workplace AI is also starting to act, not just answer. Agents can draft documents, update files, schedule meetings or carry out multi-step tasks on your behalf. These carry their own risks, from mistakes that are hard to undo to hidden instructions buried in an email or web page. Thing 21 covers automation and Thing 22 looks at agents and how to delegate to them safely.

Policies and accountability

Your employer chooses the tools. You're still responsible for what you do with what they produce.

Why your organisation's AI policy matters

Most organisations now have some form of AI policy or guidance, even if it's a short page on the intranet. It's worth finding and actually reading, because it answers questions this programme can't answer for you. A good policy will usually tell you:

• which AI tools are approved, and whether personal or free tools are allowed for work at all
• what kinds of information you can and can't put into them (for example, personal data about customers or colleagues, or commercially sensitive material)
• which tasks are fine, which need extra care and which are off limits
• whether you need to say when AI has helped produce something
• who to ask when you're not sure

Policies exist for good reasons. Your organisation has legal duties around data protection and confidentiality, and it has chosen its tools after checking where data goes. A policy is how those decisions reach you. If your organisation doesn't have one yet, asking for one is a genuinely helpful thing to do.

You're still accountable

Whatever the tool, the person who sends the email, signs off the report or shares the summary is responsible for it. "Copilot wrote it" won't help if a figure is wrong, a client is misquoted or a confidential detail ends up in the wrong place.

This matters more with workplace AI because it's so convenient. When a polished draft appears in your document with one click, it's tempting to accept it. But these tools make the same kinds of errors you'll meet in Thing 13: confident mistakes, missing context and details that sound right but aren't.

There's also good evidence about where they help and where they don't. When the UK government trialled Microsoft 365 Copilot with 20,000 civil servants, people reported saving around 26 minutes a day on average, mostly on drafting documents and preparing presentations. But the trial also found the tool struggled with complex, nuanced or context-heavy work, tasks needing deep specialist knowledge, data analysis that needed checking and sensitive matters such as HR cases. Human oversight remained essential throughout.

In practice, that means:

• read everything before it goes anywhere, especially names, numbers, dates and anything you're agreeing to
• check AI summaries against the source when the detail matters
• keep decisions about people with people
• be open about AI involvement where your policy or the situation calls for it

Questions to ask before you rely on it

A few minutes of checking now saves an awkward conversation later.

Before you start using a workplace AI feature for real work, it helps to know the answers to a handful of questions. Some you can find yourself. Others are for your manager, IT team or information governance lead.

About the tool

• Is this an approved tool, and am I signed in with my work account?
• Does it show that workplace data protection is on (such as Copilot's green shield)?
• What can it reach: just what I show it, or my email, files, chats and meetings too?

About your information

• What does our policy say I can and can't put into it?
• Are prompts and responses kept? If so, for how long and who can see them?
• Are there any kinds of information (such as personal data or client material) that should never go in, even here?

About the output

• What checks should I do before using what it produces?
• Do I need to say when AI has helped?
• Who do I tell if it gets something wrong or shows me something I shouldn't see?

You don't need perfect answers to all of these before you start. But if nobody can tell you whether a tool is approved or what you can put into it, that's a sign to pause and ask.

Resources to explore

Activity: find and test your workplace AI

Route A: you have AI in your work apps

1. Find the AI features. Open the work apps you use most (such as Outlook or Gmail, Word or Docs and Teams or Meet) and look for the AI. In Microsoft 365, look for the Copilot icon in the ribbon or side panel, or open Copilot Chat. In Google Workspace, look for the Gemini icon in the side panel. Make a quick note of where you found AI and what it offers to do in each app.
2. Check your organisation's guidance. Find your organisation's AI policy or guidance. Try the intranet, the IT or information governance pages, or ask your manager. Note down three things: which tools are approved, what information you mustn't put into them and who to ask if you're unsure. If you can't find a policy, note that too. It's a useful finding.
3. Check the data protection signal. Open Copilot Chat or the Gemini app and check you're signed in with your work account. Look for what the tool tells you about data protection. In Copilot Chat, look for the green shield next to the New Chat button. In Gemini, look for any notice about how your work data is handled. Write down exactly what it says.
4. Try one feature with made-up content. Paste the Bramblewick Garden Centres notes into Copilot Chat or Gemini and try one or two of these:

   • "Turn these meeting notes into a short, friendly team update email."
   • "List the actions from these notes, with who is responsible and the deadline."
   • "Draft an outline for a one-page how-to guide for a confusing loyalty card app."

   Use only the made-up notes. Don't ask it to search your real inbox, files or chats for this activity, even if it can.

5. Check the output. Read what it produced as if you were about to send it. Did it get the names, dates and actions right? Did it invent anything that wasn't in the notes, such as a deadline for the how-to guide? Would you be happy to put your name to it? Note anything you'd change.

Route B: you don't have AI in your work apps

1. Open a free personal assistant. Use ChatGPT, Gemini or Copilot with your personal account. Before you start, remind yourself of the golden rule: real work information never goes into a personal tool. Everything in this route uses the made-up scenario.
2. Try the same tasks. Paste the Bramblewick Garden Centres notes into the assistant and try the same prompts as Route A: a team update email, a list of actions with owners and deadlines and an outline for a how-to guide.
3. Check the output. Read it as if you were about to send it. Did it get the names, dates and actions right? Did it add anything that wasn't in the notes? Note what you'd change before using it.
4. Look at the data terms. Find what this personal tool says about your data. Is there a setting about using your chats to improve its models? Is it on? (Thing 15 shows you where to look.) Compare that with what you've read in this Thing about workplace protections.
5. Draft three questions for work. Imagine your employer announces it's introducing AI next month. Write three questions you'd want answered before using it for real work. Use the "Questions to ask before you rely on it" section for ideas, but put them in your own words.

Both routes: my workplace AI checklist

6. Write your checklist. Finish by writing a short "my workplace AI checklist" of five to eight points you'll follow when using AI at work, now or in the future. Make it practical and personal. For example: "Check for the green shield before I start", "Never paste customer details into anything except approved tools" or "Read every AI summary against the original before I forward it".

Your output

Your notes from Route A or Route B (where you found AI or what the personal tool says about data, one AI output with your comments on what you'd change and, for Route B, your three questions), plus your "my workplace AI checklist".

Claim your Open Badge

Submit your route notes, your AI output with your comments and your "my workplace AI checklist" via cred.scot. Please check that nothing you submit includes real work information.

Thing 7: AI in the tools you already use at work

Submit your workplace AI notes and personal checklist to claim this badge via cred.scot.

Claim now