Most Australian businesses already have staff using AI tools. Very few have checked what those tools can reach. These are the seven questions REDD asks on an AI exposure check. Work through them at your next leadership meeting, or download the one page version and hand it around.
The checklist
If you cannot answer three or more of these, that is worth a conversation.
Start with what is actually happening, not what the policy says. Ask the question in a way nobody gets in trouble for answering honestly, or you will get a tidy answer and a messy reality.
Once it is pasted it has left your control, and no policy brings it back. Know which of your tools are consumer accounts and which are business accounts, because they are not governed the same way.
Free and personal tiers commonly use your input to improve the model. Business and enterprise tiers commonly do not. The difference is usually a setting and a contract, and it is worth confirming in writing.
Copilot inherits the permissions each person already has. A decade of quick shares and forgotten folders becomes searchable in plain language on day one, which is why the permission clean up comes before the licences.
One page is enough: the approved tools, what must never be pasted in, and who to ask. A rule people have actually read beats a policy nobody opens.
This is the question that decides how bad an incident gets. If the answer is no, you cannot scope the problem, and you will be telling a client you are not sure what was exposed.
It is appearing in tenders and supplier reviews now. Being able to answer it well is quickly becoming a commercial advantage, not just a compliance task.
Why it matters now
Usually with the best intentions and usually with a personal account. The question is not whether, it is what has already been pasted in.
Supplier reviews, tenders and cyber insurance renewals now include questions about AI use. A clear answer is becoming a commercial advantage.
Microsoft Copilot respects existing permissions. That is the point, and the risk, because most businesses have years of oversharing nobody noticed.
What REDD does with the answers
Twenty minutes with a REDD engineer. Which tools are in use, what they can reach, and what to change first. Findings are yours either way.
A review of your Microsoft 365 tenant before licences go on: permissions, oversharing, labelling, identity and governance.
The rollout itself, run by an ISO 27001 certified team: the right tools, the right people, and the guardrails written down.
Common questions
Yes. Download the PDF here with no form, or ask for the walkthrough and a REDD engineer will go through it with you. Either way the findings are yours.
A REDD engineer looks at which AI tools your people are using, what those tools can currently reach, and what to change first. You get a short written summary and a cost for the fix if you want one. No obligation.
No. The questions apply to ChatGPT, Claude, Gemini and any other tool your staff use with work information. Copilot is the one that makes existing permission problems visible fastest, which is why it gets its own question.
No. It is practical guidance from an ISO 27001 certified managed IT and cyber security provider in Brisbane. Your obligations depend on your industry, your contracts and the data you hold.
A REDD engineer will walk through your environment and show you what your AI tools can currently reach, what to change first, and what it costs. Twenty minutes, no obligation.
Get in touch
Send the basics and a REDD engineer will come back to you within one business day. Prefer to talk? Call 1300 697 333.