How to Clean Up Your Company Data Before Rolling Out AI

Most business leaders assume that artificial intelligence will clean up their mess for them. The logic seems sound on the surface: if a tool like Microsoft Copilot can read, summarise, and connect millions of data points in seconds, surely it can make sense of an overgrown SharePoint library or ten years of scattered customer folders.

That assumption is wrong, and it is usually an expensive mistake to make.

AI does not fix bad data. It amplifies it. If you feed an AI system four conflicting versions of a pricing sheet, it will quote the wrong price with absolute confidence. If your staff have unintentionally left executive payroll spreadsheets visible to the entire company in a forgotten Teams channel, Copilot will surface that data the moment someone asks an innocent question about company finances.

Before you invest in licenses or announce an internal rollout, you must carry out a data hygiene project. For a company of 15 to 250 employees, this does not require a year-long enterprise consulting engagement. It requires a methodical, four-step audit focused on permissions, clutter, and structure.

The Illusion of "AI Will Organise It for Us"

Tools like Microsoft Copilot rely on an approach known as Retrieval-Augmented Generation (RAG). In simple terms, when an employee types a prompt, the system first searches your internal data for relevant documents, reads those excerpts, and then uses that context to draft an answer.

If your digital filing cabinet is full of duplicate, outdated, and contradictory files, the retrieval step fails.

Consider a standard scenario in an 80-person logistics or professional services firm. A project manager asks Copilot: "What is our standard cancellation policy for client contracts?"

Over the last eight years, the company has updated that policy five times. The network contains: - The 2018 policy in an old operational guidelines document. - A 2021 draft created by a departed director that was never approved. - A customized 2023 version written specifically for one legacy enterprise client. - The actual 2024 signed policy, buried in an administrative subfolder.

Copilot does not possess human intuition. It cannot guess that the 2021 draft was abandoned unless the file explicitly says so, and it cannot instinctively know which document represents current company policy. It simply gathers the most mathematically relevant text matches. If the abandoned 2021 draft happens to use the exact words from the prompt, that is the policy your employee will send to the client.

To make AI reliable, you must first remove the historical noise.

Audit Permissions Before You Touch File Names

The most urgent risk in deploying workplace AI is not inaccurate answers; it is data leakage.

In most small and medium businesses, permission management degrades over time. When a company is ten people, everyone has access to everything. As the company grows to 50 or 150 staff, teams create ad-hoc SharePoint sites, shared drives, and Teams channels. Folders are created with open permissions ("Everyone except external users") simply because it was the fastest way to get work done that afternoon.

Staff members rarely browse folders they know they shouldn't look at. The risk remains dormant because the files are out of sight.

Copilot eliminates the protection of obscurity. It operates strictly within user permissions, but it searches across every single file a user has technical rights to view. If an entry-level employee has read-access to a folder containing board packs, salary bands, or acquisition notes, Copilot will happily summarise those documents for them upon request.

Before rolling out any internal AI tool: - Run a permissions report on all primary SharePoint document libraries and cloud drives. - Restrict sensitive folders (HR, executive compensation, financial audits, legal correspondence) to explicit, named security groups rather than broad link-sharing settings. - Review "Shared with Everyone" links and break legacy inheritance on archive folders. - Review guest and contractor accounts to verify what external users can view.

If you skip this step, your AI pilot will likely be halted by an embarrassing and avoidable internal privacy incident within the first fortnight.

Apply the Three-Pile Rule: Purge, Archive, and Isolate

You do not need to clean every single file your company has generated since 2012. You only need to control what the AI can see.

The most practical method for an SMB is the three-pile rule:

• Purge (Delete): Redundant, obsolete, and trivial files (ROT). This includes temporary exports, duplicate drafts, system backups saved locally, and working notes from closed projects that have zero regulatory or operational value. If a document has not been opened in seven years and is not legally required, delete it.
• Archive (Cold Storage): Historical records that must be retained for tax, statutory, or reference purposes, but should never be used for daily work. Move these into a dedicated, read-only archive site or separate cloud storage location that is explicitly excluded from your AI search index.
• Isolate (Active Knowledge): The living documents your team relies on today: current master service agreements, active project documentation, approved standard operating procedures, and product sheets. This is the only pool of data your AI tool should actively index.

By moving your inactive history out of the search perimeter, you instantly cut the surface area for errors by half.

Establish Lightweight Standards (Without Enterprise Bureaucracy)

Many business owners delay their data cleanup because they assume it requires an elaborate enterprise taxonomy with dozens of metadata tags. In reality, complex tagging schemes fail in medium-sized businesses because busy staff members refuse to use them.

Keep your file-handling rules remarkably simple:

• Designate single sources of truth. For every core operational topic (pricing, HR policies, client onboarding), maintain one master document in one dedicated location. When policies change, overwrite or update that master document rather than saving a new file titled "Policy_2025_Final_v2_edit.docx".
• Use unambiguous version naming. If historical drafts must be kept in working folders, label them clearly with an "ARCHIVED" or "DRAFT" prefix in the filename.
• Standardise date conventions. Use the ISO standard (YYYY-MM-DD) at the beginning of dated documents. This helps AI models distinguish between historical meeting notes and recent updates.

A simple, three-rule convention that staff actually follow is infinitely more effective than a comprehensive data policy that sits unread in an employee handbook.

Weighing Your Options: Internal Effort vs External Help

As an SMB leader, you need to decide who will execute this cleanup. Broadly, you have three options:

1. The Bottom-Up Staff Approach: Asking every employee to spend Friday afternoon tidying their own folders. This rarely works. It lacks consistent governance, staff prioritise client work, and nobody wants the responsibility of deleting older files. 2. An Internal Systems Champion: Assigning your operations manager or internal IT lead to run a structured data readiness project. This works well if you have a capable lead who understands business context (not just IT infrastructure) and can be freed from daily operational duties for several weeks. 3. A Specialist-Led Audit: Bringing in an external partner to run automated permission audits, identify duplicate data stores, set up technical exclusion rules, and configure security boundaries (such as Microsoft Purview sensitivity labels) before licensing begins.

The right choice depends on your timeline and internal bandwidth. If your team is already stretched, attempting a DIY cleanup will either drag on for nine months or happen so superficially that your AI rollout remains compromised.

The Clear Next Step

Do not wait for a full company-wide consensus to begin. Start with a single, controlled diagnostic.

Pick your primary business department - usually sales, operations, or HR. Run a technical permissions review on their main document repositories and list every folder accessible to "Everyone." You will immediately see the security gaps and outdated duplicates that would confuse an AI system.

Fixing that single department provides an actionable blueprint for the rest of your business. Only when your operational data is restricted, validated, and current should you hand the keys over to AI.