How to Clean Up Your Company Data Before Turning on AI Tools

Most businesses that buy licenses for tools like Microsoft Copilot or Google Gemini make the same early mistake: they treat the rollout as a software installation rather than a data governance exercise.

They pay for the seats, toggle the switch in the admin portal, and tell staff to start asking questions. Within forty-eight hours, an intern asks a casual prompt about executive salaries and gets an accurate breakdown of the board's compensation. Or a project manager asks for the standard contract cancellation policy and receives an answer based on a draft agreement from 2017 that was abandoned six years ago.

AI models do not possess corporate common sense. They cannot tell that a spreadsheet stored in a shared folder was intended for executive eyes only, nor can they tell that "Policy_Review_Draft_v3_OLD.docx" contains superseded terms. These tools index and query whatever the logged-in user technically has permission to see. In most small and medium-sized firms, that means almost everything.

If you are currently evaluating generative AI tools for your team, your immediate priority is not prompt engineering. It is data housekeeping.

The Oversharing Problem: Fix Permissions Before Anything Else

The single greatest operational risk with workplace AI is permission sprawl. Over the last decade, most businesses between 10 and 250 staff have migrated their files to platforms like Microsoft SharePoint, OneDrive, and Google Drive. Along the way, internal file permissions eroded.

Shared links were created with access set to "Anyone in the company." Entire folders containing personnel reviews, cash flow forecasts, or merger discussions were dragged into general document libraries to save time. In a normal working environment, this loose security goes unnoticed because staff do not actively search for things they have no reason to find.

AI changes this dynamic entirely. A generative assistant does not wait for a user to know where a file lives; it crawls the entire accessible index to answer a query. If an employee has read-access to an executive folder, the AI will use the contents of that folder to answer their questions.

Before purchasing or assigning AI licenses, conduct a permissions audit:

• Review all top-level team sites and shared drives to confirm membership matches actual business needs.
• Search for and disable legacy "Company-Wide" or "Public" access links on folders holding commercial, personnel, or financial data.
• Check group memberships. Employees who change roles within small companies often accumulate permissions they no longer need.
• Enforce the principle of least privilege. Staff should only have access to the data required to do their daily jobs, nothing more.

Eliminating the Digital Attic: Managing Redundant and Obsolete Files

AI assistants treat the written word as factual unless instructed otherwise. When an employee asks, "What is our refund policy for enterprise clients?", the model parses every file referencing refunds. If your shared storage contains the 2019 policy, the 2021 revision, an unapproved 2023 proposal, and the live 2024 policy, the assistant will attempt to synthesize an answer from all four.

The result is a convincing, well-written hallucination constructed entirely from your own company's conflicting records.

To prevent this, you must run a structured purge of redundant, obsolete, and trivial (ROT) data. This does not mean deleting your company history; it means moving historical records out of the working index.

• Create an isolated archive location. Move old board packs, past client deliverables, and retired operational policies into a restricted archive repository that is blocked from search indexing.
• Consolidate active operating procedures. Maintain a single, canonical version of each core policy, handbook, and product specification.
• Delete duplicate files. Shared storage in most SMBs is littered with multiple copies of the same presentation or report, often saved in personal OneDrive folders. Consolidate them to a single shared source.

If a file contains out-of-date information that the business must retain for legal or tax purposes, lock it down to a dedicated compliance archive where AI systems cannot ingest it.

Structuring Unstructured Files for Business Context

Language models are remarkably adept at understanding plain text, but they struggle when files lack basic context. If your team relies on documents named "Notes.docx", spreadsheets titled "Summary(1).xlsx", or scanned PDFs saved as images without readable text, the AI will either miss the information entirely or misinterpret it.

Context is created through structure. You do not need an enterprise taxonomy project, but you do need standard naming and storage habits across your core business functions.

• Implement human-readable file naming. A file named "2024-Q2-Board-Report-Approved.docx" provides the model with clear temporal and subject-matter context. A file named "Report final.docx" does not.
• Ensure PDFs are searchable. Scanned invoices, contracts, and legacy records stored as flat image files are invisible to tools like Copilot unless they have undergone optical character recognition (OCR).
• Keep related documents together. Avoid scattering parts of a single project across emails, personal chats, and multiple subfolders. Group relevant files in designated project folders so the tool can trace related context easily.

Labeling and Tagging Sensitive Information

Beyond basic folder security, modern cloud platforms offer automated tools to classify and protect data. If you run Microsoft 365 Business Premium or enterprise plans, you have access to Microsoft Purview features such as sensitivity labels.

Sensitivity labels apply visual markers, encryption, and access controls to individual documents and emails based on their contents. For example, a document tagged "Confidential - Financial" can be configured so that it cannot be opened by anyone outside the finance team, regardless of where it is saved.

Tools like Copilot respect these labels. If an AI tool attempts to answer a question, it honors the protection policies attached to the underlying documents:

• Define three or four simple labels, such as Public, Internal, Confidential, and Highly Restricted.
• Configure automatic policies to flag common identifiers, such as payment details, national insurance numbers, or passport records.
• Train your managers to apply these labels manually when creating sensitive commercial proposals, personnel files, or acquisition plans.

Adding this layer ensures that even if a document is mistakenly placed in an open folder, the software will not surface its contents to unauthorized users through an AI summary.

A Four-Week Practical Cleanup Roadmap

Data cleanup can feel paralyzing if you try to tackle years of accumulated clutter all at once. The key for small and medium businesses is to focus exclusively on high-risk and high-utility data first.

1. 1

   Week 1

   Audit access. Identify who has administrative rights to your core storage environments. Restrict access to executive, HR, and accounting folders to confirmed personnel only. Turn off broad internal sharing links.

2. 2

   Week 2

   Clear the active libraries. Focus on your most frequently referenced shared spaces. Archive anything older than two years that is no longer in active operational use. Establish single source-of-truth documents for company policies.

3. 3

   Week 3

   Standardize the active pipeline. Introduce consistent naming rules for ongoing client work, proposals, and internal guides. Run OCR processing on key scanned repositories, such as active contracts and vendor agreements.

4. 4

   Week 4

   Apply sensitivity labels. Roll out standard classification tags for internal and confidential files. Test search queries from test user accounts with different permission levels to verify what can and cannot be retrieved.

Next Steps

AI assistants do not fix bad data architecture; they expose it. Turning these tools loose on an unmanaged, over-shared file system creates real security vulnerabilities and wastes staff time with inaccurate results.

Before spending money on licenses, run an internal permissions review on your primary cloud storage environment. If your IT team or managed service provider cannot show you exactly who has access to your payroll and strategy folders today, that is the first problem to solve. Clean the house first; bring in the tools second.