How to Clean Up Your Company Files Before Turning on AI

When business owners ask us about preparing their data for AI, they usually assume the work involves data science. They imagine hiring specialists to structure spreadsheets or rewrite policy manuals into machine-friendly formats.

In reality, data preparation for a business with 20, 80, or 150 staff is much simpler and far more urgent. It is about access control and digital hygiene.

If you roll out Microsoft Copilot or a similar workspace assistant tomorrow, the software will not hallucinate your directors' salary data out of thin air. It will find it because someone saved `Salaries_2024_Final.xlsx` in a SharePoint folder that was set to "Anyone in the organization can view" three years ago.

Search engines in your company intranet used to require an exact match or an inquisitive employee actively digging through nested folders. Generative AI is different. An employee can simply type, "Summarise recent management discussions about staff restructuring," and the system will gladly synthesise notes from an unprotected meeting document.

Before you spend thousands on software licenses, you need to clean up your estate. Here is how to tackle that work pragmatically, without grinding your business to a halt.

Understand the over-sharing problem

Most small and medium businesses have lived in Microsoft 365 or Google Workspace for years. During that time, convenience almost always took priority over governance.

A project manager needed quick input from a contractor, so they generated an open link. A finance administrator wanted to share a budget template, so they stored it in a top-level company documents library. Over time, folder trees became tangled, projects finished without being archived, and permissions accumulated like sediment.

AI tools surface information based on what the logged-in user is technically allowed to read. They do not care about social conventions, polite boundaries, or assumed confidentiality. If a user has read access, the AI will use that content to answer their questions.

The goal of data cleanup is not perfection. You do not need to rewrite your company handbook or organise every customer folder into an aesthetic hierarchy. Your real goal is simple: ensure that sensitive information is strictly ring-fenced, and that outdated information does not mislead the software.

Map and isolate your three danger zones

You do not need to audit every file in your business at once. Doing so is an administrative trap that leads to abandoned projects. Instead, start by identifying the three specific categories of files that present genuine legal, financial, or cultural risk if exposed:

• HR and payroll: Staff contracts, salary reviews, disciplinary records, redundancy planning, and medical notes.
• Executive and financial: Management accounts, cash flow projections, board minutes, banking details, and acquisition or merger discussions.
• Client and commercial: Pricing models, unreleased intellectual property, supplier contracts, and regulated personal data (such as passport copies or credit details).

Locate where these three buckets of information currently live. In many companies, fragments of these files are scattered across personal OneDrive folders, legacy network drives, and general team channels.

Your first operational move is to establish private, restricted-access document libraries specifically for these topics. Move the files there immediately, break any inherited open permissions, and strictly limit access to the exact individuals who require it for their daily jobs.

Cull the redundant, obsolete, and trivial

Once sensitive data is locked down, your second priority is accuracy. An AI tool is only as reliable as the material it reads. If you have seven different documents titled "Health and Safety Policy" spanning 2017 to 2024, the assistant may quote the 2018 rules to a new starter.

Information managers call this ROT: Redundant, Obsolete, and Trivial data. Dealing with it does not require deleting your company history; it requires moving old working files out of the active working environment.

• Redundant: Multiple copies of identical files saved in different folders by different staff members.
• Obsolete: Project plans from completed jobs, old internal phone lists, superseded policy versions, and drafts marked "v12_FINAL_johns_edit".
• Trivial: Social club spreadsheets, lunch orders, and internal event planning notes that carry no long-term business value.

Create an archive location that is excluded from everyday indexing, or move old project directories into cold storage. If your team is unsure whether a completed project file from four years ago can be deleted, archive the entire folder. Removing it from the active search path prevents the AI from presenting outdated project margins or old commercial terms as current facts.

Replace link-sharing with group-based permissions

One of the worst habits in modern offices is the casual use of the "Share" button. When staff want someone to review a file, they often click share and select "People in your company with the link can edit."

This creates a hidden permission layer. The file still looks like it sits inside a restricted subfolder, but a backdoor has been opened for every single employee who happens to query the system for related keywords.

To fix this, you need to re-establish structure using groups rather than individual file links:

• Turn off company-wide open links by default in your tenant administration settings.
• Group folders by functional department (such as Operations, Sales, or Client Delivery).
• Assign access via role-based groups (for example, "Finance Team" or "Sales Team") rather than adding named individuals one by one.
• Instruct staff to share files by mentioning colleagues within the relevant team channel rather than creating bespoke sharing links.

This sounds like standard IT housekeeping because it is. Generative AI does not introduce new technical risks; it accelerates and exposes the poor security practices you were already tolerating.

Run a pilot test with a restricted user profile

Before you buy licenses for your wider team, you should run a controlled permission test. This does not require expensive audit software.

Set up an account with standard, non-administrative privileges, equivalent to a junior employee or a customer service agent. Sit down at a machine logged into that account and search your document libraries for terms you know exist in your company, such as:

• "Remuneration"
• "Restructure"
• "Gross margin"
• "Confidential"
• "Appraisal"

If that test account can see files containing those words, your permissions are misconfigured. Fix those specific document libraries before you turn on an AI assistant that can read, extract, and summarise those files in seconds.

Next steps

Cleaning up your files can feel overwhelming if you try to fix a decade of digital mess in a single weekend. You do not need an immaculate file share to benefit from AI; you just need to ensure your confidential data is actually confidential, and your primary operational folders reflect how your business operates today.

Begin by identifying your executive and HR folders this week. Check their inheritance settings, confirm who has access, and close the open links. Once your boundaries are secure, you can introduce AI tools with confidence rather than anxiety.