ProArch

The conversation in most boardrooms is still "how is the AI initiative going?" That framing is already wrong. The next two years will separate boards that governed AI from boards that watched it happen. Three things have to move now: the risk surface, the commercial model, and the workforce. Wrote about what I'm seeing from my own board seat and the ones I advise. #AI #BoardGovernance #EnterpriseAI #CEO #AIStrategy ProArch

Most organizations think Microsoft Purview starts with policy. It doesn’t. It starts with visibility. When we rolled out Purview internally at ProArch, the hardest part was not writing policies. It was slowing down long enough to understand how data was actually being used before trying to control it. So we did not start with enforcement. We started with reality. Where does data actually live? How is it actually shared? What behaviors exist because of convenience, legacy habits, and default settings? That was the real turning point. Most of what we found was not malicious. It was operational drift: 📍 Old SharePoint sites with broad access 📍 Teams with no clear ownership 📍 OneDrive links that never expired 📍 Email attachments still carrying more business process than they should That is how risk usually shows up. Not as a dramatic security failure. As the accumulation of normal business behavior over time. What worked best was not heavy enforcement. It was practical guardrails that improved behavior without disrupting work: • Sensitivity labels with smart defaults • DLP policy tips that coach instead of immediately block • A smaller label set than we originally thought we needed Good protection is often quiet. The best governance models are the ones the business can actually live with. Purview is not a one-time project, and it does not need to become operationally heavy. The real work is in reviewing trends, reducing noise, and making sure governance continues to match how the business actually operates. In hindsight, I would have done three things sooner: ✔️ Brought the business into label design earlier ✔️ Defined AI and Copilot governance earlier ✔️ Started with an even smaller, clearer label set AI made that even more obvious. AI did not create most data risk. It exposed and amplified the risk that was already there. That shifts the conversation from “Should we allow Copilot?” to “How do we govern data well enough to use it responsibly?” Purview is not just a compliance tool. It is part of the operating foundation for secure AI, better data governance, and responsible scale. If your Purview journey feels messy, that does not mean it is failing. It usually means you are finally seeing the environment clearly enough to govern it properly. #DataGovernance #MicrosoftPurview #AIReadiness #Copilot #LessonsLearned