Copilot read every document in seconds. Including the ones it shouldn't have.

What they asked for

"Enable Copilot so our fee-earners can draft and review documents faster."

Not a drafting-speed problem, a confidentiality problem. Copilot answers from whatever a user can already reach, and in a firm with loose permissions and unlabelled documents, faster would have meant faster exposure of privileged material.

Govern first, then accelerate. Copilot could only be trusted to draft once it could see only what each fee-earner is entitled to see.

The situation

A law firm came to us with a straightforward-sounding ask: switch on Microsoft 365 Copilot so fee-earners stop losing hours to drafting, summarizing and reviewing documents. The productivity case was obvious. The risk underneath it was not.

Copilot does not reach into some separate, safe corpus; it answers from precisely what the signed-in user can already open, using the firm's own permissions. And this firm's document estate had accreted over decades: matters upon matters, with folder permissions nobody had audited in years. Switching Copilot on against that estate would not create a confidentiality problem so much as expose the one that was already there, instantly, at the speed of search. The task was never really about drafting. It was about making the firm's own documents safe for an AI to read.

What we found

Our diagnostic surfaced three compounding issues.

Copilot sees what the user sees. Over-broad historical permissions meant a fee-earner could already reach matters they had no business in, and Copilot would simply make that reach instant and searchable.

Nothing was labelled. Privileged, client-confidential and general documents were indistinguishable to the system, so there was no way to instruct Copilot on what to treat with care or leave untouched.

Ethical walls were manual and leaky. The separations between conflicting matters lived in people's heads and folder conventions rather than in enforced technical policy, so nothing actually stopped cross-matter exposure once search got fast.

The prize is real. Legal teams adopting Microsoft 365 Copilot report saving on the order of ~4 hours per fee-earner each week on document-heavy work (faster drafting, summarizing and first-pass review), and Clifford Chance, one of the world's largest law firms, describes Copilot freeing its lawyers to spend more time on the deeper, value-added insight and strategic input that matters to clients. But in a law firm those hours are only bankable if every answer respects privilege and the ethical wall. Speed without governance isn't a productivity gain, it's a malpractice risk. (Source: Microsoft 365 Copilot customer stories, Legal.)

What we did

Label before you launch. Microsoft Purview sensitivity labels classify matters and documents (privileged, client-confidential, internal) so for the first time the system itself understands what each document is and how it must be handled, rather than treating a privileged advice note and a stock template as the same thing.

Right-size what Copilot sees. We tightened the over-broad historical permissions and expressed the firm's ethical walls as enforced policy, so Copilot draws only on what a given fee-earner is genuinely entitled to see, and cross-matter exposure is blocked by design, not by memory.

Then accelerate the fee-earner. With the estate labelled and permissions trimmed, we enabled Copilot for drafting, summarizing and first-pass contract review inside Word, Outlook and Teams, and coached fee-earners on prompts that hold up to a lawyer's scrutiny, so the output is a genuine first draft to build on, never a final answer to trust blindly.

How we rolled it out

We didn't boil the ocean. We governed and piloted with a single practice group, proved that Copilot returned only permitted material and that fee-earners genuinely got hours back, then extended the labelling and rollout practice group by practice group, keeping risk, IT and senior fee-earners in the build, so the controls matched how the firm actually protects client confidence.

The shift

Where a fee-earner's week goes changes with it: roughly four hours move from document drafting, summarizing and review to higher-value advisory and judgment once first drafts and reviews are compressed.

Outcomes

• ~4 hours per week per fee-earner: drafting, summarizing and first-pass review compressed.
• First draft in hours, not days: blank page to a reviewable first draft, before a lawyer's judgment takes over.
• 100% of matters governed: every document classified and every Copilot answer permission-trimmed, so the speed is safe to use.

The win wasn't teaching Copilot to draft. It was making it safe to let Copilot near a law firm's documents at all.

An illustrative engagement. The scenario and figures are representative, drawn from outcomes across comparable Microsoft 365 Copilot and Purview deployments, not the audited results of a single named client.