Copilot Data Exposure Checklist for Law Firms

Microsoft 365 Copilot does not usually create law-firm data exposure from nothing.

It reveals and accelerates whatever access model already exists.

For law firms, that matters because matter files, client correspondence, internal strategy, draft advice, HR records, pricing documents, and historic workspaces often sit inside the same Microsoft 365 environment.

Use this checklist before a pilot, before wider rollout, or when partners start asking what Copilot can see.

1. Confirm The Rollout Scope

Start with the business decision, not the licence count.

Record:
- Which practice groups or teams are in scope
- Whether Copilot is pilot-only or moving to broader rollout
- Which Microsoft 365 apps are included
- Which client or matter workflows users expect to support
- Who owns the go or no-go decision

If the scope is vague, the risk review will be vague too.

2. Identify Sensitive Content Locations

List the places where sensitive legal material may live.

Check:
- Matter folders and document libraries
- Teams workspaces
- SharePoint sites
- OneDrive shared folders
- Shared mailboxes
- Historic archives
- Board or partnership papers
- HR and performance records
- Pricing, proposal, and strategy documents

The question is not only whether the content exists. It is who can access it and whether Copilot-enabled users can summarise it.

3. Review Oversharing Patterns

Copilot follows permissions. That means inherited access, broad groups, and old sharing links become governance risks.

Look for:
- Everyone or all-staff groups with broad access
- Practice-wide groups that include people outside the matter team
- Old external sharing links
- Inherited permissions that no one has reviewed
- Guest users retained after matters close
- Sensitive files stored in general-purpose sites
- Teams channels created for convenience but never cleaned up

Oversharing does not need to be malicious to become serious.

4. Define Prohibited And Restricted Copilot Use

Staff need clear rules before rollout.

Decide whether Copilot can be used for:
- Drafting or summarising client material
- Reviewing matter documents
- Preparing advice outlines
- Summarising meetings or calls
- Searching historic matters
- Producing client-facing content
- Analysing confidential correspondence

For each restricted use, state who can approve it and what human review is required.

5. Check Client Confidentiality Controls

Law firms should be able to explain how client information is protected when AI assists work.

Review:
- Whether client terms or engagement letters mention AI use
- Which matters prohibit AI-assisted processing
- How confidential information is labelled or classified
- Whether staff know what must not be prompted
- How AI-assisted drafts are reviewed before use
- Whether exceptions are recorded

This checklist is governance and cyber risk guidance. It is not legal ethics advice.

6. Test Evidence, Not Assumptions

A good readiness review should produce evidence the firm can inspect.

Useful evidence includes:
- Permission reports
- Sample workspace structures
- Screenshots of sharing settings
- Data classification or sensitivity label coverage
- AI acceptable-use policy
- Incident and exception process
- Pilot user list
- Training or briefing materials
- Ownership for each high-risk finding

If a control cannot be evidenced, treat it as unproven.

7. Prepare A 30/60/90-Day Roadmap

The outcome should be a practical sequence, not a long list of concerns.

Typical actions include:
- Remove broad access from high-risk repositories
- Define Copilot-approved use cases
- Update AI acceptable-use rules
- Clarify matter-level approval rules
- Review external sharing and guest access
- Create a Copilot risk register
- Brief partners and pilot users
- Set review checkpoints before expansion

When To Escalate To A Review

A focused readiness review is useful when:
- Copilot rollout is planned but permissions have not been reviewed
- Matter data is spread across Teams, SharePoint, OneDrive, and mailboxes
- Partners want productivity gains but risk owners lack evidence
- The firm has no AI acceptable-use policy
- The firm cannot explain which client information Copilot-enabled users can access

For a structured review, see the Copilot Readiness Review for Law Firms.