AI readiness · governance, IT and Microsoft 365 · 2026
How ready is your business for AI, really?
Fusion Computing's AI readiness assessment shows how AI reaches your data and your decisions: the AI tools your staff already use, the AI features vendors switched on inside software you pay for, and the Microsoft 365 controls underneath. It is a paid, CISSP-led assessment for firms in Canada and the United States.
- Governance evidence: an approved-tool register, named owners and review of AI-assisted decisions
- AI inventory and vendor or agent risk, using the tenant, endpoint, browser and network signals available in scope; coverage gaps recorded
- Microsoft 365 controls: Purview labeling, data posture, Entra access and audit evidence, with findings mapped to NIST AI RMF and ISO/IEC 42001
Free 60-minute scoping call, then a fixed fee quoted in writing before any work starts. Delivered remotely to Canadian and US organizations. Led by Mike Pearlstein, CISSP, MSc Computer Science (AI); a senior consultant aims to reply within one business day.
Twelve questions across governance, the AI running in your estate, and your Microsoft 365 controls. You see the score before we ask for an email.
Why teams book the assessment
CISSP-led
Led by Mike Pearlstein, CISSP, MSc Computer Science (AI)
Since 2012
Supporting Canadian businesses
Canada and the US
Delivered remotely, governance through to tenant configuration
Frameworks
Findings mapped to NIST AI RMF and ISO/IEC 42001
Free, no email until you see the score
Score yourself first
Free self-check
Twelve questions about governance, your IT estate and Microsoft 365. Your answers produce a weighted score, ranked gaps and a 30/60/90-day plan.
Paid assessment
We review the records and systems named in your statement of work and record evidence gaps. A free 60-minute scoping call comes first, with the fixed fee and deliverables agreed in writing.
Tell us about your business
Three quick questions to size your report and pick the right regulatory set. Not scored.
Why it matters now
Your staff are already using AI
Staff bring it in, and vendors switch it on inside software you already pay for. The assessment starts from what is already happening.
“When a staff member pastes a file or a question into the free ChatGPT or the free Copilot, those prompts and files can be used to train the next AI. And when that person leaves, because it's their personal AI, all that history leaves with them. We don't own that, and we can't maintain it or control it.”
According to Microsoft and LinkedIn's 2024 Work Trend Index, 78% of AI users bring their own AI tools to work, and the share rises to 80% at small and medium-sized companies. The survey covered 31,000 people across 31 countries. Personal AI accounts may be missing from your licence inventory. We check which tenant, endpoint and browser controls can observe or restrict their use.
According to KPMG in Canada's 2025 survey of 2,239 employees, 51% of Canadian employees use generative AI tools at work, up from 46% in 2024. With half of Canadian employees already using these tools, an approved-tool register and a named owner for each tool are the first controls to put in writing.
According to Statistics Canada's 2026 analysis of business AI use, 27.8% of businesses with 100 or more employees used AI in the 12 months before mid-2026. Across all businesses, 13.4% named cybersecurity or privacy concerns as a barrier to using it. An assessment turns that concern into a written list of the specific controls to check.
Who it is for
Book it when AI is real on your roadmap
The assessment fits businesses with 10 to 150 employees. Microsoft 365 is where we go deepest; the review also covers the other systems named in scope. These are the four decision points where it earns its fee.
Pricing a Copilot rollout
You are budgeting licences and want the labeling and permission work costed before the seats are committed.
Shadow AI is already happening
Staff are using ChatGPT, Claude or DeepSeek on personal accounts and you have no record of what has left the tenant.
A client or insurer asked
A security questionnaire wants your AI controls in writing and may require evidence beyond a vendor self-attestation.
You operate across the border
Canadian and US obligations differ. We work from one technical control baseline and map the jurisdiction-specific requirements separately.
How it works
How the assessment works
The scoping call is free and the fee is fixed in writing before any work begins. What you decide afterward is your call.
1. Free 60-minute scoping call
We confirm tenant size, jurisdiction, which AI tools are in play, and what your licences already cover. You get the fixed-fee quote in writing before anything starts.
2. Technical review
Read-only review across the three evidence sets fixed in the statement of work. Where a vendor, device or workflow does not expose usable evidence, we record that as a coverage gap rather than treating absence of evidence as absence of AI. Where tenant signals already exist we read them rather than surveying you. Where discovery was never switched on, the report says so and specifies what has to be enabled before useful history can be collected.
3. Report and walkthrough
A board-ready readout with the ranked findings, the remediation roadmap, a licensing recommendation and a go/no-go call. Your written quote sets the delivery schedule after scoping.
What we assess
Governance, AI use and Microsoft 365
A policy review and a Microsoft 365 tenant scan answer different questions. Neither tells you about the AI your accounting software switched on last quarter, or who signed off the decision it made. We review three evidence sets: governance and decision records made available in scope, AI-use and integration evidence from the systems, admin portals and records named in the statement of work, and Microsoft 365 controls. We score what can be evidenced and record the coverage gaps separately.
Governance and accountability
Who approves an AI tool, what the approved-tool register contains, how exceptions are granted, and what happens when someone uses something that is not on the list. We check that the policy names a decision-maker rather than a department, because an unowned policy is not a control.
AI-assisted decisions and human review
Where AI already touches decisions about people, money or safety, and who reviews the output before it counts. This is where governance becomes testable: who reviews the output, who can override it, and what gets recorded.
Vendor and third-party AI
The AI features your existing vendors switched on inside software you already pay for, and what their terms say about your data. AI can arrive inside software you already license without a separate AI purchase, so it may never appear in a dedicated AI procurement record.
AI inventory and shadow-AI discovery
Which AI tools the in-scope tenant, endpoint, browser and network signals show your people using, licensed and unlicensed. Contractor and unmanaged-device activity is included only where an instrumented signal path can observe it, and the report records the coverage gaps separately. Microsoft Purview discovers browser activity against sites categorised as Generative AI in the Defender for Cloud Apps catalog, a published list that includes chatgpt.com, claude.ai, gemini.google.com, copilot.microsoft.com and deepseek.com. We check whether that discovery is switched on at all, and we say where uninstrumented use stays invisible.
Agents, connectors and integrations
The agents, connectors and integrations wired into your systems, each with a named owner and scoped permissions, plus any AI-generated scripts running unreviewed. Microsoft creates an Entra Agent ID for new Copilot Studio agents created after the May 2026 rollout and attaches connector permissions when the agent is published, while older agents may still run on app registrations until they are migrated. We inventory both forms.
Microsoft 365 controls and evidence
Where Microsoft 365 decides the outcome, we go deep. We check whether a usable Purview label set exists and auto-labeling carries it, and we review Data Security Posture Management (DSPM) and its oversharing risk assessments. We check Entra roles and Conditional Access scoped to AI applications, and whether prompts and responses are audited, retained and searchable.
Where the controls differ by AI tool
Your AI controls are not the same on every tool
Microsoft Purview governs Microsoft 365 Copilot and third-party AI sites through different mechanisms, and the difference decides where your exposure sits.
For third-party AI sites reached through a browser, Microsoft's own documentation lists sensitivity labels and label-free encryption as unsupported. Classification, data loss prevention, auditing and insider risk are supported, and eDiscovery of prompts and responses is limited to Edge and the four named apps described below. The controls you rely on inside Copilot are a different set from the controls available when someone opens ChatGPT in a browser tab.
Claude is the clearest example of why the tool name is not the unit of analysis. Browser activity on claude.ai runs through the supported-site path. Claude Enterprise is governed on a separate connector-based path.
The Anthropic Claude connector, which Microsoft lists as in preview, uses Anthropic's Compliance API to pull activity and chat data into Purview. On that path Purview supports auditing, classification, insider risk and eDiscovery, while sensitivity labels, label-free encryption and data loss prevention are unsupported. Two deployments of the same vendor, two different control sets.
On the browser-based path, Microsoft restricts retention, eDiscovery and communication compliance to the Edge browser and to four named apps: ChatGPT, Microsoft's consumer Chat, Google Gemini and DeepSeek. Separate network data security integrations can capture and retain AI interactions outside that path, with their own licensing and prerequisites.
Most of the third-party AI capabilities need the Purview browser extension deployed and devices onboarded to Purview, and Microsoft documents that managing these AI interactions requires pay-as-you-go billing enabled on the tenant.
Endpoint policies that warn or block a paste into an AI site need Windows or macOS devices onboarded first, and they sit behind a Purview licence tier rather than being included everywhere. Scoping confirms what your existing licences already cover, and we say so when the answer is that you own what you need already.
Canada and the United States
Nobody is going to hand you the rulebook
Neither Canada nor the United States has a single omnibus federal AI statute. The rules that bind you still arrive through privacy, sector, state and provincial law. An inventory, a classification baseline, scoped access and logs are useful readiness evidence in both, and they do not replace the duties that apply to you specifically. During scoping we identify the regulatory and framework set proposed for the engagement, and the statement of work names the specific frameworks we will map technical findings to. Your legal counsel determines which legal duties actually apply.
Privacy law carries most of Canada's AI load
The Artificial Intelligence and Data Act (AIDA) was left unfinished when the 44th Parliament's first session ended on 6 January 2025. Canada's AI for All strategy, launched 4 June 2026, did not propose an omnibus AI statute and says the government will modernize privacy and online-safety laws instead. Obligations keep arriving through the laws that apply to your organization and your data. They include the Personal Information Protection and Electronic Documents Act (PIPEDA) where applicable, Quebec's private-sector law as amended by Law 25, the Alberta and BC Personal Information Protection Acts (PIPA), and health privacy statutes such as Ontario’s PHIPA. Bill C-36 was introduced 15 June 2026 and remains before Parliament.
State by state, already live
The states did not wait. Texas TRAIGA and Illinois HB 3773 took effect 1 January 2026. Colorado SB 26-189, signed 14 May 2026 and effective 1 January 2027, covers automated decision-making in consequential decisions and asks for more than disclosure: developer documentation, retained records, consumer notice, correction rights, and meaningful human review in specified cases. The federal framework of 20 March 2026 asks Congress to preempt state AI laws that impose undue burdens. It is a recommendation to Congress, so we assess the state laws that actually apply to your organization.
NIST AI RMF
AI RMF 1.0 carries no statutory mandate in either country. We use its Govern, Map, Measure and Manage functions to organise findings in a consistent shape that crosswalks to whatever framework your counterparty asks about next.
The certifiable one
Published in December 2023, ISO/IEC 42001 was the first international AI management system standard. Certification applies to the AI management system within its defined certification scope, covering policy, governance, measurement and continual improvement. This assessment contributes technical evidence toward that program rather than standing in for it.
Three facts that shape the review
What the published record says
A restricted app, a control that stops at the browser, and agents with their own identities. Each one changes what the assessment has to check in your tenant.
CBC News, 2025
DeepSeek is restricted on some federal devices
The federal chief information officer restricted DeepSeek on the government mobile devices Shared Services Canada manages, and recommended that other departments and agencies restrict it on government devices, citing the collection and retention of sensitive personal information. Reported by CBC News. Microsoft Purview lists deepseek.com among its supported AI sites, so a tenant with the required controls deployed can detect the usage and apply a data-loss policy. Retaining DeepSeek prompts and responses is documented for the Edge browser and needs a Purview collection and retention policy. The assessment tells you whether yours currently can.
Read moreMicrosoft Purview documentation, June 2026
Sensitivity labels are not a browser-AI control
For third-party AI sites reached in a browser, Microsoft lists sensitivity labels as unsupported. Its documented eDiscovery path covers only Edge interactions with ChatGPT, Microsoft's consumer Chat, Gemini and DeepSeek. Endpoint, browser and network controls are the path that can act on labelled content headed to those tools, and each has its own prerequisites.
Read moreMicrosoft Learn, Copilot Studio Entra Agent IDs, 2026
Agents now carry their own identity
Microsoft creates an Entra Agent ID for new Copilot Studio agents created after the May 2026 rollout, attaching connector permissions when the agent is published, and Entra entitlement management can govern agent identities through access packages. Microsoft licenses that scenario through specific Agent 365 and Microsoft 365 or Entra combinations rather than one product family, so we confirm your tenant's exact entitlement during scoping. Agents created before the rollout may still run on app registrations until migrated.
Read more
CISSP-led
Mike Pearlstein, CISSP, MSc Computer Science (AI), CEO of Fusion Computing
Microsoft's documentation says what each control path can support, and your tenant decides which path your staff use. Copilot honours the labels already on your content. Third-party AI sites in a browser do not support labels as an interaction control, though Endpoint DLP can still use a file's label to block an upload. The assessment maps those limits onto the tenant you run and says where coverage stops.
Frequently asked questions
What is an AI readiness assessment?
An AI readiness assessment reviews the controls that decide how AI reaches an organization's data and decisions, scored on what can be evidenced. Fusion Computing's version covers three layers: governance, including the approved-tool register and who reviews AI-assisted decisions; the AI already running in your IT estate, including vendor features, agents and shadow AI; and the Microsoft 365 controls underneath. Findings map to the NIST AI Risk Management Framework and ISO/IEC 42001.
Who provides an AI readiness assessment for businesses in Canada?
Fusion Computing, a Canadian-owned and CISSP-led IT and cybersecurity firm founded in 2012, provides a paid AI readiness assessment for firms in Canada and the United States. Mike Pearlstein, CISSP, MSc Computer Science (AI), leads the work. The tenant review is remote, and the report maps findings to the privacy, AI and sector frameworks identified at scoping. Your legal counsel confirms which duties apply.
Can Microsoft Purview control ChatGPT and Claude the same way it controls Copilot?
No. For third-party AI sites in a browser, Microsoft lists sensitivity labels as unsupported, and its documented eDiscovery path covers only Edge interactions with ChatGPT, Microsoft's consumer Chat, Gemini and DeepSeek. Claude Enterprise uses a separate Purview connector, in preview, which supports eDiscovery and leaves sensitivity labels and data loss prevention unsupported. We check the paths you use.
Do we have to buy Copilot first?
No. Running the assessment before you commit seats is the point. Copilot can surface any content the signed-in user is already authorised to access, and it does not bypass existing permissions. Some readiness features depend on your licences, so scoping checks your tenant's actual entitlement before you buy anything. Teams that already bought licences use the same findings to decide whether to widen the rollout or fix permissions first.
How is this different from the free Copilot Readiness Scan?
The free scan runs Microsoft's open-source engine against your tenant and reports on seven Microsoft 365 service areas. It is automated and focused on Copilot. This is the paid assessment, and it covers three layers: the governance you can evidence, the AI already running across your estate, including vendor features, agents and shadow AI, and the Microsoft 365 controls underneath. Run the scan first if you want a fast baseline.
Find out what your organization currently permits
Request a free 60-minute scoping call. We confirm the scope, quote a fixed fee in writing, and you decide from there. Commission the assessment and the report is yours to implement with us, with your own team, or with anyone else.