KEY TAKEAWAYS
- A 40-person Toronto financial planning firm reported sharply shorter month-end reporting after rolling out Microsoft 365 Copilot and Power Automate.
- Three workflows were automated in 90 days, and the governance framework was signed off by the compliance team before the first licence was assigned.
- The order matters: pick measurable workflows first, write the data rules second, switch the tooling on third.
Mike Pearlstein is CEO of Fusion Computing and holds the CISSP certification. He has led Fusion’s managed IT and cybersecurity practice since 2012, serving Canadian businesses across Toronto, Hamilton, and Metro Vancouver.
AI implementation for small business works when you start with specific, measurable workflows instead of switching AI on across everything at once. This 40-person Toronto firm automated three workflows in 90 days. The firm reported sharply faster month-end reporting. The compliance team signed off on the data rules before Microsoft 365 Copilot touched a client file.
Introduction
A 40-person Toronto financial planning firm automated three workflows in 90 days. The firm reported sharply faster month-end reporting. The firm started with the tasks where manual effort and output were furthest apart, then wrote the governance rules, then switched on Microsoft 365 Copilot. Source: outcomes as reported by the client to Fusion Computing during the engagement, 2026.
The firm wanted practical AI gains without gambling with client data, compliance, or a six-figure experiment. Fusion Computing deployed Microsoft 365 Copilot and Power Automate with the governance layer built first.
I sat in on the first discovery session, and my opening question had nothing to do with AI. I asked what the month-end close actually looked like, hour by hour. That is where the answer was.
This case study covers a real Fusion Computing engagement. Client details have been anonymized at the firm’s request.
The challenge
Leadership had sat through three vendor presentations about AI. Each assumed the firm had a dedicated IT team, a data lake, and a six-figure budget. The firm has 40 people and a bookkeeper. Nobody had answered the question that actually mattered: where is time being lost today, and can AI recover it without creating a compliance problem?
For a financial planning firm handling client portfolios, investment records, and personal financial data, moving fast and sorting the rules out later was not an option. Leadership needed a partner who could find where AI created real gains, put the Copilot controls in first, and prove the return inside a quarter.
The hesitation was normal, and the market has moved since. Statistics Canada reports 19.2% of Canadian businesses used AI to produce goods or deliver services in the 12 months to Q2 2026, up from 6.1% two years earlier. Professional, scientific and technical services sit at 32.4%, well ahead of the national average.
What is Copilot governance, explained in plain terms
Copilot governance is a short list of rules. They decide what the assistant may read, who may use it, and what gets checked before output leaves the firm. In practice it is four things: a written data-classification policy, Microsoft Purview sensitivity labels with matching data-loss-prevention rules, access scoped group by group, and a human review step on anything client-facing.
Copilot answers using whatever a signed-in user can already reach through Microsoft Graph. That is the design. It also means an over-shared folder becomes an over-shared answer.
The risk is not theoretical. In January 2026 Microsoft detected a code defect (Service Health advisory CW1226324) in which Copilot Chat summarized email in Sent Items and Drafts despite a sensitivity label and a DLP policy being in place, and shipped a fix in February. Labels are necessary. They are not sufficient on their own.
“We’d been to three different vendor presentations about AI, and every one of them started with the technology. Fusion started with our workflows. For the first time, AI felt like a practical business decision, not a buzzword. They helped us move fast without losing sight of client confidentiality or the controls we needed.”
Rachel D., Managing Partner, Financial Planning Firm, Toronto
Fusion Computing’s strategic solution
Fusion Computing started with workflow impact rather than tooling. Under CISSP-led direction, the team mapped where the firm lost the most hours to repeatable manual work, chose three targets, and wrapped controls around Microsoft Copilot before any AI tool reached production data. Our engineers found that compliance sign-off, not licence count, set the real pace of the rollout.
Weeks 1 and 2: workflow discovery
Fusion interviewed teams across the firm’s four departments, advisory, operations, compliance, and administration, to map which workflows consumed the most staff hours relative to their complexity. The goal was not the most impressive AI demo. It was the widest gap between effort and output.
Three targets emerged:
- Month-end reporting. Two full days of manual data consolidation, formatting, and review across several systems.
- Client meeting preparation. Advisors spent roughly 45 minutes per client assembling portfolio summaries, recent correspondence, and market context.
- Compliance document review. Quarterly reviews meant cross-referencing regulatory checklists against client files by hand.
Weeks 3 and 4: the governance framework
Before any AI tool touched client data, Fusion built a framework the compliance team could live with. This is the failure mode I look for first: tools go live before the rules exist, and by the time anyone notices client data flowing into a model, the guardrails are too late.
Month 2 onward: deployment and measurement
Copilot went to leadership and senior advisors first, with training and usage guidelines. Power Automate then pulled data from the portfolio management system into standard report templates. We measured time saved per cycle, error rates before and after, and user adoption, and reported the numbers to the managing partner every month.
What a safe Copilot rollout needs: the governance criteria
Four control layers went in before activation, and they are the criteria we apply to every Canadian professional-services rollout. Written data classification. Microsoft Purview sensitivity labels with matching data-loss-prevention policies. Access scoped one user group at a time. A human review step on any AI-drafted output that reaches a client.
- Data classification. Which client data Copilot could process, which it could not, and where the line sat between internal operational data and regulated client information.
- Sensitivity labels and DLP. Microsoft Purview sensitivity labels were applied to client-facing documents, with Data Loss Prevention policies configured so labelled content stayed out of Copilot processing.
- Phased access scoping. Copilot reached one user group at a time, never the whole firm on day one.
- Output review. AI-drafted content that would reach a client required human review before it left the firm.
Results and Copilot ROI
Within 90 days the firm had measurable savings across three departments, a governance framework its compliance team could defend in an audit, and a shortlist of what to automate next. The clearest change the firm reported was month-end reporting, which got sharply faster per cycle.
- Month-end reporting got sharply faster, recovering meaningful staff time each quarter for client-facing work, as reported by the firm.
- Client meeting preparation got materially faster. Across a busy quarterly meeting schedule, the firm reported meaningful recovered advisory time.
- The compliance review cycle shortened, as reported through the firm’s monthly review.
- No governance incidents were reported through the monthly review in the first 90 days. Tenant boundaries and data-loss prevention were configured and verified per service, and no boundary violations were detected in that period.
How does that compare with the published benchmarks? A Forrester study commissioned by Microsoft projects three-year ROI of 132% to 353% for SMBs. Licensing is the smaller half of the sum. Microsoft 365 Copilot Business lists at CA$24.43 per user per month on an annual commitment, a promotional rate Microsoft publishes through September 30, 2026.
Leadership also came away with a repeatable way to judge the next AI proposal: workflow impact first, vendor claim second. That is the part a partnership meeting can actually vote on.
Copilot vs Power Automate: which tool does which job
Microsoft 365 Copilot is an assistant inside Word, Excel, Outlook, and Teams, and it earns its keep on knowledge work that a person still reviews. Power Automate handles the structured, repeatable part of the same job. The month-end win here came from using both, not from choosing between them.
In this engagement, Copilot summarized past client correspondence and drafted pre-meeting notes. Power Automate pulled portfolio data into the standard report template and routed the compliance review tasks. Firms that buy only the assistant tend to stall where a human still moves data by hand. If that sounds like your month-end, talk to our team before you buy licences.
The same split shows up in our sector guide to AI for Canadian professional services firms and in the head-to-head on Copilot vs ChatGPT vs Claude. If you want the 12-month sequencing view, the AI implementation roadmap covers governance gates and the pilot-to-vertical pivot in one plan.
Why this mattered
For a regulated professional-services firm the win was never only faster reporting. It was proving that AI could be adopted safely, in stages, with accountability from day one. That is the version of the story that survives an audit, an insurer questionnaire, and a partner who was skeptical in January.
Gartner’s Key Insights From the 2025 Microsoft 365 and Copilot Survey (June 2025) puts it plainly: Copilot keeps improving, and large-scale adoption remains uncertain. Sequencing is what moves a firm from the second half of that sentence to the first.
AI became a controlled productivity layer at this firm instead of an unmanaged experiment. That is a smaller headline than most vendor decks promise, and it is the one that held up 90 days later. I still point partners at this engagement when they ask me what a safe rollout looks like at their size.
Want to know where AI creates real gains in your business without creating governance problems? Fusion Computing has run Microsoft 365 and security work for Canadian firms since 2012 under CISSP-led leadership. Talk to a senior engineer about your workflows before anything is switched on. Call 416-566-2845 or get in touch with our team.
There is also a downloadable PDF version of this case study. Compare it to the cannabis-retail governance build, the co-managed construction engagement, and the Prolift startup launch. Browse all case studies for the full set.
Frequently asked questions
These are the four questions I get asked most often once a Toronto or Hamilton firm has decided that a Copilot rollout is worth costing out. Each answer reflects how this specific engagement ran, not a generic product description, so use them to check whatever proposal is currently sitting on your desk against how a real engagement ran.
How long does a Microsoft Copilot deployment take for a 40-person firm?
This engagement ran 90 days from assessment to measured production. Weeks 1 to 4 covered workflow discovery, workflow prioritization, and the governance framework. Month 2 put Copilot in front of leadership and senior advisors. Months 2 and 3 added the Power Automate flow and the monthly measurement report.
What governance controls go in before Copilot touches client data?
Four layers. A written data-classification policy, Microsoft Purview sensitivity labels with matching DLP policies, access scoped one user group at a time, and mandatory human review of any AI-drafted output that reaches a client. Fusion has been CISSP-led since 2012; this four-layer baseline is how that governance is applied to current Microsoft 365 Copilot rollouts.
What is the difference between Copilot and Power Automate?
Microsoft 365 Copilot is an AI assistant inside Word, Excel, Outlook, and Teams for knowledge work. Power Automate handles structured, repeatable process automation. This engagement used both: Copilot for drafting and summarizing, Power Automate for pulling portfolio data into 1 standard report template.
Is this method replicable for other Canadian SMBs in regulated sectors?
Yes. Workflow discovery, then governance, then phased rollout with measurement is sector neutral. Fusion adapts the same three-step pattern for regulated Canadian SMBs and maps the controls to the privacy rules that apply to the client and province, including PIPEDA, PHIPA, and British Columbia’s PIPA.
