Are your employees using Copilot with the right safeguards?

IT Desk can help your business prepare for Microsoft Copilot by reviewing permissions, data structure, security and suitable use cases. We can also support employee training and practical AI policies so teams understand how to check Copilot output and use it responsibly.

Why can Microsoft Copilot give a wrong answer?

Microsoft Copilot uses large language models to generate a response based on the user’s prompt and the context available to it.

These models generate likely and useful responses, but they do not possess guaranteed knowledge of every fact. They can produce information that appears convincing without being completely accurate.

Microsoft explicitly advises users to review and verify Copilot responses. Its guidance notes that a response can sound polished while still being wrong, incomplete or risky to use.

An incorrect AI-generated statement is sometimes described as a hallucination. This may involve:

• Inventing a fact, event or statistic

• Referring to a source that does not support the claim

• Misinterpreting a document

• Combining separate pieces of information incorrectly

• Giving an outdated answer

• Missing an important exception

• Making an incorrect calculation

• Presenting an assumption as a confirmed fact

Does Copilot know when it is wrong?

Not reliably.

Copilot may occasionally express uncertainty, but it can also present an incorrect answer in confident language. The tone of the response should therefore not be used as evidence of accuracy.

Employees should be particularly careful when an answer:

• Makes a surprising or unusually specific claim

• Includes statistics without a clear source

• Quotes someone without identifying the original document

• Gives legal, financial or compliance guidance

• Conflicts with the employee’s own knowledge

• Summarises a long or complicated document

• Recommends a significant business action

• Relies on information that changes frequently

A confident answer should still be checked if getting it wrong would matter.

Does grounding Copilot in company data prevent mistakes?

Grounding can make Copilot’s response more relevant, but it does not guarantee that the response will be correct.

Microsoft 365 Copilot can use information the employee is permitted to access through Microsoft 365. Depending on the feature and prompt, this may include documents, emails, meetings, calendars and other work content.

This helps Copilot produce answers based on the organisation’s own information. However, problems can still occur if the underlying content is:

• Out of date

• Duplicated

• Poorly labelled

• Contradictory

• Incomplete

• Stored without useful context

• Accessible to the wrong people

• Based on an old company policy

Copilot may accurately summarise an outdated document and still give the employee the wrong current answer.

Good data organisation, document ownership and permissions are therefore important parts of Copilot readiness.

Can Copilot use the wrong company file?

It can retrieve or refer to a document that is less relevant than the user expected, particularly where the organisation has several similar files.

For example, Copilot might find:

• An expired price list instead of the current version

• A draft policy rather than the approved policy

• An old proposal template

• A duplicate document stored in another location

• Meeting notes that do not represent the final decision

Employees should inspect the cited source and confirm that it is authoritative, current and appropriate for the task.

Businesses can reduce confusion by applying clear document names, ownership, review dates, archive processes and SharePoint governance.

Are Copilot citations always correct?

Citations are useful, but they should still be checked.

A citation may identify the document or webpage Copilot used when creating its response. It helps the employee trace the answer back to supporting information.

However, the presence of a citation does not automatically prove that:

• The source supports every statement in the answer

• The source is current

• Copilot interpreted the source correctly

• The source is trustworthy

• The source represents the company’s final position

Employees should open important sources and locate the relevant information rather than relying only on the citation label.

How should employees check a Copilot response?

The level of checking should reflect the consequences of an error.

A practical validation process includes:

1. Identify the factual claims. Separate verifiable facts from suggestions, opinions and writing assistance.

2. Open the sources. Confirm that cited documents contain the information Copilot claims they do.

3. Check the date. Make sure the source is current enough for the question.

4. Confirm important figures. Recalculate totals, percentages, dates and financial information.

5. Compare authoritative sources. Use official documentation, approved company records or qualified professional advice.

6. Check what is missing. Look for exceptions, risks or context that could change the conclusion.

7. Apply human judgement. Decide whether the response is suitable for the intended audience and action.

Microsoft describes validation as the step between receiving a Copilot response and trusting, sharing or acting on it.

Which Copilot tasks require the most checking?

All material output should receive an appropriate review, but extra care is needed for higher-impact activities.

These include:

• Legal documents or interpretations

• Financial forecasts and calculations

• HR decisions and employee communications

• Health and safety information

• Cybersecurity instructions

• Compliance and data-protection guidance

• Customer contracts

• Public claims and statistics

• Decisions affecting access to services

• Advice that could cause financial or physical harm

• Messages sent on behalf of senior employees

Copilot can help draft or analyse material in these areas, but it should not replace the appropriately qualified person responsible for the final decision.

Is Copilot safe for writing customer emails?

It can be useful for drafting customer communications, provided an employee reviews the message before sending it.

The reviewer should check:

• Names and contact details

• Prices and dates

• Product or service claims

• Promises and commitments

• Tone and wording

• Confidential information

• Attachments and links

• Whether the response answers the customer’s actual question

A fluent email can still include an unsupported promise or a detail copied from the wrong context.

Businesses should be especially cautious about processes that allow AI-generated messages to be sent automatically without an appropriate approval stage.

Can a better prompt stop Copilot making mistakes?

A clear prompt can improve the quality and relevance of the response, but it cannot guarantee accuracy.

A useful prompt should explain:

• The task

• The intended audience

• The relevant context

• Which files or information to use

• The desired format

• Any limits or requirements

• What Copilot should do if information is missing

For example, rather than asking:

“Write our customer update.”

The user could ask:

“Draft a 150-word update for existing customers using only the attached approved service notice. Include the confirmed implementation date and do not add any benefits or promises that are not stated in the source.”

The second prompt gives Copilot clearer boundaries. The resulting draft must still be reviewed.

Will asking Copilot the same question produce the same answer?

Not necessarily.

Generative AI can produce different wording or conclusions when the same or a similar prompt is entered more than once. The available context, selected sources, application and underlying service can also affect the response.

Repeatedly asking the question until Copilot gives the preferred answer is not a reliable validation method.

The answer should be checked against evidence rather than accepted because it matches what the user expected.

Should a business have a Copilot policy?

Yes. A business adopting Copilot should explain how employees are expected to use and review it.

The policy should cover:

• Approved Copilot tools and accounts

• Suitable and unsuitable use cases

• Information that may be entered

• Human-review requirements

• High-risk or restricted activities

• Customer-facing content

• Handling confidential information

• Source and citation checking

• Reporting inaccurate or harmful output

• Responsibility for final decisions

• Training and ongoing monitoring

Businesses may also decide to display AI disclaimers or link employees to their internal AI policy within supported Microsoft 365 Copilot applications.

A policy should help employees use Copilot productively—not simply tell them that AI can make mistakes.

Does an incorrect answer mean Copilot is not useful?

No.

Copilot can still save time when used for appropriate tasks, including:

• Producing first drafts

• Summarising information

• Reformatting content

• Suggesting ideas

• Preparing meeting notes

• Identifying themes

• Finding relevant work documents

• Improving the clarity of existing writing

The value comes from combining Copilot’s speed with employee knowledge and oversight.

The safest approach is to treat Copilot as an assistant that supports work rather than an authority that makes the final decision.