Microsoft 365 Copilot for Rostering and Admin

The situation

A small community services organisation running disability and family support programs noticed staff were spending two to three hours a week on administrative tasks that felt ripe for AI assistance: drafting rostering emails, updating policy documents, and writing up notes from team meetings. They already had a Microsoft 365 subscription, which included Copilot at no additional cost.

The catch was that nobody had decided whether or how staff should use it.

What they did

The organisation took a governance-first approach. Before any staff were encouraged to use Copilot, the CEO brought the question to the board: what should our policy be?

The board approved a one-page acceptable-use policy covering what Copilot could be used for (drafting, summarising, formatting), what it could not (client case notes, anything involving names or sensitive personal information), and who to speak to if unsure. The policy was written in plain language and distributed to all staff.

They also created a simple register — a spreadsheet — to track which AI tools staff were using and for what purposes. And they added a standing item to the board agenda: a quarterly AI use review, ten minutes long, to check whether the policy was still fit for purpose.

What it cost

Zero additional cost. Microsoft 365 Copilot was already included in the organisation's existing subscription. Drafting the policy and setting up the register took roughly half a day of management time.

What the board did

The board reviewed and approved the acceptable-use policy before any AI use began. This is the governance action many organisations skip — deploying tools first, then scrambling to catch up with policy. Setting the framework before use started meant staff had clear guidance from day one.

The quarterly review item means the board sees AI use as an ongoing governance responsibility, not a one-off decision.

The outcome

Staff now save two to three hours per week on administrative tasks. The policy has been updated once — a staff member raised a question about whether Copilot could be used to summarise external emails that referenced client details, and management brought the gap back to the board for a policy clarification.

No incidents have occurred. The register gives the board confidence that AI use is visible and bounded.

Lessons for directors

• If your organisation already uses Microsoft 365, Copilot may already be available. Ask management whether it is active and who can access it.
• A one-page acceptable-use policy approved before deployment is infinitely more useful than a comprehensive policy written after an incident.
• A standing quarterly agenda item for AI review costs almost nothing and sends a clear signal that the board takes ongoing oversight seriously.