A practical, risk-based look at how councils prepare SharePoint for Copilot and AI, and what happens when they do not.
TL;DR
- For councils intending to use Copilot and AI safely, SharePoint cleanup is becoming a practical prerequisite, not just a tidy-up.
- AI readiness is now exposing long-standing information governance issues: duplicate content, unclear ownership, weak metadata and permission drift.
- Councils face higher stakes because information quality affects compliance, public accountability, security and user trust.
- AI tools retrieve and summarise content a user is already allowed to access; if that content is outdated, duplicated or over-permissioned, the answers can reflect those weaknesses.
- Councils do not need to fix everything at once. Start with high-risk, high-use and AI pilot areas, then improve governance progressively.
- Better content foundations lead to safer, more useful AI outcomes.
It’s not an AI problem first
Councils are excited about Copilot, agents and AI. But many are discovering that the hardest part is not deploying the technology.
It is dealing with 10, 15 or 20 years of policies, project files, working documents, records, permissions and legacy folders sitting underneath it.
AI readiness is becoming the forcing function for what is often long-deferred information governance work. AI can only draw on work with the content, permissions and governance structures already in place. If those foundations are weak, AI tends to expose the problem rather than solve it.
Microsoft explains that Microsoft 365 Copilot grounds responses using Microsoft Graph and accesses information according to the signed-in user’s permissions. In practice, this means poor content quality, weak ownership, outdated files and oversharing can become more visible once AI is introduced.
In a council context, SharePoint cleanup for AI is about fixing that foundation first. It is a structured, evidence-based program to make content safe, current, findable and authoritative.
Trusted content in leads to trusted answers out.
Why this matters more for councils
For most organisations, SharePoint cleanup improves productivity. For councils, it also affects compliance, public accountability and community trust.
Across Australia, councils operate within state- and territory-based recordkeeping, privacy, information access and public accountability obligations. While the specific legislation and retention authorities differ by jurisdiction, the underlying requirement is consistent: councils must be able to identify, manage, retain, secure and produce trustworthy information when required.
For example, each jurisdiction has its own approach to records retention, privacy and access to government information. The details vary, but the practical implication for councils is the same: information must be governed well enough to support service delivery, compliance, discovery, security and defensible decision-making.
If a council cannot clearly identify:
- Which document is authoritative
- Who owns it
- Who has access
- Where it sits in its lifecycle
then improving AI simply increases visibility of those gaps.
Microsoft guidance reinforces this point: Copilot operates within the Microsoft 365 service boundary, uses Microsoft Graph as part of grounding, and only accesses data the signed-in user is authorised to access. It does not, by itself, resolve which document is the organisational source of truth.
Many councils start a SharePoint cleanup because of AI, but the conversation often expands quickly into security and privacy.
That makes cleanup as much a security and information governance activity as an AI readiness activity. The more content an organisation retains without clear ownership, classification and access controls, the greater the risk that sensitive, outdated or low-value information more content may be surfaced, shared or exposed during a security incident. Councils are increasingly reviewing permissions, information classification, security labels and access models as part of their cleanup programs, recognising that AI readiness and information security are now closely connected.
That is why the conversation about SharePoint cleanup usually becomes very practical, very quickly.
What we see in council environments
When the WebVine team works with council clients, we see consistent patterns. The issue is rarely a lack of intent. Most councils understand the importance of information governance. The challenge is competing operational demands and years of content growth across SharePoint, file shares, intranets and records systems
In one recent engagement:
- Over 1,785 intranet pages were assessed
- Content spanned 70+ SharePoint sites
- Thousands of assets and legacy items required review before migration
In our experience, these numbers are not unusual for environments that have grown organically over time. They are also a useful reminder that AI readiness is not only about technology settings. It is about knowing what content exists, who owns it, whether it is current, and whether it should be available to the people and tools that can now discover it more easily.
The underlying issues usually fall into four areas.
- Content quality and authority - Duplicate policies, outdated procedures, reference material repeated across multiple sites, and uncertainty about which version should be trusted.
- Ownership and lifecycle - Content moved during migrations without clear business ownership, review cycles or decisions about whether it should be kept, updated, archived or deleted.
- Records boundaries - Working documents, records, drafts and long-term reference material mixed together, especially where SharePoint is used alongside a separate records management system.
- Permissions and metadata - Legacy access, broad sharing, weak classification and inconsistent metadata that make it harder for search and AI to prioritise the right information.
This is why cleanup has become a major AI readiness activity rather than just a migration activity. When millions of files or many years of accumulated content are involved, manually reviewing every document is not realistic. Councils need a risk-based approach that uses reporting, automation and business accountability to focus effort where it matters most.
The risk if nothing changes
Councils that skip this work tend to encounter the same outcomes.
- Signal gets lost in the noise – Councils often have multiple versions of the same information, decades of historical files and large volumes of reference material. AI may surface answers, but users still struggle to determine which information matters most.
- Confident but incorrect answers - AI summarises conflicting or outdated content without resolving which is correct.
- Oversharing becomes visible - Content that should no longer be widely accessible becomes easier to find.
- Compliance exposure - Weak records management makes it harder to demonstrate compliance with retention, privacy, information access and audit obligations with retention and access obligations.
- Loss of trust and adoption - Once users encounter a few incorrect answers, confidence drops quickly.
This is why AI readiness and information governance are now tightly linked.
What a real SharePoint cleanup involves
The good news is that councils do not need to solve these problems in one massive project. The most successful programs start with visibility, then prioritise remediation based on risk, use and AI impact.
A practical starting point is to focus first on content that is most likely to affect trust and exposure: high-risk policy and HR content, frequently used operational guidance, overshared sites, authoritative intranet pages, and areas selected for early AI pilots. The most successful programs focus on visibility first, then progressively improve governance, permissions, metadata and content quality over time.
From there, the cleanup can be delivered in phases. That process usually looks something like this.
1. Make the problem visible
This starts with understanding the current state.
- What exists
- What AI could surface
- Where the risks are
2. Establish governance and ownership
Governance provides clarity:
- Who owns what
- How sites are created
- How content is maintained
- How long information is retained
Most councils begin without formal SharePoint governance. That is common and fixable.
3. Redesign information architecture
Structure should reflect how councils operate.
- Department and service-based hubs
- Clear navigation
- Consistent naming
- Practical metadata
4. Audit content and make decisions
This is where cleanup becomes tangible. Content is reviewed and categorised:
- Keep
- Update
- Archive
- Delete
In one council program, we used a structured inventory workbook to track every item’s owner, status, and disposition decision, ensuring accountability sat with the business, not just IT.
5. Fix permissions and reduce oversharing
Permissions are aligned to roles and responsibilities. The goal is not tighter restrictions. It is correct access. This reduces unintended exposure while improving confidence in AI-generated responses.
6. Strengthen metadata and authority
Metadata becomes practical rather than theoretical. It supports:
- Search accuracy
- Context for AI
- Record authority
Australian public sector recordkeeping guidance consistently treats metadata as essential to trustworthy records. Metadata helps describe the content, context, structure, relationships, actions and lifecycle of information, turning it from a technical detail into a practical signal of authority and trust.
7. Remediate in phases
Councils do not need to fix everything at once. The most effective approach is to prioritise:
- High-risk content, such as HR, privacy, governance, legal, policy and compliance material
- High-use content
- Areas where AI is being deployed first
- Overshared or unmanaged sites where broad access may create unnecessary exposure
- Authoritative policy libraries and intranet pages that staff rely on for consistent answers
This reduces effort while delivering early impact.
8. Train, support, and iterate
Cleanup is not the end state. It becomes part of ongoing governance. Teams need:
- Clear guidance
- Practical training
- Ongoing support
This is what maintains quality over time, rather than allowing environments to drift again.
What this looks like in practice
In practice, cleanup is usually most effective when it is connected to work councils are already doing, such as intranet redevelopment, AI readiness, records improvement or Microsoft 365 governance.
For example one of our council clients also had:
- A new intranet hub built
- Existing sites were progressively reviewed and rationalised
- Cleanup activities continued after go-live as part of governance
In another case:
- An AI hub was centralised as a single source of truth
- Content duplication was removed
- Publishing was controlled to maintain authority
These decisions ensure environments stay clean, rather than requiring repeated large cleanups.
The bottom line
For councils intending to use AI safely and effectively, SharePoint cleanup is becoming a practical prerequisite. It is the work required to ensure:
- Information is trustworthy
- Access is appropriate
- Records are defensible
- AI produces usable answers
The question for councils is no longer whether the information foundation matters.
It is whether they strengthen it now, on their own terms, or allow AI to expose years of unresolved content, access and governance gaps in front of staff, leaders and the community.
Author Bio – Chloe Dervin
Chloe Dervin is Managing Director of WebVine and has spent more than two decades helping councils and organisations improve the way people find, share and manage information using Microsoft 365 and SharePoint. She specialises in digital workplaces, information governance and AI readiness.
FAQs
What is a SharePoint cleanup for AI?
It is a structured program that improves content quality, permissions, metadata, and governance so AI tools return accurate and reliable answers.
Why do councils need this before using Copilot?
Copilot reflects existing content and permissions. If the environment is messy or over-permissioned, AI surfaces those issues rather than solving them.
How much content do councils typically need to review?
In many projects, councils review thousands of pages and dozens of sites. For example, one WebVine engagement involved over 1,700 pages across more than 70 sites.
Do councils need to clean everything at once?
No. Most start with high-risk or high-impact areas and improve progressively over time.
What is the biggest risk of not doing this work?
Low trust in AI, inaccurate answers, oversharing of information, and increased compliance exposure.