The Longest Road to Copilot

I teach my AI workshops with the optimism of someone who has never met a participant. The lesson plan is flawless, the timing precise, the copilot window pre-loaded, the demonstration prompts tested and even, in what I now recognise as an exercise in hubris, included as a 10-minute "parking lot" for questions arising spontaneously. I have never once reached the parking lot. The brochure describes my AI literacy workshop as covering basic concepts, an overview of tools, a demonstration of practice, hands-on experience and discussion.

The Session That Was Supposed to Start Two Hours Ago

My workshop actually provides the same basic concepts twice, at different rates of presentation to two completely different groups of participants who experience the same room but not the same decade. This is followed by a 40-minute excursion to explain why you cannot simply paste information into a chatbot (an activity that is not on the agenda, but has become in effect the agenda). Finally, we have lunch and, if conditions are favourable and satellite internet access is adequate, approximately 45 minutes of the demonstration that I originally intended to provide from 9:30. This outcome reflects fundamental limitations on the capacity for effective AI instruction.

It is not a function of pedagogical or motivational styles, or of individual capacity for or willingness to learn. Rather, it reflects the difficulty of providing meaningful AI instruction within 90 minutes, just as it is impossible to provide a course of driver education within the time required to parallel park. The result is an absolute requirement for a full day of instruction. This requirement is based entirely on the characteristics of those who enter the room.

Each group that participates in a workshop represents a completely representative cross-section of readiness for AI technology that encompasses about 30 years of experience with technology within the same physical space. On one end of the continuum are individuals who have never communicated with a large language model. On the other end are individuals who have used one every day for 6 months and have never mentioned this experience to anyone. And hovering somewhere in the middle, a third group that learned about ChatGPT mainly through a newspaper article that characterised the technology in a way that would have been alarming in 1984 and are only marginally less alarming today.

It is impossible to develop one lesson plan that will work for all three groups. Instead, you must begin at the level of each individual group, build on that level of experience and accept that the parking lot will not be available today.

In Which the Room Has Questions Before It Has Context

The beginner questions come early and are individually eminently reasonable. Collectively, they represent a two-hour session on digital literacy that I had not planned for and cannot ethically omit. You cannot ethically omit them because they reflect the attempts of individuals to understand something new. If you omit them to achieve the demonstration, you will end up with a room full of individuals interacting with tools about which they know nothing. That is precisely how we got into this mess in the first place. The results are remarkably consistent across cohorts.

Can it verify results? (Usually, but with appropriate caveats, do not expect unconditional reliability.) How do I know whether results are accurate? (You verify, and this is absolutely mandatory.) Does it record our activities? (No; this is a completely different product and ultimately a very complex situation.) Will IT have access to our conversations with Copilot? (Possibly, yes, depending on the configuration of your tenant, and providing an excellent opportunity to discuss an important subject.)

Finally, what happens when it generates incorrect information? It will do so routinely with complete confidence.

We will discuss this extensively. And what is the relationship between our experience and that of Google? It is fundamental, extensive and, most importantly, an excellent place to begin. The experience of the room is entirely supportive of this approach. In fact, the room subsequently raises an additional 14 questions. That is entirely appropriate, and represents the essential mode of operation.

Begin at the level of the individual. Build upon that experience. The lesson plan serves only as a suggestion and never as a contract. The use of the "parking lot" is once again inappropriate. My response to questions of the type "Can it do X?" is simply to ask it. Immediately and in full view of all participants.

Activate Copilot, or Claude or ChatGPT, enter the question of the beginner and allow the tool to provide its own complete response. Can it verify the accuracy of factual information? Yes, and with a level of thoughtful, complete and candid description of its own limitations that far exceeds the degree of honesty achieved in most of the marketing information that Microsoft has released for the same product. The room is perpetually mildly startled by this. In fact, the effort to show how AI explains itself provides another powerful demonstration of how AI operates, and thus exemplifies a form of pedagogical efficiency to which I was not trained but have inadvertently adapted in response to necessity. By 11 o'clock, I am explaining for the fourth time in 30 minutes why one cannot paste an individual's medical history into a public chatbot.

The Shadow AI Confessional (A Genre Piece in Three Movements)

Everyone uses AI. Not some of them. Not most of them. All of them. Before there is any policy, any training or any discussion by the IT department about whether there should be one.

They use it on their phones, with individual accounts, and in anonymous modes that reflect an assumption that what IT cannot see it cannot care about.

The confessional of shadow AI is a feature of every workshop with the regularity of the tides. It begins when I casually ask who has tried an AI chatbot. Three hands go up. Then, with the carefully measured gentleness appropriate to a discussion of recreational drug use, I ask whether anyone has used a personal account to perform work-related tasks. Not necessarily tasks for which there is a separate work account, but tasks performed on their own phones and, preferably, at home outside working hours.

The result is complete silence that itself conveys a message.

Finally, someone (and there is always someone) says, "I use it to write some e-mails." Another says, "I provide some input and request that it identify the major themes." A third reports with the assurance of someone who has never previously considered the relevance of this activity: "I give it a spreadsheet and request a summary of the data."

At this point, I am wearing my private expression of poker face, an attempt to prevent my facial expression from transmitting the message, "Please tell me that there were no names in that spreadsheet." There were, of course.

This is not because these individuals are reckless or incompetent. Rather, it reflects the complete absence of instruction concerning the implications of public use of AI, the fate of input data on a free-tier account and the degree of responsibility for data handling associated with a friendly, conversational interface compared with an officially sanctioned system for data entry. They were trying to do their jobs. They found a tool and used it. There had been no development of a permission-seeking attitude, either personally or institutionally, because the institution itself had not yet adopted a position.

This is the segment of the workshop that is not included in the brochure. For that reason, it is a full day and explains why our demonstration of Copilot must await the completion of lunch.

Our well-prepared, extensively field-tested demonstration of Copilot is quietly waiting in a browser tab opened at 9:00 a.m. today.

I spend the next thirty minutes on what I have started calling Basic AI Safety Literacy: what goes in, what that means for where it ends up, what your organisation’s actual policy says (which they often haven’t read, which is fine, because it often wasn’t written when they started using the tool), and the practical difference between “using AI” and “using AI in a way that won’t eventually require a lawyer.”

And then — inevitably, reliably, with the comic timing of a perfectly structured farce — someone raises their hand and asks: “So can I use it to help process the client data?”

No. No you cannot. And that brings me, with great theatrical restraint, to Exhibit A.

Exhibit A: The Spreadsheet That Should Not Have Existed

Between March 12 and 15, 2025, a contractor for the NSW Reconstruction Authority (the state agency responsible for managing flood recovery for those still rebuilding their lives following the 2022 Northern Rivers floods) uploaded a Microsoft Excel spreadsheet to ChatGPT. The file included more than 12,000 records with 10 fields of information: names, addresses, phone numbers, e-mail addresses and, in some cases, information on personal health status. The data represented the records of up to 3,000 applicants for the Northern Rivers Resilient Homes Program. The incident was disclosed to the public in October 2025, six months after the breach. (Source: Information Age / ACS, iTnews, TechNadu, October 2025.)

The contractor had no intent of committing a crime, but was simply attempting to perform its job. It had a spreadsheet, a question concerning that spreadsheet and access to a chatbot. The result was transfer of the spreadsheet to the chatbot.

Here we pause to provide adequate space for an important interpretation. This was not a story about a bad person, but rather about the consequences of a very large gap between capability and understanding. As a consequence, a well-intentioned individual inadvertently exposed thousands of victims of flood damage who were in the midst of rebuilding their lives to conditions of complete and unacceptable information security risk.

The data were transmitted to a public system for artificial intelligence without knowledge or consent of the individuals involved. This was accomplished by a person who presumably was simply attempting to achieve rapid processing of a spreadsheet.

The major concern associated with the breach, as Jon Robertson, founder of Australian cybersecurity company Tarian Cyber, noted, was the transfer of personal data to an artificial intelligence system without awareness of how that information would be stored or used subsequent to the initial processing operation. Cybersecurity expert Turner observed that use of chat input data for purposes of training artificial intelligence systems resulted in complete loss of control over use of the data and in ultimate utilisation of information that had been provided without knowledge or consent. (Source: Information Age / ACS, October 2025.) This is exactly what I mean by saying that the privacy conversation comes first. Not as bureaucratic paperwork. Not as a compliance exercise. But as the documented, real-world result of operating a powerful tool without understanding what you are feeding into it or what happens to it after it gets there.

The result was that the NSW Reconstruction Authority "reviewed and enhanced internal systems and procedures and provided clear guidance to staff regarding use of unauthorised AI systems." (Source: Information Age / ACS, October 2025.) That represents, in my view, the institutional equivalent of posting a warning sign on the photocopier following unauthorised duplication of a passport and electronic transmission of the copy to an overseas lottery. It is laudable, essential and finally achieved with considerable delay.

I use this case study in every workshop now. I put it in the introductory materials. I reference it every time someone says “it’s fine, it’s only internal data” — a phrase that should, in my considered professional opinion, trigger a small alarm somewhere in the vicinity of the person who said it.

In Which the Feedback Forms Arrive and I Learn What People Thought They Were Attending

The feedback forms come back the following morning. I read them with the specific dread of a person who knows, in their bones, exactly what they’re about to say.

It derives from at least one member of each cohort with the certainty of a natural law and is my favourite form of feedback for the entire experience. Not because it is unreasonable (it is entirely reasonable and precisely what I had trained my participants to do), but because of my experience of quietly recalling the morning session and identifying the source of my feedback. The individual who wishes to learn to apply AI to his or her work is inevitably the one with whom I spent 25 minutes politely describing as unable to interact with a public chatbot. This reflects neither any fault on the part of the participant nor any inadequacy of my teaching.

Rather, it reflects the requirement that my participants handle confidential information about students, clients or members of the public and thereby avoid serious violations of standards for protection of privacy. My participant was fully aware of these requirements and attended the workshop for this purpose. However, the resulting experience of the morning session was remarkably complete. My participant reported, "I wanted to learn how to apply AI to my work." This conveyed the impression that my discussion of the nature of the participant's work had been an accidental distraction rather than the major focus of the day.

In addition, it implied that my teaching and my feedback had been prepared by different individuals. Finally, I wish to emphasise unequivocally that I make no attempt to ridicule my participants. They came to obtain important information and ideally to apply it successfully. However, there is an unavoidable and continuing element of irony inherent in the design of this situation which is both amusing and disturbing.

Indeed, those participants most eager to apply AI to their work were in positions in which such application would have been completely inappropriate. Finally, those individuals for whom use of an AI writing assistant will represent true technological innovation were precisely those for whose data I spent the morning describing as inappropriate for release to anyone outside the room. It seems someone placed an advertisement in the staff newsletter offering "free chainsaws to anyone who needs to prune a tree." All who responded were fully qualified arborists operating in confined spaces. I would also appreciate additional time for the Copilot demonstrations.

I really would. The demonstrations reflect the period of greatest enthusiasm, and are the very reason for conducting the demonstrations. But I cannot ethically justify my priority for the demonstrations over the sequence that differentiates the demonstrations from an incident report.

The Part Where It Stops Being Funny (Briefly)

The NSW contractor who uploaded that spreadsheet probably attended compliance training at some point. Probably clicked through an acknowledgement of the data handling policy. Probably understood, in the abstract, that personal information required careful stewardship. The abstract understanding and the specific, practical, in-the-moment recognition that this particular action with this particular file constitutes a breach had never been properly connected. The gap between knowing a rule and understanding what it means in practice — that is the gap I am trying to close, one reluctant workshop participant at a time, in a room where the internet drops out every forty minutes and the air conditioning has been reported to maintenance since November.

It takes the full day. It requires starting where people actually are, which is not where the lesson plan assumed they would be. It means the demo is after lunch, or occasionally the demo is the first thing after the fire drill that nobody mentioned was scheduled, or the demo is abbreviated because we ran long on the confessional section and I made the pedagogical call that understanding the risk matters more than seeing the interface. Every time. Even when the feedback forms say otherwise. Even when I am tired of explaining it. Especially then.

In Which We Return to Our Regularly Scheduled Absurdity

I am, as I write this, drafting a revised workshop description. I have been advised, by people who know about these things, that the description should “lead with the benefit” and “not front-load the compliance messaging,” which is excellent advice for a marketing brochure and catastrophically wrong advice for a training programme whose entire first half is compliance messaging. I am trying to find language that accurately communicates “you will not be doing what you think you will be doing for at least three hours, and this is correct, and you will be grateful for it, probably, once the feedback form is a distant memory.”

Current draft: AI Literacy for Professionals — a full-day workshop exploring how to use AI tools effectively and safely in your workplace. Which is true. Which omits, by design, the part where “safely” constitutes the majority of the session and “effectively” is what we get to if “safely” goes well. I am becoming, I think, the thing I make fun of in other contexts: the person who knows what the audience wants to hear and carefully doesn’t say it.

The rainbow ball is in the workshop now. It has attended three sessions. It does not take notes. It has, on two separate occasions, raised its hand to ask whether AI can write code, which is a reasonable question for which I have a good answer, but which requires me to explain that we haven’t got to practical demonstrations yet because we are still on the part about what happens when a government contractor uploads an Excel spreadsheet to a public chatbot, so if we could just hold that thought until after the break, I think we’ll find it lands much better with the right context.

The ball is patient. I’ll give it that.

She’ll be right. Probably. I have another workshop on Thursday with a group from a government department that handles, among other things, sensitive case management data for vulnerable populations. The confirmation email says they’re “really looking forward to the hands-on Copilot session.” I have replied with warmth and enthusiasm and have not yet mentioned that we’ll be spending the first two hours on something else entirely.

Ask me how it went on Friday.