The Longest Road to Copilot

I design my AI workshops with the optimism of a person who has never met a participant. The lesson plan is immaculate. The timing is precise. The Copilot window is pre-loaded, the demo prompts are tested, and I have even — in what I now recognise as a form of hubris — built in a ten-minute “parking lot” segment at the end for questions that arise organically. I have never, once, reached the parking lot.

The Session That Was Supposed to Start Two Hours Ago

Here is what the brochure says my AI literacy workshop covers: foundations, tool overview, practical demonstration, hands-on practice, questions. Here is what my AI literacy workshop actually covers: the same foundations, twice, at different speeds, for two distinct populations who are sharing a room but are not, experientially speaking, in the same decade. Then a forty-minute detour into why you cannot paste that into a chatbot, which is not on the agenda but has become, over time, effectively the agenda. Then lunch. Then, if conditions are favourable and the satellite internet is cooperating, approximately forty-five minutes of the demo I originally planned to deliver from nine-thirty.

The reason for this is structural. Not pedagogical, not motivational, not a reflection of anyone’s intelligence or willingness to learn. Structural. You cannot deliver meaningful AI training in ninety minutes any more than you can deliver a driver’s licence course in the time it takes to parallel park. You need the full day. You need it because of what walks through the door.

What walks through the door, in every workshop I have run, without a single exception across eight months of regional Australian professional development, is this: a perfectly representative cross-section of AI readiness that spans approximately thirty years of technological experience within the same room. On one side, people who have never spoken to a large language model. On the other, people who have been using one daily for six months and haven’t mentioned it to anyone. And, floating somewhere in the middle, a third group that has heard of ChatGPT primarily through a newspaper article that described it in terms that would have been alarming in 1984 and are only slightly less alarming now.

You cannot design a single lesson plan for all three. You can only start where they are, build from there, and accept that the parking lot is not happening today.

In Which the Room Has Questions Before It Has Context

The beginner questions begin early and are, individually, entirely reasonable. Collectively, they constitute a two-hour introductory seminar on digital literacy that I did not budget for but cannot, in good conscience, skip. You cannot in good conscience skip them because they are the questions of people who are genuinely trying to understand something new, and if you skip them to get to the demo, you will have a room full of people clicking on things they don’t understand, which is how we got into this mess in the first place.

The questions, across cohorts, are remarkably consistent. Can it check things? (Sometimes, with caveats, don’t trust it unconditionally.) How do I know if it’s right? (You verify. This is non-negotiable.) Is it recording us? (No, that’s a different product, also not really, it’s complicated.) Can IT see my Copilot chats? (Possibly, yes, depending on your tenancy settings, which is actually a great segue into something I need to talk to you all about.) What if it makes something up? (It will. Regularly. With complete confidence. We will discuss this at length.) What’s the difference between this and Google? (Fundamental and significant and I am so glad you asked because this is where we start.)

My approach to the “can it do X?” category of questions — and I stand by this as pedagogy, even when it costs me forty minutes — is to simply ask it. Right there. In front of everyone. Load up Copilot, or Claude, or ChatGPT, type the beginner’s question in, and let the tool answer for itself. Can you check whether facts are accurate? And Copilot responds, thoughtfully, at length, with a nuanced account of its own limitations that is more honest than most of the marketing material Microsoft has produced about the same product. The room is always slightly startled by this. It turns out that demonstrating how AI explains itself is itself a demonstration of how AI works, which is the kind of pedagogical efficiency I was not trained to deliver but have accidentally discovered through necessity.

The room likes this method. The room then generates fourteen more questions.

This is fine. This is how it works. You start where people are. You build from there. The lesson plan is a suggestion, not a contract, and the parking lot is — once again — not happening today.

The Shadow AI Confessional (A Genre Piece in Three Movements)

Here is what I have learned, after eight months of running these workshops: everyone is using AI. Not some of them. Not most of them. All of them. They are using it before the policy exists, before the training exists, before the IT department has assembled a working group to discuss whether it should exist. They are using it on their phones, through personal accounts, in incognito windows opened on the logic that what IT can’t see IT cannot have feelings about.

The Shadow AI Confessional occurs in every workshop with the reliability of a tide. It begins when I ask, casually, who has tried an AI chatbot before. Three hands go up. Then I ask — with the carefully calibrated gentleness of a GP asking about recreational drug use — whether anyone has used a personal AI account to do something work-related. Not the work one, if there is one. A personal account. Their own phone. Maybe at home, after hours, for something that was technically a work task.

The room goes quiet in a way that is itself an answer.

Then someone — there is always a someone — says: “I use it to write emails sometimes.” And someone else says: “I put in some feedback and asked it to find the themes.” And a third person says, with the confidence of a person who has genuinely never considered that this might be relevant: “I gave it a spreadsheet and asked it to summarise the data.”

At this point I am wearing what I privately call the Poker Face. It is the expression I adopt when I need to not let my face communicate the words: please, please tell me that spreadsheet did not contain names.

It often contained names.

This is not because these people are reckless or unintelligent. It is because nobody told them not to. Nobody explained what “public AI” means, or what happens to inputs on a free-tier account, or that the friendly conversational interface doesn’t come with the same data handling obligations as, say, their organisation’s officially sanctioned filing system. They were trying to do their jobs. They found a tool. They used it. The concept of asking permission hadn’t formed yet — institutionally or personally — because the institution itself hadn’t formed a position.

This is the part of the workshop nobody puts in the brochure. This is why it is a full day. And this is why the Copilot demo — carefully prepared, road-tested, sitting patiently in a browser tab I opened at nine o’clock this morning — is going to have to wait until after lunch.

I spend the next thirty minutes on what I have started calling Basic AI Safety Literacy: what goes in, what that means for where it ends up, what your organisation’s actual policy says (which they often haven’t read, which is fine, because it often wasn’t written when they started using the tool), and the practical difference between “using AI” and “using AI in a way that won’t eventually require a lawyer.”

And then — inevitably, reliably, with the comic timing of a perfectly structured farce — someone raises their hand and asks: “So can I use it to help process the client data?”

No. No you cannot. And that brings me, with great theatrical restraint, to Exhibit A.

Exhibit A: The Spreadsheet That Should Not Have Existed

Between the 12th and 15th of March 2025, a contractor working for the NSW Reconstruction Authority — the state body responsible for managing flood recovery for people still rebuilding their lives after the 2022 Northern Rivers floods — uploaded a Microsoft Excel spreadsheet to ChatGPT. The file contained more than 12,000 rows of data across ten columns: names, addresses, phone numbers, email addresses, and in some cases personal health information. The data belonged to up to 3,000 applicants to the Northern Rivers Resilient Homes Program. The breach was publicly disclosed in October 2025 — six months after it happened. (Source: Information Age / ACS, iTnews, TechNadu, October 2025.)

The contractor was not trying to commit a crime. They were trying to do their job. They had a spreadsheet. They had a question about the spreadsheet. They had access to a chatbot. They put the spreadsheet into the chatbot.

I want to pause here, because I need the room to understand something before we proceed: this is not a story about a bad person. This is a story about what happens when the gap between capability and understanding is wide enough that a well-intentioned person can inadvertently expose thousands of flood victims — people who had already lost their homes, who were in the middle of rebuilding their lives — to a data breach that included their health information, their contact details, and the private circumstances that led them to need government assistance.

Their data was uploaded to a public AI platform without their knowledge or consent. By someone who was, in all likelihood, just trying to process a spreadsheet efficiently.

Jon Robertson, founder of Australian cybersecurity company Tarian Cyber, noted that the “main concern” of the breach was the upload itself — the fact that personal data had been fed to an AI tool without an understanding of how it would be stored or used after the immediate task. Cybersecurity expert Turner observed that ChatGPT’s potential use of chat inputs for training purposes meant the victims’ information was “now being used in a way they did not agree” to. (Source: Information Age / ACS, October 2025.)

This is what I mean when I say the privacy conversation comes first. Not as bureaucratic box-ticking. Not as a compliance performance. As the actual, documented, real-world consequence of using a powerful tool without understanding what you’re putting into it, or where it goes once it arrives.

The NSW Reconstruction Authority subsequently “reviewed and strengthened internal systems and processes and issued clear guidance to staff on the use of unauthorised AI platforms.” (Source: Information Age / ACS, October 2025.) Which is, if you’ll forgive me, the institutional equivalent of putting a sign on the photocopier after someone photocopied their passport and emailed it to an overseas lottery. Admirable. Necessary. Somewhat late.

I use this case study in every workshop now. I put it in the introductory materials. I reference it every time someone says “it’s fine, it’s only internal data” — a phrase that should, in my considered professional opinion, trigger a small alarm somewhere in the vicinity of the person who said it.

In Which the Feedback Forms Arrive and I Learn What People Thought They Were Attending

The feedback forms come back the following morning. I read them with the specific dread of a person who knows, in their bones, exactly what they’re about to say.

That last one. That last one. It arrives from at least one participant per cohort with the statistical reliability of a natural law, and it is my favourite piece of feedback in the entire corpus, not because it is unreasonable — it is completely reasonable, it is the entire stated purpose of the training — but because of what I find when I quietly think back over the morning session and try to identify who sent it.

The person who wants to learn how to use AI in their workflow is, in my experience, almost invariably the person whose workflow I spent twenty-five minutes of that morning politely explaining cannot go near a public chatbot. Not because they are doing anything wrong. Because their job involves handling personally identifiable information belonging to students, or clients, or members of the public, and the workflow they have in mind involves uploading that information to an AI tool in a way that would make a privacy lawyer age visibly in real time.

They do not know this. That is precisely why they are at the workshop. And yet the feedback form, filled in at the end of a day in which we covered exactly this, reads: I wanted to learn how to use AI in my workflow. As though the morning’s conversation about their workflow was a detour, rather than the main event. As though the lesson and the feedback had been written by two different people, which, given the gap between what was taught and what was heard, is functionally accurate.

I am not, I want to be clear, mocking these participants. They came to learn something useful. I genuinely hope they did. But there is a specific, chronic irony in the structure of this situation that I find simultaneously funny and alarming, which is: the people most eager to integrate AI into their workflows tend to work in the roles where that integration is most fraught. The people who would find an AI writing assistant genuinely transformative are often the ones whose data I spent the morning explaining was too sensitive to share with one. It is as though someone put a notice in the staff newsletter that said “free chainsaws for anyone who needs to prune a tree,” and the people who showed up were exclusively arborists working in enclosed spaces.

I would like more Copilot demo time too. I really would. I love the demo. The demo is the part where people light up. The demo is the whole point. But I cannot, in good conscience, prioritise the demo over the thing that stands between the demo and an incident report.

The Part Where It Stops Being Funny (Briefly)

The NSW contractor who uploaded that spreadsheet probably attended compliance training at some point. Probably clicked through an acknowledgement of the data handling policy. Probably understood, in the abstract, that personal information required careful stewardship. The abstract understanding and the specific, practical, in-the-moment recognition that this particular action with this particular file constitutes a breach had never been properly connected. The gap between knowing a rule and understanding what it means in practice — that is the gap I am trying to close, one reluctant workshop participant at a time, in a room where the internet drops out every forty minutes and the air conditioning has been reported to maintenance since November.

It takes the full day. It requires starting where people actually are, which is not where the lesson plan assumed they would be. It means the demo is after lunch, or occasionally the demo is the first thing after the fire drill that nobody mentioned was scheduled, or the demo is abbreviated because we ran long on the confessional section and I made the pedagogical call that understanding the risk matters more than seeing the interface. Every time. Even when the feedback forms say otherwise. Even when I am tired of explaining it. Especially then.

In Which We Return to Our Regularly Scheduled Absurdity

I am, as I write this, drafting a revised workshop description. I have been advised, by people who know about these things, that the description should “lead with the benefit” and “not front-load the compliance messaging,” which is excellent advice for a marketing brochure and catastrophically wrong advice for a training programme whose entire first half is compliance messaging. I am trying to find language that accurately communicates “you will not be doing what you think you will be doing for at least three hours, and this is correct, and you will be grateful for it, probably, once the feedback form is a distant memory.”

Current draft: AI Literacy for Professionals — a full-day workshop exploring how to use AI tools effectively and safely in your workplace. Which is true. Which omits, by design, the part where “safely” constitutes the majority of the session and “effectively” is what we get to if “safely” goes well. I am becoming, I think, the thing I make fun of in other contexts: the person who knows what the audience wants to hear and carefully doesn’t say it.

The rainbow ball is in the workshop now. It has attended three sessions. It does not take notes. It has, on two separate occasions, raised its hand to ask whether AI can write code, which is a reasonable question for which I have a good answer, but which requires me to explain that we haven’t got to practical demonstrations yet because we are still on the part about what happens when a government contractor uploads an Excel spreadsheet to a public chatbot, so if we could just hold that thought until after the break, I think we’ll find it lands much better with the right context.

The ball is patient. I’ll give it that.

She’ll be right. Probably. I have another workshop on Thursday with a group from a government department that handles, among other things, sensitive case management data for vulnerable populations. The confirmation email says they’re “really looking forward to the hands-on Copilot session.” I have replied with warmth and enthusiasm and have not yet mentioned that we’ll be spending the first two hours on something else entirely.

Ask me how it went on Friday.