Microsoft logged what Copilot changed in your spreadsheet

The limit on AI right now is proof, not models.

Three things from yesterday, and they sit on the same bottleneck. Not one of them is an argument about whether the models work. They are arguments about who can say afterwards what the thing actually did.

Advertisement

1. Three in four IT leaders say compliance is the brake

Cloudera asked IT leaders what is holding enterprise AI back, and got an answer about themselves rather than about the technology.

75% say compliance constrains how far they can scale AI.

On 26 October the same research programme published its public sector cut, and that one is sharper: the public sector leads every other industry on data governance, and data access gaps threaten its AI readiness anyway. Strong rules, locked doors. At the company's own conference on 30 October the argument on stage was that role-based access control decides whether an agent can be trusted at all.

I read that 75% the other way round. Compliance did not grow teeth this year. It has always asked for the same record, which field changed and on whose authority, and now it costs you to not have it. Most of those IT leaders are not blocked by a regulator, they are blocked by lineage nobody funded while it was boring. I would spend the next quarter being able to say where a number came from before spending another euro on a model. The survey also comes from a company that sells data governance, which does not make the figure wrong, only well timed.

Read the source →

2. Cyera is in talks at $20 billion for knowing where the data sits

Cyera is in funding talks at a valuation of about $20 billion, close to double what it was priced at in June. What the product does is find and classify sensitive data across a company's systems.

So you end up paying for an index of your own files instead of a model.

It also agreed to buy Oasis Security, an access-management platform for AI agents, for about $1 billion, reported on 9 October. That puts the labels on your data and the identity of the machine reading them inside one supplier, in a quarter where cybersecurity startups took $6.8 billion from investors.

Priced at that level, data discovery stops being a security line item and becomes the map everybody else's agents read from. That worries me more than it reassures me. If one supplier owns both the labels and the identities, the provenance story you hand your auditor is somebody else's product roadmap, and roadmaps move on their schedule rather than yours. I would want those labels back in an exportable form I keep myself before signing anything multi-year.

Read the source →

Advertisement

3. Microsoft put a change log inside the accountant's spreadsheet

Copilot got accounting skills in Excel, and the interesting half is what came with them. An accountant can start an audit trail when they invoke one of those capabilities, so the chat history holds what Copilot changed and why. Copilot can then summarise recent activity, say who made a specific change, and reverse individual edits without disturbing the rest of the workbook.

It landed inside a bigger package the same day: more than 25 new finance skills and partner-built plugins across Copilot in Excel and the Copilot app. Word, Excel and PowerPoint move into the Copilot app itself from mid-November. Malta's public IT agency is putting Copilot in front of more than 12,500 officers.

Finance was always going to be first in the queue, because a spreadsheet is already the one place in a company where every change has a named owner and a quarter-end to answer to. The timing is what gets me: the log shipped the same day as the capability instead of two years later, so buyers were asking for it in the room. My guess is the real fight here turns out to be retention. A chat history is not a seven-year record, and somebody's auditor will say that out loud before summer.

Read the source →

Advertisement

Also today

• Alphabet expects to spend up to $205 billion on capital projects this year, and says the number keeps rising through 2027 (read it). (3 min read)
• Runware wants to build AI data centres on a production line and have one running inside 48 hours (read it). (4 min read)
• Estée Lauder put Microsoft Copilot in front of more than 14,000 office staff and is merging its data platforms to cut duplication (read it). (2 min read)

The Long ReadThe record the tool keeps on itself

Years ago I used SQL Server with ActiveX components for things most SQL Server experts do not know are possible, and built browser automation with VBScript inside Access and Excel, before people understood you could do that. It worked, and it was fun. It also left nothing behind. No record of which cell moved, on whose say, or why.

That same reach shipped this week with a receipt attached, which is the part worth arguing about: in Excel the thing writing the receipt is the thing that made the change.

Does the log that proves your AI behaved come from the thing you are proving?

My call: by the end of June 2027, a named organisation publicly fails an audit or a regulatory request because its only evidence of what an AI agent did was that vendor's own activity history. It goes on the Scoreboard.

Read the deep dive →