AI deployment and governance · Microsoft Copilot + Claude
AI deployment and governance for law firms, oil & gas companies, medical device companies, and PE-backed organizations. We help your team deploy Claude Enterprise and Microsoft 365 Copilot with the right permissions, data protections, and oversight.
Law firms · Oil & gas · Medical device companies · PE-backed organizations
A 60-minute working session, written findings, and a follow-up review. No obligation to purchase.
Steven R. Combs
Co-Founder and Managing Director
“We needed Claude Cowork live without opening the firm to oversharing risk. Cocha designed the controls so we could move forward with confidence.”
— IT / Security leader, Atlanta-based Am Law 200 firm
Steven R. Combs leads the technical work—from AI readiness to implementation. Meet Steven
Technology partners and tools we implement with. Logos do not imply endorsement.
The free AI Readiness Snapshot reviews selected permissions, data-protection controls, and AI governance practices. You receive written findings that help your IT and leadership teams agree on priorities.
Plan for: a 60-minute working session, preparation by your IT team, and a 30-minute findings review. We respond within 4–8 business hours. Written findings are provided within five business days after the working session and receipt of the required inputs. Your team’s availability can affect the overall schedule.
The free Snapshot is a bounded diagnostic. It is not a complete tenant audit, penetration test, regulatory certification, or implementation plan. The paid AI Readiness Assessment is a separate engagement.
Illustrative example only—not a client finding or a complete report.
Finding: A matter folder is shared with a broader group than its intended team.
Evidence: An access export supplied by the firm shows the group membership and folder permissions. Matter content has not been inspected.
Priority: Validate the intended access boundary before expanding connected AI use. Severity depends on the sensitivity and actual access.
Recommended next step: Have the matter owner and IT team confirm who needs access, then review the group and sharing settings.
Limit: This selected review does not establish that all ethical walls or tenant permissions are effective.
We commonly start by bringing existing AI use under governance and rolling out approved tools with appropriate security. A new Claude Enterprise deployment is another common starting point.
Establish approved users, use cases, connected data, and administration before expanding adoption.
Review access and configure the data-protection controls appropriate to your environment.
Define ownership, approval, monitoring, and evidence for AI tools and agents.
Large Canadian law firm
Engagement scope: governance and pilot readiness, account migration planning, administrative roles, connector evaluation, monitoring architecture, and rollout guidance alongside the firm’s IT team.
Client feedback, paraphrased: Cocha brought considerations into the rollout that the team had not identified.
Large U.S. law firm
Cocha supports the Copilot rollout and ongoing governance, with advisory as the Copilot ecosystem changes.
Client feedback, paraphrased: The CISO described Cocha’s involvement as essential to keeping up with the work.
Law firms: Overbroad matter permissions can let Copilot or connected Claude surface files across ethical walls.
Energy: Connected agents can surface contractor and operations files a user can already access in SharePoint and Teams.
Medical device: Broad M365 access can expose design-history, QMS and FDA evidence files to connected AI.
For Microsoft 365 security or a planned cloud move, start with a free focused Snapshot.
Yes. The AI Readiness Snapshot is a free, bounded diagnostic with written findings. Paid work such as the AI Readiness Assessment or an implementation sprint is scoped and priced separately, only if you choose to continue.
Plan for IT preparation before the 60-minute working session, and attendance from someone who can speak to Microsoft 365 permissions and AI plans. Any diagnostic tooling, required permissions, and data handling are agreed with your IT team in advance.
Yes. We can review and harden a live deployment, tighten permissions and data protections, and improve governance without assuming a full redeployment.
Yes. Cocha works alongside your internal IT team or MSP on AI deployment, data protection, and governance. We can also provide helpdesk and managed IT support, with responsibilities tailored to your organization.
We respond within 4–8 business hours, Monday–Friday, 8 AM–5 PM Central. We confirm fit, explain preparation, and arrange the 60-minute working session. Written findings are provided within five business days after the working session and receipt of the required inputs. Your team’s availability can affect the schedule.
Steven R. Combs leads the technical work, drawing on 30 years in IT and 15 years working with law firms. Gabriella San Miguel manages the back office, project management, and business coordination, helping keep scheduling, inputs, and follow-through organized.
Request a free AI Readiness Snapshot or call to discuss your situation.
