Enterprise Search Readiness: A Pre-Launch Checklist

Enterprise AI search fails for boring reasons: stale documents, duplicated sources of truth, permissions nobody has reviewed since the last reorg. The model is rarely the problem.

If you're an IT director at a growth company, you've probably been handed an AI mandate without a platform team to absorb it. The deployment itself isn't the hard part. Connectors into Drive, Confluence and SharePoint are largely configuration. The hard part is the content and permissions work that happens before any of that. It stays invisible until the assistant confidently cites a document that was retired eighteen months ago.

This is a pre-flight checklist for enterprise search. Short, scoped, and built to be run by a small team.

Why the readiness work decides the outcome

Gartner predicted in February 2025 that through 2026, organizations will abandon 60% of AI projects unsupported by AI-ready data, and reported that 63% of organizations either don't have or are unsure whether they have the right data management practices for AI. Those projects fail on their content, not their models.

The pattern is best documented in the Microsoft 365 Copilot ecosystem. Worth borrowing from, since equivalent quantified evidence for Gemini Enterprise readiness delays isn't yet publicly available. In a Gartner survey of 132 IT leaders conducted in June 2024 and reported by Computerworld, 60% had started Copilot pilots. Only 6% had finished one and were planning large-scale deployment. Concerns about oversharing caused 40% to delay rollouts by three months or more. Separately, 57% limited rollout to low-risk or trusted users.

Gartner director analyst Max Goss put the cause where it belongs.

This is, of course, not Copilot's fault... this is just the fact that you're putting Copilot into an environment where permissions haven't really been taken care of for years. — Max Goss, Gartner, via Computerworld

That framing matters for how you brief your executives. AI search doesn't grant new access. It inherits the permissions you already have and makes them fast to discover. Your permissions debt becomes visible. Uncomfortable, but a long way from a breach.

The five checks to run before authorizing a connector

These five items are our own framework, drawn from what we see in readiness work, not a vendor standard. They apply whether you're rolling out enterprise search across Google Workspace, Microsoft 365, or a mixed estate, and a small team can check them in days, not months.

1. A named owner per content source. Every space, site and shared drive in scope needs one person accountable for what's in it. Ownerless content is where stale documents accumulate.
2. A canonical decision for duplicated documents. Pick which of your four onboarding documents is the real one and retire the rest. Practitioner analysis of retrieval failures is direct on this: when two versions of a document are indexed with different content, the retrieval layer surfaces conflicting context, and updates should replace indexed versions rather than append to them.
3. A review of broadly-shared content. Anything set to "anyone with the link" or shared org-wide inside the pilot's scope gets checked before connection, not after.
4. Stale and ownerless cleanup. Dormant accounts still carrying group membership quietly widen retrieval. Varonis's 2025 State of Data Security Report, based on 1,000 real environments, found 88% had stale but enabled ghost user accounts and only 1 in 10 had labeled files. That's vendor data from self-selected environments, so treat the magnitudes as indicative at best. The failure mode itself is real.
5. A defined index scope. Write down what will and won't be indexed in the pilot. This is the item that lets you say no to a "connect everything" mandate without saying no to the project.

Microsoft's own foundational deployment guidance sequences the same way: remediate oversharing first, then set up guardrails, then meet regulations. When a vendor with every commercial incentive to accelerate rollout puts remediation first, the ordering is worth respecting.

What the platform actually gives you

On the Google side, the readiness work is concrete rather than theoretical. Gemini Enterprise is Google's enterprise search and assistant platform, and its connector model reflects that scope. Gemini Enterprise connector documentation explains that each data source supports a set of entity types and that a separate data store is created per entity. It also distinguishes federated retrieval, where content is read directly from the source, from ingestion into an index. Different risk profiles, and worth deciding on deliberately.

For anything outside Google's own surfaces, Google's custom-connector documentation is explicit that before you begin you need a clear data mapping plan covering which fields to index and how to represent access control, including third-party identities. Gemini Enterprise supports ACLs and identity mapping for document-level access, with identity mapping used where the source relies on non-Google identities or non-IdP-based groups. A community walkthrough published in the Google Cloud Medium publication adds the operational half: ACL and identity mapping data has to stay in sync with content. Permissions sync runs for as long as the connector does.

On the Workspace side, an IT director already has four levers worth knowing before the pilot:

• Drive trust rules, which restrict what Gemini can retrieve by controlling internal and external sharing.
• Drive inventory reporting, for a holistic view of how data is classified and who can access it.
• Client-side encryption, which makes content indecipherable to Gemini.
• Gemini audit logs via the Reports API, showing when Gemini accessed a Drive file.

One caveat on currency: Gemini Enterprise surfaces are moving quickly, and edition-specific connector availability changes. Confirm what your edition supports at the time you plan the pilot rather than assuming a published list still holds.

The trap on the other side: cleaning everything first

The checklist above isn't an argument for a six-month program. A June 2026 QueryNow whitepaper argues that the most common governance error is exactly that: a tenant-wide effort to classify everything before anyone gets value. It recommends remediating only the sites and libraries the pilot cohort actually uses, expanding the governed perimeter sprint by sprint. The same whitepaper reports that Forrester's Total Economic Impact study of Microsoft 365 Copilot, published March 2025, found 70% of surveyed organizations ran data security projects ahead of deployment.

The strongest evidence against perfectionism is the UK Government Digital Service trial: 20,000 participants across government from 30 September to 31 December 2024, saving an average of 26 minutes a day, with over 70% agreeing it reduced time spent searching for information and 82% saying they wouldn't want to go back. Those were ordinary tenants. The same report still warns that organizations should ensure information and knowledge management practices are up to date, because searching with a user's own access may highlight cases where users can reach files they shouldn't.

Read those together and the conclusion is scope, not delay. Clean the cohort's content. Connect. Measure. Widen.

Readiness is a practice, not a gate

Gartner's own guidance is that AI-ready data isn't one and done. It's a practice requiring continual improvement in metadata management, data observability and governance. A pre-flight checklist gets you to launch. It won't keep you there. Enterprise search only stays trustworthy if governance keeps pace with the index.

Two things make it repeatable. First, name the owner who re-runs the five checks each time the indexed perimeter grows. Second, use what the platform gives you after launch: audit logs and inventory reporting turn "we think it's fine" into an observable position.

It's also worth being honest that hygiene isn't the only blocker. Adoption is shallow relative to licenses sold: on Microsoft's FY2026 Q2 earnings call the company reported 15 million paid Microsoft 365 Copilot seats, which analyst Kevin Kieller calculated as 3.3% of 450 million paid commercial M365 seats. Microsoft has since reported 20 million and then 30 million paid seats across its next two quarterly calls, growth worth acknowledging, and still a single-digit share of the commercial base. A perfectly governed estate with no enablement still stalls.

Where to start this quarter

Pick one cohort. Run the five checks against only the content that cohort touches. Write down the index scope. Then connect.

If you want that audit done independently before anything is authorised, our Workshop & Assessment is a short fixed-scope engagement that delivers the owner map, canonical-document decisions, sharing and stale-account review, and a recommended index scope as a written report. It's a cheap way to find out how much content work sits between you and a working pilot.

What did your last permissions review actually surface?