EPC Group has published TAR-8, a framework for testing whether Microsoft 365 and Azure environments are actually ready for Copilot, AI agents and approved external models. Its useful idea is refreshingly concrete: do not ask only who has an AI licence, ask what the system can find, change, retain or transmit, and show the evidence.
Watch Desk analysis
What happened
TAR-8 scores eight areas from 0 to 3, for a maximum of 24 points. The surfaces cover identity, sensitive data, content, conversations, reports and dashboards, business applications and customer records, infrastructure and external models, plus ownership and evidence.
The published rubric sets practical gates. A score of 0 on any surface means the tenant is not ready under the standard. Identity, sensitive data and content must each reach at least 2 before broad Copilot enablement. Conversations, reports and business applications must reach at least 2 before agents can take actions, while infrastructure and external models must reach at least 2 before an outside model is connected to tenant data.
Each score is meant to be backed by evidence such as policy exports, access tests, audit logs, agent inventories or tested retrieval and transmission paths. EPC Group says its optional assessment is read-only and produces a prioritised remediation sequence and an evidence pack. The company’s public framework is not an external audit, regulatory approval or certification.
Key findings
- Eight connected surfaces
The rubric links permissions, data, agents, models and accountability instead of treating AI readiness as a licensing exercise. - A 24-point scale
Each surface is rated from unknown to evidenced, with level 3 requiring recent operating proof. - Deployment gates
A strong total cannot compensate for a missing prerequisite, particularly around identity, data and action-taking agents. - External-model checks
Connecting Claude, ChatGPT, Gemini or a private model requires testing what data crosses the boundary and what is logged. - Quarterly ownership
The framework calls for named decision-makers, review intervals and records showing that controls continue to operate.
Why it matters
AI systems inherit the permissions, data quality and governance of the environments they enter. A Copilot licence may show who can use a tool, but it does not prove that a Teams transcript is governed, a dashboard metric is trustworthy or an agent cannot alter a customer record without approval.
That makes TAR-8 useful as a checklist for deployment conversations, especially for organisations connecting several model providers to the same business data. It also makes the sales boundary important: EPC Group is describing its own method, not presenting independent evidence that the framework makes a tenant safe.
Our read
The strongest part is the insistence on operational evidence. “We configured the control” is a very different sentence from “here is the recent log showing it worked”. The eyebrow-raising bit is that this sensible discipline arrives wrapped in a commercial assessment offering, so buyers should use the rubric as a starting point rather than mistake it for a neutral seal of approval.
Read the TAR-8 report if your organisation is preparing an agent rollout. The practical takeaway is to test permissions, connectors, approvals and data paths before testing how enthusiastically the demo says “absolutely”.
What to watch
- Whether organisations publish evidence that the proposed gates changed real deployment decisions.
- How the framework handles failures in retrieval, connector permissions and agent actions.
- Whether Microsoft or independent auditors adopt comparable evidence-based readiness measures.
- Whether the 0-to-3 scoring survives contact with complex, multi-provider environments.
Discussion spark: Should AI-readiness frameworks such as TAR-8 be treated as useful public checklists, or do commercial scoring methods need independent audit before organisations rely on them?
Sources and evidence
- EPC Group Publishes TAR-8, the 8-Surface Tenant AI Readiness Standard for Microsoft 365 and Azure – AiThority (24 September 2026, 08:37 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.