Programme Status Dashboard
Prepared for Corey Gray · Reporting date Monday 7 September 2026 · Sources: Outlook, Microsoft Teams, SharePoint & OneDrive, plus public vendor and regulatory research
Six workstreams assembled from programme documents, mailbox notifications and the Teams estate. Each card names the evidence it rests on. RAG status is assigned from the presence and age of open blockers, not from a formal status report — no signed-off RAG return was found in the sources searched.
Owner: Corey Gray · Delivery team: AI Agent Governance team (Teams: AI Agent Central)
Sources: AI Agent Central portal page (index.html); AI Agent Central - Deployment Guide; Teams channel creation events, 25 Mar – 2 Apr 2026.
Owner: AI Governance Lead (Accountable: CIO, per the RACI matrix)
Sources: AI_Governance_Policy_Book; AI_Governance_Strategy_RACI; AI_Governance_QuickStart_Checklist; Jira weekly update, 2 September 2026; Daily Task Digest, 6 September 2026.
Owner: Corey Gray · Stakeholder awaiting update: Adil Eli
Sources: Draft roadmap for AI/agentic integration (Zava S2P Agent); GovernedAI Governance Framework for S2P Agent; Daily Task Digest, 6 September 2026.
Owner: Corey Gray · Approval body: Leadership
Sources: Draft initial AI/agentic roadmap document; Define roadmap milestones and deliverables; Establish metrics and KPI linkage for roadmap; Review and finalize roadmap with leadership.
Owner: Corey Gray with Executive Sponsor · RFP-ERP-D365-2026-001
Sources: Executive_Procurement_Brief_ERP_Integration_2026 (Market Analysis, Compliance Status, Vendor Comparison, Recommendation); RFP_Response_Zava_Trading (Pricing, SLA & Support).
Owner: Corey Gray (Microsoft 365 admin actions)
Sources: “Your Copilot connection ServiceNowTickets2607141032 needs immediate attention”, 22 Aug 2026; “Alert! We've disabled one of your flows”, 25 Aug 2026; Power Automate failure notices, Aug 2026; Daily Task Digest, 6 September 2026.
Internal milestones are dated from the documents and system records that evidence them. External milestones — marked External — are dated from public vendor and regulatory sources and are shown because the programme depends on them.
| ID | Risk | Impact if unmanaged | Severity | Owner | Key date | Evidence |
|---|---|---|---|---|---|---|
| R1 | ServiceNow Copilot connection is failing because the data source instance is hibernated. | Indexed ServiceNow items are deleted, breaking Copilot search over ticket data. | High | Corey Gray | 19 Sep 2026 (12 days) | M365 connection notice, 22 Aug 2026 |
| R2 | Azure OpenAI Assistants API retirement date has passed with no evidence of migration to Foundry Agent Service. | Any workload still on the Assistants API stops working; agent capability outage. | High | Platform Admin (Accountable: IT Director) | 26 Aug 2026 — elapsed | Azure retirement notice, 18 Aug 2026 (tracking ID LZ_6-Y1Z) |
| R3 | ERP procurement compliance is only Partial — the SOW template is missing from the contract pack. | Contract cannot be executed cleanly; award to Zava Trading is exposed on legal review. | High | Corey Gray + Executive Sponsor | Before contract signature | Executive Procurement Brief — Compliance Status |
| R4 | EU AI Act high-risk obligations are in force while agent registration and verification (ZAG-6) remains unassigned. | Regulatory exposure on agents that fall in scope; no owner to classify or document them. | High | AI Governance Lead (Accountable: CIO) | In force since 2 Aug 2026 | Jira weekly update, 2 Sep 2026; public EU AI Act guidance |
| R5 | Jira connector issue unresolved since 12 August 2026. | Programme tracking data in Copilot goes stale; governance backlog reporting is unreliable. | Medium | Corey Gray | Open 26 days | Daily Task Digest, 6 Sep 2026 |
| R6 | ZAG-5 “Draft compliance criteria for agent behavior” is overdue; ZAG-4 scope definition also open. | Agents ship without behavioural acceptance criteria; governance gate is unenforceable. | Medium | AI Governance Lead | Overdue | Daily Task Digest, 6 Sep 2026 (item 7) |
| R7 | S2P agent status update to Adil Eli outstanding for 138 days. | Sponsor confidence erodes on the workstream carrying the 80% adoption target. | Medium | Corey Gray | Raised 22 Apr 2026 | Daily Task Digest, 6 Sep 2026 (item 5) |
| R8 | No EcoVadis or CreditSafe ratings held for any shortlisted ERP vendor; ARIBA/SAP price and contract discrepancies flagged. | Vendor due diligence is incomplete at the point of award. | Medium | Procurement (Corey Gray) | Before award | Executive Procurement Brief — Market Analysis |
| R9 | Recurring Power Automate flow failures, including Cowork Plan Approval; one flow disabled by the platform. | Approval workflows silently stop; requests stall without notification. | Medium | Corey Gray | Aug 2026, recurring | Power Automate failure notices; flow-disabled alert, 25 Aug 2026 |
| R10 | A privileged directory role was assigned outside Privileged Identity Management. | Standing privilege outside the approval and audit path, against the programme's own identity controls. | Medium | Security Officer | Flagged 20 Aug 2026 | PIM alert: “A privileged directory role was assigned outside of PIM” |
Public vendor roadmap and regulatory research, retrieved 7 September 2026. These are outside the organisation's control but set the dates the programme has to plan around.
Announced generally available on 1 May 2026 as a centralised control plane to discover, manage, govern and secure AI agents across the environment, together with previews for discovering and managing shadow AI agents.
Why it matters: AI Agent Central v3 already advertises Agent 365 integration. Shadow-agent discovery is the capability that would close the ZAG-6 agent registration and verification gap.
microsoft.com/en-us/security/blog/2026/05/01/microsoft-agent-365-now-generally-available-expands-capabilities-and-integrations/The April 2026 Copilot Studio release added agent governance improvements, intelligent workflows, more control over agent operations and an expanded agent usage estimator; Microsoft has separately published six core capabilities for scaling agent adoption in 2026, covering governance, security and operational readiness.
Why it matters: The usage estimator and operational controls map directly onto the financial-governance pillar — token caps, cost attribution and monitoring — in the internal RACI plan.
microsoft.com/en-us/microsoft-copilot/blog/copilot-studio/6-core-capabilities-to-scale-agent-adoption-in-2026/Obligations for high-risk AI systems took legal effect on 2 August 2026, covering Articles 9–17 for providers and Article 26 for deployers — risk management, data governance, technical documentation and transparency. Reported penalties reach €35M or 7% of global revenue, and one industry analysis put the share of organisations unprepared at 78%.
Why it matters: Paris-based operations put this squarely in scope. The internal governance pack covers data residency and DLP, but no risk classification of the S2P, Sales or ESS agents against Annex III was found.
labs.cloudsecurityalliance.org/research/csa-research-note-eu-ai-act-high-risk-compliance-deadline-20/Microsoft ships Dynamics 365 updates on a twice-yearly cadence: wave 1 covers April to September, wave 2 covers October to March. Features reach designated sandbox environments for early access roughly 4–6 weeks before general availability.
Why it matters: Gives a concrete validation window for the D365 integration ahead of the October wave — worth aligning with the Zava Trading onboarding workshop rather than running it cold.
learn.microsoft.com/en-us/dynamics365/get-started/release-scheduleGartner forecasts that 40% of enterprise applications will embed task-specific AI agents by the end of 2026, up from under 5% in 2025. Against that, published surveys put roughly 31% of enterprises as actually running agents in production.
Why it matters: The internal S2P target of 80% of business units is well above the current market production rate — an ambitious goal that needs the adoption curve stated explicitly when the roadmap goes to leadership.
digitalapplied.com/blog/ai-agent-adoption-2026-enterprise-data-pointsMicrosoft positions Foundry Agent Service as the consolidated, OpenAI-compatible successor to overlapping preview surfaces, and continues to publish monthly product updates through August 2026. Classic agents are explicitly unaffected by the Assistants API retirement.
Why it matters: The retirement date passed on 26 August 2026. Confirming which subscription workloads were on the Assistants API — and whether they were purely model-inferencing, in which case the Responses API is sufficient — is the fastest way to close R2.
learn.microsoft.com/en-us/azure/foundry/whats-new-foundry