Hiscox's Citizen AI Programme Put Copilot Studio in Front of the Whole Business
Hiscox's reasoning is simple. The people who understand a business problem best are usually the ones dealing with it every day. They know where information is hard to find and which repetitive jobs cause delays. James Jackson, Hiscox's Data Culture and AI Lead, says Citizen AI means putting the tools in the hands of the people who do the tasks. He names underwriters, claims professionals, finance and HR staff as the intended builders, with AI adding to their work rather than taking it over.
The main tools are Microsoft Copilot for everyday help and Copilot Studio for building agents. Copilot Studio is Microsoft's low-code agent builder. Microsoft's own Inside Track blog describes it as providing a low-code environment for citizen developers to create Microsoft 365 Copilot extensions. Those agents can customize Copilot's behavior with additional instructions, grounding, and actions. That low bar is the reason 3,500 people could produce 6,000 agents. It is also why governance becomes a problem.
The case study says the agents do more than assist: they complete tasks. It doesn't say whether the 6,000 figure counts published agents, active agents or abandoned experiments. At nearly two agents per employee, the figure most likely includes a long tail of personal, single-purpose builds (our inference). It should not be read as 6,000 agents in production across the enterprise.
Tone of Voice Agent and a 20-Minute Workflow Show the Scale of Individual Wins
The named examples are small and specific. Paul Lawrence, Chief Underwriting Officer for Hiscox London Market, built a "Tone of Voice" agent that checks language is on-brand and consistent in style. He used it to help prepare two board reports and estimates it saved him six or seven hours, which he spent working with brokers and underwriting teams. Jackson says versions of the agent have spread to other senior executives and their assistants. They use it for board presentations, material for external meetings and everyday communications.
Jack Gargrave, a trading manager, built an agent workflow that automates a series of tasks. The work previously took around three hours and now takes about 20 minutes. The story doesn't name the tasks or say how the time was measured.
Across the company, colleagues report saving an average of two to five hours a week, and some save much more. Jackson estimates that productive time returned to the business and costs avoided have "already passed seven figures." That is an internal estimate with no stated method, period or currency. It counts avoided costs and recovered time, not cash taken off the balance sheet. No other outlet has reported Hiscox's figures, so they rest on the company's own account in a Microsoft-published story.
Other examples use plain Copilot and no custom agent at all. At the start of each week, Learning and Development Manager James Welford asks Copilot to go through his team's messages and his Outlook email and build a to-do list, so smaller items don't slip. Paola Hristova, Business Readiness Lead in the UK, uses Copilot to challenge her assumptions and test an approach from different angles. She calls it "almost like a sounding board" for thinking about governance and risk.
Hiscox Treats Duplicate Agents as Evidence of Wider Demand
The most transferable idea in the Hiscox account is how it reads duplication. Many IT teams see ten staff building the same agent as waste. Jackson's team sees it as evidence that a need is shared across the business.
When several people build agents for the same task, the team can bring in data science, technology, cyber and risk specialists to turn the idea into a more refined, shared tool. Hiscox has already done this with agents that extract contact information from emails. Several individual solutions are now becoming a larger business project. The case study doesn't say whether that project has shipped or how it is built. Jackson describes his job as making such ideas "make sense for the entire business" and getting them the right level of support.
This works as a demand-discovery system. Employees prototype cheaply, and the pattern of their prototypes tells central IT where to invest in engineering. The system only works if someone can see the prototypes, which is why governance tooling is central to the model.
Training, Not Licences, Moved Hiscox's Copilot Adoption From 4% to 74%
Hiscox says access to the tools on its own didn't change how people worked. Earlier in 2026 it had around 200 active Copilot users. Six months later, usage reached about 3,200 people on busy days, which the company describes as a rise from 4% to 74% adoption.
Those figures don't quite add up. Against a workforce of about 3,500, 200 users would be closer to 6%, and 3,200 would be above 90%, not 74%. Our inference is that the percentages use a different base or a different measure than the busy-day headcount, perhaps an average rather than a peak. The direction is clear. The exact adoption rate depends on a definition the story doesn't give.
Hiscox credits regular training and visible support from leaders for closing the gap. It says it has trained more than 3,000 colleagues and run executive workshops, employee events and an ongoing practical-skills programme. The programme covers writing better prompts, using AI in meetings and building agents. Jackson, a former teacher, treated training as a core part of the rollout. He says Hiscox has delivered "thousands of hours of training" and built a dedicated AI hub whose resources are updated every week. Before any of that, the company started small: it asked staff to list the annoyances in their own jobs, such as repeated tasks, frustrating searches and slow processes, and then looked at which parts Copilot could handle.
Outside practitioners give similar advice. Consultancy VisualLabs notes that natural-language agent building lowers the barrier to entry, but it doesn't remove the need for structure, governance, and training.
RAISE and Microsoft Agent 365 Arrive After the Agents Did
Hiscox acknowledges the downside of rapid, bottom-up agent building. The problems it names are duplication, observability and governance. It needs to know that agents built by staff handle proprietary data safely, and that confidential data can only be reached by people with the right clearance.
The company has two answers. The first is RAISE, its existing responsible-AI process for assessing higher-risk uses of AI. Hiscox is refining it so that scrutiny rises with the level of risk. The story doesn't expand the acronym or list its criteria. The second is Microsoft Agent 365, which Hiscox says it is now introducing. Jackson says it will help the company see what has been built, identify duplication and flag agents that could pose a risk. Hiscox is still rolling it out. The case study doesn't show Agent 365 covering all 6,000 agents or report any results from it yet.
What Agent 365 actually is
Microsoft announced general availability of Agent 365 for commercial customers on May 1, 2026, in a Microsoft Security blog post. It describes the product as a control plane, a central management layer, for observing, governing and securing agents using existing admin and security tools. Independent reporting agrees on the basics. Cloudmagazin describes Agent 365 as a control plane that makes agents visible – including those from ecosystem partners – and controls them with existing admin and security tools.
Microsoft's product page splits the work across four admin roles:
- Microsoft 365 admins get the agent inventory, onboarding through IT-controlled workflows with security policy templates, and agent analytics.
- Microsoft Entra admins protect agent identities and control access to apps, resources, the internet and other agents.
- Microsoft Purview admins govern the data agents use and create.
- Microsoft Defender admins extend security posture management and threat protection to agents.
For a Hiscox-style estate, the lifecycle features matter most. Microsoft says Agent 365 supports rules-based policies such as expiring inactive agents, flagging agents with no owner and blocking risky ones. Those map directly onto Jackson's goals of finding duplicates and flagging risk.
The inventory boundary admins should understand
Automatic discovery has a limit. Microsoft says agents published through Microsoft 365 channels and registered with an Entra Agent ID (an identity in Microsoft Entra for the agent itself) appear in the Agent 365 inventory automatically. Agents built outside those environments need extra steps. Microsoft lists agents built in Copilot Studio or Microsoft Foundry, prebuilt agents in Microsoft 365 Copilot and Teams, and certain partner agents as supported. Several broader discovery features were still in preview at launch. They include syncing the registry with AWS Bedrock and Google Cloud, and finding local agents on Windows devices through Defender and Intune. Hiscox's agents were built on Copilot and Copilot Studio, so they should fit the automatic path. The case study doesn't confirm how they are registered.
Licensing also shapes the decision. Agent 365 costs USD 15 per user per month on an annual commitment, or comes included in Microsoft 365 E7, which lists at USD 99 per user per month. Microsoft recommends a licence for every user who interacts with, owns, manages or sponsors an Agent 365–managed agent. In a Citizen AI model, where nearly everyone is a builder, that can mean close to the whole workforce. Hiscox hasn't said which licensing route it uses.
What Hiscox's Agent Model Means for Microsoft 365 Admins
If you run a Microsoft 365 tenant, decide whether your governance will come before or after your agents. Hiscox trained people first, let thousands of agents appear, and is now adding Agent 365 and a risk-tiered RAISE process on top. That order produced adoption and useful signals about demand. It also means the company is doing inventory after the fact.
Security researchers warn about how much a low-code builder hides. Pluto Security writes that in Copilot Studio every shortcut compresses an architectural decision into a single click. That is the argument for having visibility in place before a builder programme scales, not after.
- Treat a figure like Hiscox's 6,000 agents as a count of builds, not of production workloads, and set your own definition of an "active" agent before you report adoption.
- Use duplicate agents as a demand signal: when several staff build the same agent, pass it to a central team, as Hiscox did with its email contact-extraction agents.
- Budget for training alongside licences, since Hiscox credits trained staff and visible executive support, not tool access, for its rise from about 200 to about 3,200 busy-day Copilot users.
- Check whether your agents are published through Microsoft 365 channels with an Entra Agent ID, because only those appear in the Agent 365 inventory automatically.
- Scale review to risk, as Hiscox is doing with RAISE, so a personal to-do-list prompt doesn't get the same scrutiny as an agent that touches confidential underwriting data.
- Model Agent 365 licensing against your number of builders and sponsors, not just IT staff, because Microsoft recommends a licence for everyone who owns, manages, sponsors or uses a managed agent.
Hiscox's savings figures come from a corporate case study, not a controlled study. The practical lesson is the operating model: people who know the work find the problems, cheap agents test the fixes, repeated fixes show where the business needs a shared tool, and governance gets stricter as risk rises. Agent 365 is how Hiscox plans to make that model last. The next thing to watch is whether it actually surfaces the duplicates and risky agents Jackson expects across an estate that grew before anyone was counting.