This week in AI: Copilot billing, Google checkout and an ID breach

Three things happened this week that a small business owner could miss entirely and still feel later: on a Microsoft bill, in a Shopify sales report, or in a letter from a privacy regulator. None of them needs a panic. Two of them need a setting checked.

The first is about how AI gets paid for. The second is about where your customers actually buy. The third is not an AI story at all, but it is the clearest reminder in months of what happens to customer data you hand to a software vendor.

Microsoft now charges for Copilot's agents by the job

On September 25, Microsoft relaunched its Copilot app as three sections. Home puts chat and Cowork, Microsoft's agent that carries out multi-step tasks, in one place, with Word, Excel and PowerPoint running inside the app. Code lets people who are not programmers build small tools, such as a dashboard or an internal app, by describing what they want. Autopilot is what Microsoft calls a "persistent, proactive and personal agent that keeps working even when you're not": it handles recurring tasks and follow-ups under its own identity inside your Microsoft 365 account.

An agent, in this sense, is software that is given a goal and works through the steps on its own, rather than answering one question at a time.

What changes for a small business

The part that matters most is the bill. As GeekWire reported, Copilot now has two ways to pay. A per-user monthly licence still covers everyday use: chat, and Copilot inside Word, Excel, PowerPoint, Outlook and Teams. The heavier agent work, meaning Cowork, Code and Autopilot, is billed by usage, as are the newest frontier models from OpenAI and Anthropic. Microsoft's chief executive had already told investors in July that the company is moving "beyond per-seat to per-seat-plus-consumption."

For a ten-person office, that is a real change in how to budget. A licence is a fixed number you approve once a year. Usage billing is a meter, and an agent that runs while nobody is watching is exactly the kind of thing that runs the meter up.

The good news is in the defaults. According to GeekWire, the usage-based services are off by default, and administrators can set spending limits for the whole company, for groups or for individual users. Consumer Microsoft 365 subscriptions will also get usage billing for the new features later this year.

What to do

Nothing yet, for most businesses. Most of this is not broadly available. Code is with Microsoft's Frontier early-access customers now, with a preview for Microsoft 365 Premium and Pro subscribers later this year, and Autopilot goes to a private preview at the end of the month.

When it does reach you, set a company-wide spending limit before anyone turns on an agent, not after the first invoice. And decide who in the business is allowed to create an always-on agent at all. Microsoft's own Copilot executive Jacob Andreou put the risk plainly: the autonomy that makes a long-running agent useful "is the same thing that makes them absolutely terrifying to an IT admin."

Google turned on checkout inside its AI for Shopify stores

On September 22, eligible Shopify merchants received an email from Google that, as PPC Land reported, read: "Your Shopify store was matched to your Merchant Center, enabling native checkout on Google AI Mode and Gemini." The next line settled who had opted in: "Eligible products are automatically included."

In plain terms, a shopper who asks Google's AI Mode or the Gemini app about a product can now buy it right there, without visiting your store. Google Merchant Center is the free Google account that holds your product listings for Google Shopping; if your Shopify store feeds it, your products may already be part of this. The system underneath is Google's Universal Commerce Protocol, an open standard that lets AI assistants place orders with shops.

What changes for a small business

You still make the sale. ContentGrip notes that the retailer remains the seller of record, while Google Pay handles payment and shipping details inside the flow. What you lose is the visit. The shopper never sees your product pages, your bundles or your "you might also like" row.

You also lose some of your measurement. ContentGrip, citing Search Engine Land, reports that certain custom pixels and client-side Google Analytics tracking are not supported in this checkout. If you run ads and judge them by what your analytics says they sold, sales through Google's AI can show up as orders with no visit attached.

You still make the sale. What you lose is the visit.

The reporting describes this as a US rollout for eligible US Shopify merchants, and Google's own documentation still calls the wider programme phased and limited to selected merchants. So for most Canadian stores this is a preview of what is coming rather than something already switched on.

What to do

If you sell through Shopify and have products in Merchant Center, especially to US customers, check the setting this week. PPC Land gives the path: in the Shopify admin, go to Sales channels, then Agentic, where native checkout has to be turned off by hand.

Whether to turn it off is a business decision, not a technical one. If most of your margin comes from what people add to the basket once they are on your site, or if your ad reporting depends on on-site tracking, you may want to keep checkout at home for now. If you sell single items that people already know they want, one less step may be worth more than the visit.

Ottawa is investigating a breach of scanned driver's licences

On September 21, the Privacy Commissioner of Canada opened an investigation into a data breach at IDScan.net. The company's technology is used by hospitality and nightlife businesses to check customers' government-issued ID, and the stolen data includes digital scans of driver's licences and other identification.

The commissioner is examining the security safeguards IDScan.net had in place, and whether its notices to affected people were adequate, to decide whether it complied with PIPEDA, Canada's federal private-sector privacy law.

What changes for a small business

CBC News reports that IDScan.net sells its software to bars, casinos and car rental companies, and that the breach potentially exposed details from millions of licences and other IDs from Canada and the US. The company said an unauthorized third party "may have accessed and/or copied certain customer information stored within their accounts on the IDScan.net cloud," and that it was notifying people and offering free credit monitoring. A threat researcher quoted by CBC, who found his own licence in the stolen data, said: "There's never been a breach of driver's licences at this scale."

This is not an AI story, but it is the same question every AI tool raises. When you use someone else's software to handle your customers' information, their security becomes yours in the eyes of your customers. The bar owner did not lose the licences. The bar's customers still handed them over at the bar's door.

What to do

If you scan IDs at the door or the counter:

1. Ask your vendor in writing whether its product uses IDScan.net software or cloud storage, and whether your customers' data was involved.
2. Find out what your scanner keeps. Many businesses only need to confirm a person's age, not store a copy of the card.
3. Turn off storage you do not need, and set the shortest retention period the system allows.

Then ask the same three questions of every AI tool that touches customer data: what it stores, where, and for how long.

What we're watching

• Microsoft's usage prices. The announcement sets out the model but not what an hour of agent work will cost a small business. We will look again when the features reach ordinary Microsoft 365 business plans.
• Google's checkout outside the US. If the same automatic enrolment reaches Canadian Shopify stores, the setting above becomes urgent rather than advisable.
• The IDScan.net findings. The commissioner's report will say what safeguards were expected. That is useful reading for anyone choosing a vendor that holds customer data.

Where to start

1. If you are on Microsoft 365, find out who in your business is the administrator, and put "set a Copilot spending limit" on their list before any agent feature arrives.
2. If you sell on Shopify, open Sales channels, then Agentic, and make a deliberate choice about native checkout instead of inheriting Google's default.
3. If you scan customer IDs, send your vendor the three questions above this week.

If you would like a second opinion on any of these, you can book a short call with Trimotech.