Microsoft 365 Copilot compliance: GDPR, AI Act, DPA, training, transfers

TL;DR. Microsoft acts as processor under its DPA, and its Product Terms commit that Microsoft's generative AI services will not use Customer Data to train foundation models. For tenants provisioned in the EU or EFTA, Copilot is an EU Data Boundary service with three main Copilot-specific exceptions: Bing web search queries (outside the DPA and the boundary), flex routing (inferencing outside the boundary at peak demand) and Anthropic models (excluded from the boundary). Previews are also excluded from the boundary. Web search is on by default in every commercial tenant, whatever its creation date. Flex routing (eligible EU and EFTA tenants, not Multi-Geo) and Anthropic models in Word, Excel and PowerPoint (EU, EFTA and UK tenants) are on by default for tenants created after 25 March 2026. For older tenants (those that existed on or before 25 March 2026 for flex routing, and before 25 March 2026 for the Word, Excel and PowerPoint setting), Microsoft asks admins to check the setting rather than stating a default. UK tenants are outside the EU Data Boundary and flex routing. The wider Anthropic subprocessor setting is off by default throughout the EU, EFTA and UK. Copilot Chat, used with a work or school account, is under the same DPA and is listed in scope for the HIPAA BAA.

DPO action: in the Microsoft 365 admin centre (Copilot > Settings > View all), check "Flex routing during peak load periods" (EU and EFTA tenants) and "AI providers operating as Microsoft subprocessors", which holds the Anthropic and OpenAI settings and the separate Anthropic setting for Word, Excel and PowerPoint. Decide whether to allow web search, which is on by default in commercial tenants and sends generated queries to Bing outside the DPA. Record each decision in the DPIA. For PHI, the BAA applies by default through the DPA, but minimum-necessary access across the Graph is the main HIPAA control.

What the tool does

Microsoft 365 Copilot is an AI assistant embedded in Word, Excel, PowerPoint, Outlook, Teams and the wider Microsoft 365 stack. It draws on the user's tenant data (emails, files, chats) through Microsoft Graph and combines that with large language models to generate text, summaries, action items and draft documents. Microsoft has renamed it Microsoft Copilot, and Microsoft 365 Copilot Chat is now Microsoft Copilot Chat, on Microsoft Learn (Microsoft states there are no changes to security, compliance and privacy), although the Product Terms and some licences still use the old names.

Copilot Chat is used with a work or school account and is grounded in the web by default rather than in organisational content, but Microsoft applies the same DPA, Product Terms and enterprise data protection to it. Buyers should still record it separately in a DPIA because its grounding differs. Consumer Copilot (Microsoft 365 Personal and Family) is a different product, and Copilot Studio (the agent platform) is a separate compliance evaluation again.

Data processed

The hard part of this profile is that Copilot processes a lot:

• Email content (Outlook)
• Document content (OneDrive, SharePoint)
• Chat and meeting transcripts (Teams)
• Calendar data
• User identity and permissions
• Anything else accessible via the user's M365 Graph permissions

Special-category likelihood: Very high. Copilot reads anything the signed-in user can read. In a typical SME, that includes HR records, performance reviews, financial data, and customer correspondence. DPIA is not optional for any deployment.

Default geographic processing: Copilot is an EU Data Boundary service for tenants provisioned in the EU or EFTA, subject to the exceptions set out under EU / UK transfer position below (flex routing, Anthropic models and Bing web search queries). UK tenants are outside the EU Data Boundary.

DPA availability

Microsoft 365 Copilot is governed by the Microsoft Product Terms and Data Protection Addendum (DPA), both publicly available and incorporated by reference into all M365 commercial agreements.

• DPA URL: aka.ms/DPA resolves to Microsoft's DPA page
• Sign-up requirement: applies automatically to all M365 commercial customers
• Current edition at this review: the Microsoft Products and Services Data Protection Addendum, last updated 22 May 2026

The DPA makes the customer the controller and Microsoft the processor of Personal Data, which covers Copilot prompts, responses and the tenant content Copilot reads. Microsoft acts as an independent controller when it processes Personal Data for business operations incident to providing the Products and Services to the customer, which the DPA defines as the processing operations the customer authorises in that section. Several Copilot routes fall wholly or partly outside the DPA:

• Web search. When web search is on, Copilot sends a generated search query to Bing. Microsoft describes the query as a few words informed by the prompt. It excludes the user's entire prompt "unless the prompt is very short", and excludes entire files, but when a user prompts Copilot inside a Microsoft 365 app or references a specific document, the query "may also be informed by data within a Microsoft 365 document". Microsoft handles the query as a controller under the Product Terms, and states: "The Microsoft Products and Services Data Protection Addendum (DPA) doesn't apply to the use of generated web search queries in Microsoft Copilot, Microsoft Copilot Chat, or the Bing search service. Also, HIPAA compliance and the EU Data Boundary don't apply to generated search queries." Web search is on by default in commercial tenants: it is available to users unless an admin configures the "Allow web search in Copilot" policy or disables optional connected experiences. In GCC and DoD tenants it is off by default.
• Anthropic models with Data Retention. These opt-in models are off by default. Where an admin enables them, Anthropic acts as an independent processor under its own Commercial Terms and DPA, and Microsoft states that the data is "not subject to your Microsoft Customer Agreement including commitments in the Product Terms and DPA".
• Mistral and SpaceXAI models. These are hosted by the providers outside Microsoft, are available only after an admin accepts the providers' terms, and are offered in Copilot Studio (Mistral) and in Copilot Studio and Copilot Cowork (SpaceXAI). Microsoft states that the Product Terms and DPA do not apply to them.
• Previews. The Product Terms define EU Data Boundary Services "excluding any Previews". For Previews that do not allow Personal Data processing, the DPA's terms on processing of Personal Data and the GDPR, on data security and on the HIPAA Business Associate Agreement do not apply. Previews that allow Personal Data processing are covered by the DPA with three exceptions. Preview Data "may be transferred to, and stored and processed in, the United States or any other country in which Microsoft or its Subprocessors operate". Microsoft may delete Preview Data when a Preview ends, even if the Preview is later made generally available. Previews may also be subject to additional terms provided with them. Unless Microsoft notes otherwise, the DPA tells customers not to use Previews to process Personal Data or other regulated data.

Breach notification: the DPA commits Microsoft to notify the customer of a Security Incident "promptly and without undue delay", and Appendix A adds that notification will be made "without undue delay and, in any event, within 72 hours."

Subprocessor list

Microsoft publishes the Microsoft Online Services Subprocessors List on the Service Trust Portal. The AI model providers that matter for Copilot are:

• OpenAI: Copilot uses OpenAI's GPT models. OpenAI was not on the Subprocessors List before 23 June 2026, and Microsoft describes Copilot as relying primarily on Azure OpenAI models when it was first certified in 2025. Microsoft hosts and operates those models itself and states for them that "Data does not leave Microsoft". Microsoft added OpenAI to the Subprocessors List on 23 June 2026 for "OpenAI operated models", available from 9 July 2026. Since 24 July 2026 these models have been enabled for all users of eligible commercial customers unless an admin selects No users. Microsoft's page does not define "eligible commercial customers" and states no exception for EU, EFTA or UK tenants. The only availability limit it gives is that OpenAI-operated models are not available in government clouds (GCC, GCC High, DoD) or sovereign clouds. Its Exclusions section adds three points: certifications for OpenAI-operated models are "maintained and managed by OpenAI", the models are not FedRAMP High authorized, and OpenAI's Zero Data Retention for the Responses API used by Microsoft is subject to the limitations and feature-specific data handling practices in OpenAI's own documentation. Microsoft states that OpenAI-operated models are excluded from in-country processing commitments and are included in the EU Data Boundary "except as otherwise noted in the EU Data Boundary documentation". That documentation states that an AI subprocessor, for troubleshooting, debugging and security purposes, "may process and store a pseudonymized user ID or session GUID outside the EU Data Boundary, including in the United States."
• Anthropic: added as a subprocessor effective 7 January 2026; on by default in most commercial-cloud regions, off by default in the EU, EFTA and UK (except Copilot in Word, Excel and PowerPoint for EU, EFTA and UK tenants created after 25 March 2026, described below)
• Various support, analytics, and infrastructure subprocessors

For subprocessors that support AI functionality, the May 2026 DPA gives "30 days' notice with the ability to disable use of that subprocessor until at least 6 months after notice", rather than the 6 months' advance notice that applies to other new subprocessors with access to Customer Data. A new AI subprocessor can therefore receive Customer Data 30 days after notice, which matches the OpenAI timeline (added 23 June 2026, on by default from 24 July 2026), and the admin's protection is the ability to disable it.

The carve-out worth flagging: when Copilot uses Anthropic models, the processing falls outside the Microsoft EU Data Boundary. Microsoft's page on Anthropic models in Microsoft Online Services (last updated 18 September 2026) states:

"Anthropic models deployed in Microsoft offerings such as Microsoft Copilot, Researcher, Copilot Studio, Power Platform, and Copilot in Microsoft 365 apps are currently excluded from the EU Data Boundary, and when applicable, in-country processing commitments. Customers within the EU Data Boundary and customers in the UK have Anthropic models disabled by default."

Microsoft turns Anthropic models on by default for most commercial-cloud customers, but not in the EU, EFTA or UK. In those regions the "AI providers operating as Microsoft subprocessors" setting for Anthropic appears with its default set to No users, as it has since the setting was introduced in December 2025. A separate setting introduced on 3 April 2026, described by Microsoft as "Copilot in Microsoft 365 apps with Anthropic models", makes Anthropic the default model for Copilot in Word, Excel and PowerPoint. Microsoft states that this setting is on by default for EU, EFTA and UK tenants created after 25 March 2026, and tells tenants that existed before that date to check the Message Center for their default. When Anthropic models are used in Word, Excel or PowerPoint, the processing takes place outside the EU Data Boundary. Both settings are reached through Copilot > Settings > View all > AI providers operating as Microsoft subprocessors in the Microsoft 365 admin centre. When the Anthropic subprocessor setting is enabled for all users or for specific users and groups, the Word, Excel and PowerPoint setting is unavailable and cannot be changed. Microsoft decommissioned the earlier Anthropic independent processor (IP) setting on 1 May 2026.

Training-on-customer-data position

Copilot does not use Customer Data, including prompts, responses and data accessed through Microsoft Graph, to train foundation models. The contractual commitment is in the Product Terms (Universal License Terms for Online Services, "Use of Content for Training"): "Microsoft Generative AI Services will not use Customer Data to train any generative AI foundation model, except pursuant to Customer's documented instructions." Microsoft's Copilot privacy documentation describes the position this way: "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot."

Optional user feedback is treated differently. Microsoft may use it to improve Copilot, states that it does not use that feedback to train the foundation LLMs, and gives admins controls to manage it.

Sources: Microsoft Product Terms, Universal License Terms for Online Services; Microsoft Learn, "Data, Privacy, and Security for Microsoft Copilot".

Retention and deletion

Copilot stores each prompt and response, with citations to the content used to ground the response, as the user's Copilot activity history. Microsoft's Purview documentation states that this data is held in a hidden folder in the mailbox of the user who runs the AI app, where compliance administrators can search it with eDiscovery. Admins set retention and deletion with Microsoft Purview retention policies, and users can delete their own activity history through the My Account portal. Microsoft states that Copilot services have opted out of the abuse monitoring available in Azure OpenAI, which includes human review of content.

After a subscription ends, the DPA keeps Customer Data in a limited-function account for 90 days so the customer can extract it, and Microsoft then deletes it within a further 90 days unless the DPA authorises retention. The opt-in Anthropic models with Data Retention are the exception to this picture: Anthropic, not Microsoft, keeps most inputs and outputs for up to 30 days. Where Anthropic's trust and safety classifiers identify potential violations of its Usage Policy, Microsoft's page states that Anthropic "may retain content (inputs and outputs) for up to two years and trust and safety classification scores for up to seven years."

EU / UK transfer position

The position depends on where the tenant is provisioned, when it was created and how its admin settings are configured.

EU Data Boundary scope. Under the Product Terms, a Microsoft 365 tenant provisioned in the EU or EFTA is in scope for the EU Data Boundary unless the customer has also bought the Multi-Geo Capabilities add-on. Microsoft 365 Copilot and Microsoft 365 Copilot Chat are listed as EU Data Boundary Services, for which Microsoft commits to store and process Customer Data and Personal Data within the boundary. Copilot was added to Microsoft's data residency commitments on 1 March 2024. The Product Terms list limited transfers that apply to every EU Data Boundary service, for example remote access by Microsoft personnel outside the boundary to operate, troubleshoot, support and secure the service.

Flex routing (EU and EFTA). Flex routing lets LLM inferencing for Copilot and Copilot Chat take place outside the EU Data Boundary during periods of peak demand. Microsoft's EU Data Boundary transfers page states that Copilot prompts, responses and grounding data may then be processed outside the boundary and that pseudonymous user IDs may be stored there for security and operational purposes. Other data at rest stays inside the boundary.

• Flex routing is on by default for eligible tenants created after 25 March 2026. Eligible means in scope for the EU Data Boundary, so tenants that have purchased or used Multi-Geo Capabilities are excluded.
• For eligible tenants that existed on or before 25 March 2026, Microsoft's public page states no default and encourages admins to check their tenant's setting. Microsoft notified tenants through Message Center post MC1269223, which gave 17 April 2026 as the effective date and told the receiving tenant that flex routing was enabled by default for it. Message Center posts are visible only inside tenants and the text cited here comes from a third-party reproduction, so an older tenant's setting should be confirmed in the admin centre rather than assumed.
• An admin with the AI Administrator role changes the setting under Copilot > Settings > View all > Flex routing during peak load periods. That setting covers Microsoft Copilot and Copilot Chat, and a separate Power Platform admin centre setting covers Copilot experiences in Dynamics 365, Power Platform and Copilot Studio.

Microsoft's own pages differ on this point. Microsoft's main Copilot privacy page, as read on 14 October 2026, states "For EU customers, Microsoft Copilot is an EU Data Boundary service" and "EU traffic stays within the EU Data Boundary while worldwide traffic can be sent to the EU and other countries or regions for LLM processing." It does not mention flex routing. The flex routing page (last updated 29 September 2026) and the EU Data Boundary page on ongoing partial transfers describe the peak-demand exception. Those two pages also word the destinations differently: the flex routing page says inferencing "may occur in the United States, Canada, or Australia", while the transfers page says processing may take place outside the boundary "including in the United States, Canada, and Australia". A DPIA should record both statements alongside the tenant's actual flex routing setting.

Anthropic, OpenAI and web search. Anthropic models are excluded from the EU Data Boundary wherever they are used (see Subprocessor list above). OpenAI-operated models are included in the EU Data Boundary "except as otherwise noted in the EU Data Boundary documentation", which allows an AI subprocessor to process and store a pseudonymised user ID or session GUID outside the boundary, including in the United States. Generated web search queries sent to Bing are outside the EU Data Boundary, and web search is on by default in commercial tenants (see DPA availability above).

Taken together. For an EU or EFTA tenant created after 25 March 2026, Microsoft's defaults allow three routes outside the EU Data Boundary: generated web search queries sent to Bing, inferencing at peak demand through flex routing (eligible tenants), and Anthropic models in Word, Excel and PowerPoint. The wider Anthropic subprocessor setting stays off unless an admin opts in. For an older tenant, web search is still on by default, and the flex routing and Word, Excel and PowerPoint settings should be checked in the admin centre because Microsoft's public pages state no default for them.

UK tenants. A tenant provisioned in the UK is outside the EU Data Boundary and outside flex routing. Under the Product Terms, Microsoft stores certain Customer Data at rest in the UK for a UK-provisioned tenant, including stored content of interactions with Microsoft 365 Copilot and Microsoft 365 Copilot Chat, but LLM processing is not limited to the UK: Microsoft's privacy page states that "Customers outside the EU may have their queries processed in the US, EU, or other regions." The Anthropic subprocessor setting is off by default for UK tenants, while the Word, Excel and PowerPoint Anthropic setting is on by default for UK tenants created after 25 March 2026.

Transfer mechanism. The DPA makes all transfers of Customer Data and Personal Data out of the EU, EEA, UK and Switzerland subject to "the terms of the 2021 Standard Contractual Clauses implemented by Microsoft". It defines those clauses as the processor-to-processor module between Microsoft Ireland Operations Limited and Microsoft Corporation (Module Three in the Commission's numbering, which is our gloss rather than the DPA's wording), so the customer is not a party to them. Transfers from the UK are also subject to the IDTA, the name Microsoft uses for the UK Information Commissioner's international data transfer addendum to the SCCs.

EU-US Data Privacy Framework: Microsoft Corporation appears on the participant registry with all three certifications, EU-US, Swiss-US and the UK Extension, each running to 31 August 2027. When the register was checked on 9 and 14 October 2026 the status of all three was "Active". On 8 September and 4 October 2026 it had read "Active - Re-certification under Review", the register's wording for an annual re-certification in progress. The DPA also states that Microsoft is certified to the EU-US and Swiss-US frameworks and the UK Extension.

For EU and EFTA tenants, Copilot remains an EU Data Boundary service under the Product Terms, but Bing web search queries, flex routing and Anthropic models can each take processing outside the boundary. Web search is on by default in every commercial tenant, and the other two are on by default for tenants created after 25 March 2026 (flex routing for eligible tenants only). A DPIA should record the tenant's actual settings and the decision taken on each. - My read

Security documentation

Microsoft's certifications relevant to Copilot, as stated on its public pages:

• ISO/IEC 42001:2023: Microsoft lists Microsoft Copilot and Microsoft Copilot Chat in scope. Copilot was first certified in March 2025 (by Mastermind, accredited by the International Accreditation Service, according to Microsoft's announcement at the time) and recertified after an audit in March 2026. Microsoft also states that it holds CSA STAR for AI Level 2 certification.
• ISO/IEC 27001: Microsoft's Copilot privacy page lists ISO 27001 among Copilot's certifications, and its HIPAA page states that BAA-covered services are audited for ISO/IEC 27001 and the HITRUST CSF. Microsoft's public ISO/IEC 27001 in-scope list for Office 365 does not name Copilot, so Microsoft's sources differ. Check the current certificate on the Service Trust Portal.
• SOC 1 / 2 / 3 and ISO/IEC 27017 / 27018 / 27701: Microsoft's public in-scope lists for these do not name Microsoft Copilot or Copilot Chat. Check the current audit reports on the Service Trust Portal before relying on them for Copilot.
• FedRAMP: Microsoft lists Microsoft Copilot in scope for its US government clouds (GCC, GCC High and DoD). OpenAI-operated models are not FedRAMP High authorized, according to Microsoft, and are not available in those clouds.
• HIPAA / HITRUST: Microsoft Copilot and Copilot Chat are in scope for Microsoft's BAA (see below), and Microsoft's HIPAA page states that BAA-covered services are audited for the HITRUST CSF. Microsoft's public HITRUST in-scope list for Office 365 does not name Copilot, so Microsoft's sources differ. Check the current letter of certification on the Service Trust Portal.
• OpenAI-operated models: Microsoft states that their certifications are maintained and managed by OpenAI rather than Microsoft, so Microsoft's own certifications should not be assumed to cover them.
• EU GDPR / UK GDPR: explicit compliance commitments in the DPA (Attachment 1 holds the GDPR terms)
• Microsoft Service Trust Portal: exhaustive compliance documentation, gated access

Microsoft's standards coverage is broad, but its public pages name Copilot in fewer certification scopes than the wider portfolio suggests. For Copilot, the questions that most often need a decision concern default settings and configuration.

HIPAA & BAA position

Microsoft's HIPAA Business Associate Agreement is part of the DPA by default for any customer that is a covered entity or business associate. Under the DPA, execution of the customer's agreement includes execution of the BAA, and the customer can opt out by written notice, so there is no separate BAA to sign. Microsoft lists both Microsoft Copilot and Microsoft Copilot Chat as in-scope services for Office 365 Commercial and GCC. Microsoft's HIPAA page still calls the document the Online Services DPA, which is now the Products and Services DPA.

The harder obligation is the minimum-necessary standard, and it is where Copilot differs from a standalone API. Copilot reads anything the signed-in user can read across the Microsoft Graph: every mailbox, file, Teams chat, and SharePoint site within that user's permissions. In a healthcare tenant that is a large PHI surface, and the HIPAA Privacy Rule's minimum-necessary standard (45 CFR 164.502(b)) requires reasonable efforts to limit PHI used or disclosed to the minimum necessary for the purpose. A BAA does nothing to limit what Copilot can surface. Permission hygiene and a DLP layer (Microsoft Purview or equivalent) are the controls that do, and they are the buyer's to configure.

• Which Copilot matters: Microsoft lists both Microsoft Copilot and Microsoft Copilot Chat (work or school account) as in scope for its BAA. Consumer Copilot (Microsoft 365 Personal and Family) is not on the list and Copilot Studio is not named, so evaluate those separately. Generated web search queries sent to Bing are outside HIPAA compliance and outside the DPA, and web search is on by default in commercial tenants (off by default in GCC and DoD), so a healthcare tenant should decide whether to allow it.
• Previews: the DPA's HIPAA Business Associate terms do not apply to Previews, except Previews that allow Personal Data processing, and the DPA tells customers not to use Previews for Personal Data or other regulated data unless Microsoft notes otherwise. Copilot features released as Previews should be kept away from PHI unless Microsoft's documentation says the Preview allows Personal Data processing.
• The EU-residency questions above (flex routing, the Anthropic subprocessor) are GDPR questions rather than HIPAA ones; a US-healthcare buyer with any EU footprint inherits both.

The BAA is the contractual piece. HIPAA's remaining obligations (the Security Rule's risk analysis, security awareness training and audit controls, the Privacy Rule's minimum-necessary standard, and the Breach Notification Rule) still fall on the covered entity, and with Copilot the minimum-necessary and audit-control work is unusually heavy. See HIPAA for AI tools for the full walkthrough across vendors.

AI Act role + risk classification

• Role: Microsoft is the provider of Copilot as an AI system, which it places on the market under its own name. OpenAI and Anthropic are the providers of the general-purpose AI models behind it and carry the obligations the Act places on GPAI model providers.
• Your role as a buyer: deployer, which the Act defines as a person or body "using an AI system under its authority" (outside personal, non-professional use). Your obligations depend on what you use Copilot for.
• Risk classification for typical use cases: drafting, summarising and searching office content are not uses listed in Annex III, so they do not make the deployment high-risk. If Copilot is used for an Annex III purpose, such as recruitment and selection, decisions on promotion or termination, task allocation based on personal traits, or monitoring and evaluating staff performance, the high-risk deployer obligations will apply to that deployment from 2 December 2027, unless the Article 6(3) exception applies (an Annex III system is not high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making, but a system that profiles natural persons is always high-risk). That is the date the Digital Omnibus (Regulation (EU) 2026/1744) set for AI systems classified as high-risk under Article 6(2) and Annex III. A high-risk system put into service before that date is caught only if its design changes significantly after it, and for systems intended for use by public authorities the deadline is 2 August 2030.
• When a deployer becomes a provider: under Article 25(1)(c), a deployer is treated as "a provider of a high-risk AI system" if it modifies the intended purpose of an AI system, "including a general-purpose AI system", that has not been classified as high-risk, so that it becomes high-risk under Article 6. The deployer then carries the provider obligations in Article 16. A buyer that configures Copilot, or builds a Copilot Studio agent, for an Annex III purpose should assess whether it has become the provider. Article 25 is in Chapter III, Section 3, so for Annex III systems it also applies from 2 December 2027.

Microsoft publishes AI Act readiness materials. Useful evidence for your audit file but does not relieve your own obligations.

DPIA prompts (for your use case)

1. Have you checked your flex routing setting? It is on by default for eligible EU and EFTA tenants created after 25 March 2026. For older tenants, Microsoft asks admins to confirm the setting rather than stating a default.
2. Have you decided whether to allow Anthropic models? Anthropic has been a Microsoft subprocessor since 7 January 2026, on by default in most commercial regions but off by default in the EU, EFTA and UK. Check the separate Word, Excel and PowerPoint setting as well, which is on by default for EU, EFTA and UK tenants created after 25 March 2026. Anthropic processing is outside the EU Data Boundary.
3. Have you decided on OpenAI-operated models and web search? OpenAI-operated models have been enabled by default for eligible commercial customers since 24 July 2026. Web search is on by default in commercial tenants, and its generated queries go to Bing outside the DPA, HIPAA compliance and the EU Data Boundary.
4. Have you mapped which roles can access Copilot? Copilot reads anything the user can read. Over-permissioned mailboxes and SharePoint sites become AI-exposure points.
5. Have you implemented Microsoft Purview or equivalent DLP to control what Copilot can surface? Copilot surfaces whatever the signed-in user can access, and Purview sensitivity labels and DLP policies are the controls that narrow it.
6. AI Act Annex III applicability: is Copilot being used for any purpose listed in Annex III, such as recruitment, promotion or termination decisions, or monitoring and evaluating staff performance? If so, the high-risk deployer obligations will apply from 2 December 2027 unless the Article 6(3) exception applies (it never covers a system that profiles people), a system put into service before that date is caught only if its design changes significantly afterwards (public authorities: 2 August 2030), and a use that turns Copilot into a high-risk system can make you its provider under Article 25(1)(c).
7. Copilot Studio agents: if you've built or enabled agents, treat each as a separate AI system for AI Act purposes - risk-classify each independently.

Unresolved questions / red flags

• Flex routing, on by default for eligible EU and EFTA tenants created after 25 March 2026, lets Copilot inferencing leave the EU Data Boundary at peak demand. Confirm the setting (older tenants included) and record the decision.
• Anthropic as a subprocessor (since 7 January 2026) is an explicit EU Data Boundary exception. It is off by default in the EU, EFTA and UK, but the Word, Excel and PowerPoint setting is on by default for tenants there created after 25 March 2026. The tenant's position should be a recorded decision.
• Generated web search queries go to Bing outside the DPA, HIPAA compliance and the EU Data Boundary, and web search is on by default in every commercial tenant unless an admin configures the policy.
• Copilot's data access scope is the user's full Graph permissions. Over-permissioning becomes a Copilot-magnified problem.
• Several products share the Copilot name. Microsoft Copilot (formerly Microsoft 365 Copilot, licensed and grounded in tenant data), Microsoft Copilot Chat (work or school account, web-grounded by default, under the same DPA and enterprise data protection), consumer Copilot, Copilot Studio (agent platform) and GitHub Copilot each need their own DPIA entry.
• Microsoft Service Trust Portal is gated: buyers need to register to pull primary compliance documents.

Related profiles

• OpenAI - model provider sub-route
• Anthropic - model provider sub-route, out of EU Data Boundary

Sources checked

• https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy ("Data, Privacy, and Security for Microsoft Copilot") - training, stored interactions and retention controls, abuse monitoring, EU Data Boundary statements, certifications and the product rename - checked 2026-10-14
• https://learn.microsoft.com/en-us/copilot/privacy-and-protections - Copilot Chat grounding and enterprise data protection - checked 2026-10-14
• https://learn.microsoft.com/en-us/copilot/microsoft-365/manage-public-web-access - generated web search queries, Microsoft as controller, outside the DPA, HIPAA and the EU Data Boundary, admin policy - checked 2026-10-14
• https://learn.microsoft.com/en-us/microsoft-365/copilot/copilot-flex-routing (last updated 29 September 2026), with Wayback Machine copies of 6 April and 6 July 2026 for the earlier wording - flex routing default, eligibility, locations and admin setting - checked 2026-10-14
• https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-ongoing-partial-transfers - Copilot transfers at peak demand - checked 2026-10-14
• https://learn.microsoft.com/en-us/microsoft-365/copilot/connect-to-ai-subprocessor (last updated 18 September 2026), with the Wayback Machine copy of 18 December 2025 for the 7 January 2026 date - Anthropic defaults by region, EU Data Boundary exclusion, Anthropic models with Data Retention - checked 2026-10-14
• https://learn.microsoft.com/en-us/microsoft-365/copilot/copilot-anthropic-apps (last updated 3 September 2026) - Anthropic in Word, Excel and PowerPoint for EU, EFTA and UK tenants - checked 2026-10-14
• https://learn.microsoft.com/en-us/microsoft-365/copilot/openai-subprocessor (last updated 9 October 2026) - OpenAI as a subprocessor, dates, default and exclusions - checked 2026-10-14
• https://learn.microsoft.com/en-us/microsoft-365/copilot/ai-models-overview - Azure OpenAI models operated by Microsoft, AI subprocessors and independent processors - checked 2026-10-14
• https://learn.microsoft.com/en-us/microsoft-365/copilot/connect-mistral-ai-models and https://learn.microsoft.com/en-us/microsoft-365/copilot/connect-to-ai-models - Mistral and SpaceXAI models outside the Product Terms and DPA - checked 2026-10-14
• https://learn.microsoft.com/en-us/purview/retention-policies-copilot - where Copilot interactions are stored and how retention applies - checked 2026-10-14
• https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA and the DPA document it links (last updated 22 May 2026) - roles, SCCs and IDTA, breach notification, retention after termination, AI subprocessor notice, HIPAA BAA, DPF - checked 2026-10-14
• https://www.microsoft.com/licensing/terms/product/PrivacyandSecurityTerms/all and https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all (Product Terms) - EU Data Boundary scope and services, data residency, the Bing carve-out and the training commitment - checked 2026-10-14
• https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech - BAA by default and in-scope services - checked 2026-10-14
• https://learn.microsoft.com/en-us/compliance/regulatory/offering-iso-42001, Microsoft's Tech Community recertification post https://techcommunity.microsoft.com/blog/microsoft365copilotblog/recertified-how-microsoft-365-copilot-continues-to-earn-trust-and-what-changed-i/4521693 and Microsoft's Japan blog of 15 April 2025 - ISO/IEC 42001 scope, certification body, recertification and CSA STAR for AI - checked 2026-10-14
• Microsoft's SOC 1, SOC 2, SOC 3, ISO/IEC 27001, 27017, 27018, 27701 and FedRAMP offering pages under https://learn.microsoft.com/en-us/compliance/regulatory/ - in-scope service lists - checked 2026-10-14
• eCFR, 45 CFR Part 164 structure and section 164.502(b) - the minimum-necessary standard and the subparts of the HIPAA rules - checked 2026-10-14
• Regulation (EU) 2024/1689 (the AI Act), Articles 3(4) and 25 and Annex III, and Regulation (EU) 2026/1744 (the Digital Omnibus on AI), amending Article 25(2) and (4) and setting 2 December 2027 for Annex III high-risk systems in Article 113, both from the Publications Office (https://publications.europa.eu/resource/celex/32024R1689 and https://publications.europa.eu/resource/celex/32026R1744) - checked 2026-10-14
• dataprivacyframework.gov participant registry, Microsoft Corporation, with a control query - checked 2026-10-14
• Message Center post MC1269223 (flex routing, effective 17 April 2026), read through a third-party copy at https://www.itelio.com/en/microsoft-message-center/MC1269223 because Message Center posts are visible only inside tenants - checked 2026-10-14

Related reading

• DPA for AI vendors - the eight clauses to check on any AI vendor DPA, with the Copilot Anthropic-subprocessor question explained
• EU AI Act for AI buyers - deployer-side obligations for buyers running Copilot Agents in Annex III use cases
• HIPAA for AI tools - BAA gate and Security Rule checklist for US healthcare buyers on Copilot
• Copilot 365 vs Google Workspace AI compliance - the closest enterprise-tier alternative
• OpenAI vs Copilot enterprise compliance - ChatGPT Enterprise direct vs the Copilot route

For ongoing AI compliance support, work with Janus DPO-as-a-Service. For other vendors, browse the full index, or see real agent failures analysed legally in the AI Agent Incident Register.