AI Vendor Directory · AI in productivity suites
Does Microsoft 365 Copilot train on your data?
No — does not train on your data by default. Vendor-stated default: no (all commercial tiers). Microsoft states: "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft 365 Copilot." No opt-out is needed. Optional customer feedback is also excluded from foundation-LLM training and can be disabled by admins. Prompts/responses are stored as Copilot activity history under existing M365 contractual commitments (users can delete it; Purview retention policies apply). Anthropic and OpenAI models are offered as subprocessors under the same no-training commitments, but note Anthropic models are currently excluded from the EU Data Boundary.
By the Shieldra Compliance Team · Last updated 2026-07-29
What is Microsoft 365 Copilot?
AI assistant embedded across Word, Excel, PowerPoint, Outlook and Teams that grounds LLM responses in the tenant's Microsoft Graph data (email, documents, chats, meetings). SMBs typically use it for drafting, summarization and meeting recap inside existing M365 workflows.
Key facts
- Vendor: Microsoft — https://www.microsoft.com/microsoft-365/copilot
- Trains on customer data by default: no (all commercial tiers)
- Source for the training answer: https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy
- Data residency: EU (EU Data Boundary); US; additional regions via Advanced Data Residency / Multi-Geo
- Last verified: 2026-07-29
What certifications does Microsoft 365 Copilot hold?
- ISO 27001
- ISO 42001
- HIPAA (BAA available)
Security, DPA, and subprocessor links
- Security / trust page: https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy
- Data processing agreement (DPA): https://aka.ms/dpa
What is your EU AI Act role when you build on Microsoft 365 Copilot?
Your organization is a deployer under the EU AI Act; Microsoft is the provider. Article 50 transparency duties can trigger when you publish Copilot-generated text or images externally without human review; disclose AI involvement where required.
What to record in your AI registry
- Provider: Microsoft
- Model type: third party api
- Data typically flowing to the vendor: emails, documents, chat messages, calendar data, meeting transcripts
Sources
- https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy
Disclaimer
Curated from vendor-published pages on the date above. Vendor terms change - verify against the cited sources before relying on a profile for a procurement decision. Last verified 2026-07-29.
Frequently asked questions
Does Microsoft 365 Copilot train AI models on your data?
No — does not train on your data by default. Vendor-stated default: no (all commercial tiers). Microsoft states: "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft 365 Copilot." No opt-out is needed. Optional customer feedback is also excluded from foundation-LLM training and can be disabled by admins. Prompts/responses are stored as Copilot activity history under existing M365 contractual commitments (users can delete it; Purview retention policies apply). Anthropic and OpenAI models are offered as subprocessors under the same no-training commitments, but note Anthropic models are currently excluded from the EU Data Boundary.
What certifications does Microsoft 365 Copilot hold?
Per the vendor's published pages as of 2026-07-29: ISO 27001; ISO 42001; HIPAA (BAA available).
Where does Microsoft 365 Copilot store your data?
Vendor-listed data residency options as of 2026-07-29: EU (EU Data Boundary); US; additional regions via Advanced Data Residency / Multi-Geo.
What is your EU AI Act role when you build on Microsoft 365 Copilot?
Your organization is a deployer under the EU AI Act; Microsoft is the provider. Article 50 transparency duties can trigger when you publish Copilot-generated text or images externally without human review; disclose AI involvement where required.
