Contents 8 sections
Who signs, and what they are trusting
Before Microsoft Copilot (formerly Microsoft 365 Copilot) moves from a pilot group to the whole company, people outside IT have to put their names to it. The compliance lead signs that sensitive data is protected, and the CFO signs the license plan and the cost of running the controls. In the EU the data protection officer advises on the data protection impact assessment, and in Germany the works council usually agrees a works agreement first. Legal confirms that client contracts allow it, and none of them will ever open the settings they are trusting.
This checklist is for those people. Each item names what is being signed and the evidence IT should show, so the sign-off rests on a report or a test. It leaves the configuration steps to IT, which our Copilot rollout how-to covers, and the paper Copilot after rollout covers the agent controls that come next.
What the compliance lead signs
DLP policies are in enforce mode. Purview lets a data loss prevention (DLP) policy run in simulation mode, which runs it as if it were enforced but without acting on anything. It is easy to leave a pilot in that state and assume the data is protected. The evidence is the policy list with each policy's mode, and a test in which a pilot user tries something a policy should stop and is stopped.
Copilot leaves labeled content out of its answers. A sensitivity label alone does not stop Copilot. Microsoft's DLP for Copilot documentation describes a policy on the location "Microsoft 365 Copilot and Copilot Chat" that uses label conditions to exclude matching files and emails. It needs E5-level rights, from E5, the Purview Suite or the Purview Suite for Business Premium, and a matching file can still be cited while its content stays out. Microsoft documents gaps: the policy covers emails sent from 1 January 2025 and no calendar invitations, and DLP cannot scan files uploaded straight into a prompt. The evidence is the policy and test prompts from a normal account, on the routes that matter, that return none of the labeled content. Without those rights, the backstop is encryption on the files that must not leak, because Copilot needs the rights to open a file and to take content out of it.
Sensitive prompts are handled. The same DLP location can block web search for prompts that contain sensitive information such as card numbers, which is available now, and can block those prompts outright, which is in preview at the time of writing. The evidence is the policy and its mode.
The most sensitive sites are reviewed or hidden. Sites holding HR, finance, legal or client material have had their permissions reviewed by their owners. Any that could not be fixed in time are hidden from company-wide search and Copilot with Restricted Content Discovery, which leaves access unchanged, does not cover OneDrive and can take time to apply on large sites. The evidence is the list of hidden sites with an owner and end date, a search from a normal account after the setting has taken effect, and the data access governance report before and after the review.
Copilot activity is audited, and only named roles can search it. Each Copilot interaction creates a CopilotInteraction record naming the agent used and the files it read, per Microsoft's audit documentation. The record holds message IDs rather than prompt text, which sits with the user's own content and is reachable through eDiscovery. Audit (Standard) keeps records for 180 days. Audit (Premium), with E5 or the Purview Suite for Business Premium, allows up to a year once IT sets a retention policy for Copilot records. The evidence is that policy, a sample search and the list of people allowed to run one. Our guide to audit trails for AI agents covers what to keep.
Agents are limited by reach. The Microsoft 365 environment, which Microsoft calls the tenant, sets who may share agents with the whole organization, and agents submitted for company-wide use wait in the admin center's Requests queue for review. Microsoft documents no switch to stop people creating Agent Builder agents, so the rule on creation sits in the AI policy. The evidence is a screenshot of the agent settings and the list of agents approved for the company in the Agent Registry. Our guide to citizen-built agents sets out the levels.
Staff have the policy, and the literacy record exists. Every user has acknowledged the AI acceptable use policy, and DLP policy tips link to it, as Microsoft's page on managing Copilot Chat describes. For EU staff, the AI Act requires measures that support AI literacy, sized to the role and the risk, and the European Commission's AI literacy Q&A says no certificate is needed but suggests an internal record. The evidence is the acknowledgement log and the training record per role.
What the CFO signs
The license plan matches the controls. Business Premium, which Microsoft sells for up to 300 users, covers labels, DLP for Exchange, SharePoint and OneDrive, and 180 days of audit. Excluding labeled content from Copilot and automatic labeling need E5 or a Purview suite, while the SharePoint oversharing tools come with the Copilot license itself. The evidence is a one-page plan that maps each control to the license it needs and names the users who still need an upgrade. Microsoft's list prices are in our post on Copilot on Business Premium and its costs.
Someone owns the controls after launch. DLP alerts, agent requests, site reviews and the quarterly agent review all need a named owner and time in someone's week. The evidence is a run plan with names, which the CFO can cost before signing.
Where the DPO advises and the works council agrees
A DPIA where one is needed. Under Article 35 of the GDPR, a data protection impact assessment is required when processing is likely to result in a high risk to people's rights and freedoms. The company decides, on the DPO's advice, whether a company-wide rollout meets that test. If it does, the evidence is the assessment with its data flows and EU Data Boundary choices. Two details belong in it. Microsoft lets admins enable Anthropic models in Copilot, and its enterprise data protection page says those models are currently excluded from the EU Data Boundary. The same page says the boundary does not apply to the web search queries Copilot sends to Bing, which follow their own data handling terms, so the assessment should record whether web search is on.
A works agreement in Germany. German law gives the works council a say over technical systems that can monitor staff behavior or performance, and German courts have treated Microsoft 365 as such a system because administrators hold audit logs and usage data. The works agreement records what is switched on, which reports exist and what they may not be used for. Our post on Copilot and the works council in Germany covers the agreement and the DPIA together.
What legal signs
Client contracts allow it. Some client contracts forbid AI on the client's data, and others only limit who may see it. A prohibition needs a control that stops Copilot processing that client's files, such as a label with the Copilot exclusion or encryption that withholds the rights Copilot needs, tested on the routes the contract cares about, and hiding the client's site does not meet it. A limit on who sees the data may be met by a permission review on the client's site. Each clause type then maps to evidence the client can be shown. Our post on sorting client AI clauses into controls and evidence describes the method.
Company data stays the company's. Microsoft's privacy documentation says prompts and responses, and the data accessed through Microsoft Graph, are not used to train foundation models, and Copilot Chat used with work accounts runs under Microsoft's enterprise data protection terms. Legal should see that statement and the tenant's model settings. On personal accounts, Microsoft's security guidance for Copilot advises against blocking copilot.cloud.microsoft and points to tenant restrictions instead.
Signing for the scope in front of you
A checklist like this can become a reason never to launch, and that has costs of its own. No list makes a tenant safe once and for all. A Microsoft bug, CW1226324, let Copilot Chat summarize labeled emails in Sent Items and Drafts for several weeks in early 2026 despite a DLP policy, as BleepingComputer reported.
What the decision group can sign is that the known controls are in place and tested, with a named owner, a judgment it can make for a pilot well before every library is labeled. Sign for the scope in front of you: first a pilot group with reviewed access and the sensitive sites hidden, then the whole company once the remaining items are closed.
Where QueryNow fits
QueryNow prepares this sign-off with the decision group as part of our Copilot AI Foundation service. We configure the controls and gather the evidence for each item into one pack. We also draft the AI policy and the literacy plan. In Germany we prepare the DPIA input and the works council pack with your data protection officer. QueryNow was founded in Germany in 2014 and works from teams in Texas and Munich.
QueryNow leads AI transformation for enterprises in the US and Europe. Founded in Germany in 2014, we build the foundation enterprise AI runs on, and the agents that run on it, for pharma, healthcare, manufacturing and financial services organizations on Azure and AWS.
FAQ
Frequently asked questions
Our DLP policies are in simulation mode. Are we protected?
No. Simulation mode runs a policy as if it were enforced but takes no action, so nothing is blocked. Switch the policies that protect sensitive data to enforce mode before the pilot widens, and test each one with a normal user account.
Who decides what Copilot may access?
Copilot can reach whatever the signed-in user can already open, so the people who grant access decide, which means site owners and IT. The compliance lead decides which controls sit on top, such as the Copilot exclusion for labeled files, and the AI policy makes users responsible for checking what they use.
Is free Copilot Chat safe to leave on for everyone?
Microsoft Copilot Chat, included with Microsoft 365 business and enterprise plans, runs under enterprise data protection when people sign in with work accounts. It still needs the AI policy and DLP for sensitive prompts in place, and Microsoft points to tenant restrictions, not blocking its address, for keeping personal accounts out.
Do we need a DPIA before Copilot?
In the EU a DPIA is required when processing is likely to be high risk, and the company decides, with its data protection officer's advice, whether a company-wide Copilot rollout meets that test. In Germany, plan the works agreement alongside it, since both draw on the same description of what Copilot does with staff data.
The Monday digest
The three posts worth your time each week, one paragraph each. From the people building production AI.
