If Copilot is in the EU Data Boundary, is Azure AI Foundry too?

Copilot’s EU Data Boundary does not cover Foundry

Microsoft Learn’s Foundry deployment-types article is the source of record for how prompts are placed. Microsoft 365 Copilot is a different product. Copilot is an employee productivity surface over Microsoft 365 data, with a documented EU Data Boundary path and documented exceptions (Flex Routing, Anthropic-in-Copilot, web grounding). Azure AI Foundry and Azure OpenAI are how you build custom assistants. They follow the Azure resource region, the model’s deployment type, and the network you attach. Staff will call both “Copilot”. Governance cannot.

Three sentences that are not synonyms: (1) Copilot EU Data Boundary — a Microsoft 365 catalogue commitment. (2) Foundry Data Zone EU — prompts may infer in any EU-zone geography Microsoft defines for that model. (3) Foundry Global Standard or Global Provisioned — prompts may infer anywhere Foundry runs. A tenant that has disabled Flex Routing and written a Copilot DPIA has not decided (2) or (3). InfoQ and vendor blogs that treat “Claude on Azure” as a single residency story are collapsing (2) and (3).

What each deployment type actually does

Regional: the resource lives in one Azure geography. Inferencing for that model stays in that geography unless the model card says otherwise. Picking Sweden Central is a choice in the Azure portal, not a Copilot tenant setting.

Data Zone EU: Microsoft’s Foundry commitment that processing of prompts and completions stays inside the EU data zone it defines — typically EU member states, sometimes including EFTA. It is not “this one datacentre” and it is not Copilot Flex Routing. Not every model offers a Data Zone SKU. If the model card has no EU zone, you do not have one.

Global Standard / Global Provisioned: inferencing may run in any Microsoft Foundry region worldwide, including outside the EU, even when the resource was created in Europe. Data at rest generally stays in the selected geo. That is the same storage-versus-processing split as Flex Routing, on a different product, with a worse default: Global is often what a tutorial creates first. Microsoft documents an Azure Policy path to disable access to global deployments on subscriptions that may see EU personal data. If that policy is not assigned, developers will recreate Global next sprint.

Claude and Anthropic on Foundry are not Azure OpenAI’s EU zone

Azure OpenAI models on a Data Zone EU deployment are one legal and technical story. Claude and other Anthropic models sold through Foundry in 2026 did not offer a European data zone comparable to Azure OpenAI. Treat Anthropic as an independent processor, read the current model card, and do not write “hosted on Azure, therefore EU Data Zone” in a DPIA. The same caution applies to other partner models whose cards describe US processing even when the Foundry resource is in Europe.

The Copilot DPIA usually does not cover this

Treat Foundry as its own processing activity or record why it is out of scope. An addendum is cheaper than discovering, in a customer questionnaire, that developers have been sending EU staff data to a US-default endpoint since March. Name an owner who is not “whoever set up Copilot”. Model catalogues move without a Microsoft 365 Message Center post. Public endpoints, shared keys in client apps, and unbounded prompt retention are the usual companions of a team that “just needed an API”.

If Foundry is forbidden on personal data, write that down and enforce it in Azure Policy. A green Copilot score does not travel. The table on this page is the artefact to paste; the questionnaire checks whether anyone in the organisation can actually name the deployment type in use.

Sources

• Foundry model deployment types — Microsoft Learn
• Optional capabilities that transfer Customer Data (Foundry Global) — Microsoft Learn
• Data, privacy and security for Models sold by Azure — Microsoft Learn

Read first

• Does the EU AI Act replace GDPR for Copilot?

  Most organisations using Copilot as a deployer have lighter AI Act duties than providers. GDPR obligations remain fully applicable.

FAQ

Other assessments — not the same questionnaire

• Is Microsoft 365 Copilot in the EU Data Boundary?

  Eligible Microsoft 365 Copilot is an EU Data Boundary service. That sentence is true and incomplete. Data at rest can stay in Europe while Flex Routing sends inferencing to the United States, Canada or Australia. Anthropic models and Copilot web grounding (Bing) sit outside the Boundary even when Copilot is listed as in-scope. Multi-Geo tenants are not in scope for the Microsoft 365 EU Data Boundary. Azure AI Foundry is a different product: Copilot settings do not govern Global vs Data Zone deployments.

• Copilot Flex Routing: Can Inferencing Leave the EU?

  Yes for inferencing. No for data at rest. Microsoft Learn says Flex Routing lets EU and EFTA customers allow LLM inferencing outside the EU Data Boundary at peak demand. That sentence is true, and it is the whole problem: storage is not what it describes. Prompts, responses and grounding data may be processed in the United States, Canada or Australia. Customer data at rest stays inside the Boundary, except limited pseudonymized operational data. Message Center MC1269223 enabled the setting by default for new eligible tenants after 25 March 2026 and for many existing tenants from 17 April 2026.

• Is Microsoft’s Copilot DPIA Template Enough?

  Microsoft’s “Build your own” Microsoft 365 Copilot DPIA is a starting file, not the record. Article 35 still needs tenant facts the template cannot know: the Flex Routing value and whether extra-EU inferencing is a transfer, whether historically overshared SharePoint still grounds Copilot, whether DLP lists Microsoft 365 Copilot as a location, web grounding, Anthropic models, commercial vs consumer licensing, and a named owner. A score is not that file.