One readiness score for the board—not one form for every Microsoft question

Copilot GDPR compliance is a configuration, not a logo

Search “is Microsoft 365 Copilot GDPR compliant” and you will find vendor pages that treat the EU Data Boundary as the answer. For a European controller it is the start of the answer. Copilot is a processing activity over prompts, grounding data and whatever the signed-in user can already open in SharePoint, OneDrive, Exchange and Teams. You remain the controller. Microsoft remains the processor under the Products and Services DPA — if you are on commercial licences, not the consumer product.

A 2026 board, works council or customer security questionnaire will not accept “Copilot is an EU Data Boundary service” as a complete reply. They will ask where inferencing runs when Flex Routing is on, whether Anthropic models are enabled, whether web grounding sends queries to Bing, who can retrieve historically overshared files, and whether a DPIA exists. Those are different failure modes. They happen to sit in one product.

EU Data Boundary, Flex Routing and extra-EU processing

The EU Data Boundary is a residency commitment for listed Microsoft 365 workloads. Data at rest in an EU/EEA tenant can still leave Europe at inferencing time. Flex Routing, introduced as a peak-load path and left on as a default for many EU tenants in 2026, can send Copilot LLM inferencing to the United States, Canada or Australia. Anthropic models are excluded from the Boundary even when Copilot itself is in scope. Generated Bing search queries from web grounding sit outside the Boundary by design.

Each of those is a Chapter V question if personal data is in the prompt or the grounding set. They are not one slide called “Copilot is in the EU”. A DPO who has not opened Copilot → Settings → Flex routing does not yet have a transfer decision, regardless of tenant geo.

Oversharing is the incident that actually happens

Copilot does not invent a new permission. It summarises what ACLs already allow, including Everyone, Anyone links and “except external users” leftovers from 2019. The typical incident is not a new share: it is a chat summary of a personnel file or a customer folder that has been overshared for years. Sensitivity labels and Microsoft Purview DLP only bite if they are applied and if Microsoft 365 Copilot is a location in the policy. A published label taxonomy with thin coverage is not a control.

Identity multiplies the same problem. Standing admin roles, missing MFA and guest access change who Copilot can be. Unbounded licence assignment copies every other gap to more people. A safe Copilot rollout in Europe is still a bounded pilot, then sharing hygiene, then expansion — not an E5 checkbox.

The GDPR file is not the readiness score

Article 35 does not ask for a vendor score. It asks for a DPIA (or a recorded decision that one is not required), a record of processing, an employee-facing notice, audit of Copilot interactions, retention that is yours rather than the product default, and a named owner who will catch the next Message Center change. A works council or supervisory authority can stop a rollout on paperwork even when Flex Routing is off and labels are excellent.

ISO 31000 is how a board talks about those risks (extra-EU processing, disclosure, accountability, unbounded expansion). ISO/IEC 27001:2022 Clause 6.1 is how an ISMS scores them. NIST CSF 2.0 is the operational profile. They share facts. They do not share language. Mixing them into one “we are ISO 27001” sentence is how Copilot programmes get a false green.

What “ready” means for a European organisation

Ready means you can evidence, in one pack, where Copilot processes data, what it can already see, who it can act as, which technical controls actually include Copilot, and which GDPR artefacts exist. Not ready means at least one of those is an “I’m not sure” — the same rule a supervisory authority uses when you cannot produce the setting.

If the live question is only Flex Routing, only oversharing, only the DPIA file, only identity, or Azure AI Foundry rather than Copilot, use that assessment. Foundry is not covered by Copilot tenant settings. A green Copilot score does not travel.

Read first

• How to score Copilot risk under ISO 31000

  ISO 31000 is the process. GDPR is the legal duty. NIST CSF 2.0 is the operational profile. ISO/IEC 27001 Clause 6.1 and Annex A are the ISMS artefacts. This scan produces all four from the same 25 answers — it does not certify any of them.

• What to check before assigning Copilot licences

  A safe European rollout combines technical configuration, accountability documentation and organisational measures. The sequence matters.

• Is work Copilot the same as consumer Copilot?

  Commercial Microsoft 365 Copilot under Enterprise Data Protection is a different product, contractually and technically, from consumer Copilot.

FAQ

Other assessments — not the same questionnaire

• Copilot Flex Routing: Can Inferencing Leave the EU?

  Yes for inferencing. No for data at rest. Microsoft Learn says Flex Routing lets EU and EFTA customers allow LLM inferencing outside the EU Data Boundary at peak demand. That sentence is true, and it is the whole problem: storage is not what it describes. Prompts, responses and grounding data may be processed in the United States, Canada or Australia. Customer data at rest stays inside the Boundary, except limited pseudonymized operational data. Message Center MC1269223 enabled the setting by default for new eligible tenants after 25 March 2026 and for many existing tenants from 17 April 2026.

• Is Microsoft 365 Copilot in the EU Data Boundary?

  Eligible Microsoft 365 Copilot is an EU Data Boundary service. That sentence is true and incomplete. Data at rest can stay in Europe while Flex Routing sends inferencing to the United States, Canada or Australia. Anthropic models and Copilot web grounding (Bing) sit outside the Boundary even when Copilot is listed as in-scope. Multi-Geo tenants are not in scope for the Microsoft 365 EU Data Boundary. Azure AI Foundry is a different product: Copilot settings do not govern Global vs Data Zone deployments.

• Copilot Oversharing: SharePoint, Labels and DLP

  Yes, if a licensed user can already open them. Copilot does not create a new SharePoint permission. It summarises existing ACLs — including Everyone, Anyone links and “except external users”. Sensitivity labels and Purview DLP only stop that if they are applied and if Microsoft 365 Copilot is a location in the policy.

• Is Microsoft’s Copilot DPIA Template Enough?

  Microsoft’s “Build your own” Microsoft 365 Copilot DPIA is a starting file, not the record. Article 35 still needs tenant facts the template cannot know: the Flex Routing value and whether extra-EU inferencing is a transfer, whether historically overshared SharePoint still grounds Copilot, whether DLP lists Microsoft 365 Copilot as a location, web grounding, Anthropic models, commercial vs consumer licensing, and a named owner. A score is not that file.