Does the EU AI Act replace GDPR for Copilot?

Most organisations using Microsoft 365 Copilot as a deployer have lighter AI Act duties than providers. That is not a free pass. GDPR obligations remain fully applicable, and the AI Act still expects literacy, transparency and human oversight for how you use the system at work.

Keep the two regimes in one file

Do not over-claim AI Act exposure (“we cannot use Copilot, it is prohibited”) and do not under-claim GDPR (“the AI Act is the only AI law”). Complete transparency to staff, human oversight of high-impact uses such as HR or customer decisions, training, and a DPIA where required.

If you build your own agents in Copilot Studio or Azure AI Foundry, re-assess. Custom systems can look more like a provider or like a high-risk use depending on purpose. The Copilot productivity licence is not a blanket legal opinion over everything labelled “Copilot” in the company.

Practical steps that satisfy both conversations

Tell staff what Copilot is allowed to be used for. Keep a human in the loop for decisions that affect people. Log and retain enough to investigate harm. Review settings when Microsoft changes defaults. That list is also the organisational section of the readiness scanner.

What to tell a board in one paragraph

“We use Microsoft 365 Copilot as a deployer of a general-purpose system. Our binding duties for staff and customer data remain the GDPR, including a DPIA. The AI Act adds literacy, transparency and oversight. Custom agents we build ourselves will be assessed separately.”

If that paragraph is not true yet — no DPIA, no staff notice, no owner — the AI Act debate is a distraction. Finish the GDPR file first. The scanner is built to show that gap without pretending to classify your system under the Act.