Copilot governance starts with a description of the actual service, users, information and actions. The word “Copilot” does not establish the legal classification of a system or which obligations apply to the organisation using it.
Identify accountable legal, privacy, security and process owners. Engineering can implement and test agreed controls, while applicability and professional decisions remain with the responsible organisation and advisers.
Identify the system and the activity
Record the specific Microsoft product and experience, whether it retrieves organisational content and whether extensions or agents can call external tools. Distinguish drafting, search, recommendations and actions that change records.
Identify the people affected and the decisions the output may influence. An internal search tool and a workflow used in a consequential eligibility decision need different assessments even when they share a conversational interface.
The data map should include prompts, responses, sources, tools, logs, processing locations and subprocessors. A hosting-region setting does not by itself describe every data flow.
Apply privacy rules to the actual processing
Under GDPR, establish the relevant lawful basis and the applicable information, security and individual-rights obligations. Explicit consent is not the only lawful basis. Article 22 addresses certain solely automated decisions with legal or similarly significant effects, subject to its conditions and exceptions.
In Canada, assess PIPEDA and applicable provincial or sector-specific laws. The OPC’s guidance on processing across borders explains the accountability requirement; it is not a blanket Canada-only hosting rule.
For applicable US health-information processing, HHS guidance addresses cloud providers and required agreements and safeguards. HIPAA does not universally require an on-premise AI model. These are examples of scoped requirements, not a claim that Ryzolv provides clinical services.
Use the current EU AI Act
Determine the organisation’s role and the system’s intended use. Provider, deployer and general-purpose model obligations are not identical. Working in finance does not automatically make every application high risk.
The Commission’s current guidance reflects the AI Omnibus in force from 27 July 2026. Relevant Annex III high-risk rules now apply from 2 December 2027, and Article 6(1)/Annex I product-related high-risk rules from 2 August 2028. Other provisions have different dates and some already apply.
Check the current Commission guidance and consolidated law. Do not treat an old August 2026 headline as the deadline for every obligation.
Scope financial-sector records carefully
SEC and FINRA obligations do not apply identically to every bank or financial-services business. Determine the regulated entity, activity and record class before assigning a retention period.
For example, the SEC’s explanation of Rule 17a-4 distinguishes record categories. A universal statement that every business communication must be kept for six years is inaccurate.
Similarly, SAR confidentiality requires analysis of access, purpose, recipients and permitted sharing. It is not accurate to say every internal processing of SAR-related material is automatically an unlawful disclosure. FinCEN’s authorised-sharing guidance illustrates why scope matters. An organisation may adopt stricter internal restrictions and should label them as policy.
Map obligations to evidence
For each applicable requirement, name the owner, the implementation measure and the evidence to review. Examples include access tests, configured retention, approved use cases, reviewer training and incident procedures.
A model-generated answer citing a policy does not demonstrate legal compliance. A control matrix without operating evidence does not demonstrate enforcement. Record gaps and residual risks explicitly.
Voluntary standards such as the NIST AI RMF can organise the work. They are not regulatory approvals or substitutes for the applicable law.
Reassess material changes
Review the assessment when the purpose, data, connectors or affected users change. Track which product and policy versions the evidence covers.
Use qualified advisers for jurisdiction-specific legal conclusions. Our AI Security and Governance capability supports the technical control work that follows that assessment, without claiming certification or guaranteed compliance.