{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:0962b926-f967-5a14-b784-1086acb901e1",
  "version": 1,
  "metadata": {
    "timestamp": "2026-11-04T00:00:00Z"
  },
  "components": [
    {
      "type": "machine-learning-model",
      "bom-ref": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/component",
      "name": "Microsoft Copilot: Microsoft Copilot for work, formerly Microsoft 365 Copilot",
      "properties": [
        {
          "name": "com.jesseahawkins:fact:ai_subprocessors",
          "value": "Names Anthropic and OpenAI as subprocessors for their models"
        },
        {
          "name": "com.jesseahawkins:evidence:ai_subprocessors",
          "value": "snapshot:sha256:d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c"
        },
        {
          "name": "com.jesseahawkins:recorded-at:ai_subprocessors",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:ai_subprocessors",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:responsive-to:ai_subprocessors",
          "value": "dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1"
        },
        {
          "name": "com.jesseahawkins:fact:certifications",
          "value": "ISO 27001 and ISO 42001, listed beside GDPR and HIPAA"
        },
        {
          "name": "com.jesseahawkins:evidence:certifications",
          "value": "snapshot:sha256:d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c"
        },
        {
          "name": "com.jesseahawkins:recorded-at:certifications",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:certifications",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:fact:customer_data_retention_period",
          "value": "Stored with the organization’s Microsoft 365 content; admins set retention"
        },
        {
          "name": "com.jesseahawkins:evidence:customer_data_retention_period",
          "value": "snapshot:sha256:d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c"
        },
        {
          "name": "com.jesseahawkins:recorded-at:customer_data_retention_period",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:customer_data_retention_period",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:responsive-to:customer_data_retention_period",
          "value": "iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:fact:data_residency",
          "value": "EU traffic stays in the EU Data Boundary, except on Anthropic models"
        },
        {
          "name": "com.jesseahawkins:evidence:data_residency",
          "value": "snapshot:sha256:d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c"
        },
        {
          "name": "com.jesseahawkins:recorded-at:data_residency",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:data_residency",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:fact:dpa",
          "value": "The Microsoft Product Terms and Data Protection Addendum, named for data residency"
        },
        {
          "name": "com.jesseahawkins:evidence:dpa",
          "value": "snapshot:sha256:d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c"
        },
        {
          "name": "com.jesseahawkins:recorded-at:dpa",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:dpa",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:fact:trains_on_customer_data",
          "value": "Not used to train foundation LLMs"
        },
        {
          "name": "com.jesseahawkins:evidence:trains_on_customer_data",
          "value": "snapshot:sha256:d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c"
        },
        {
          "name": "com.jesseahawkins:recorded-at:trains_on_customer_data",
          "value": "2026-10-26T00:00:00Z"
        },
        {
          "name": "com.jesseahawkins:valid-from:trains_on_customer_data",
          "value": "2026-10-26"
        },
        {
          "name": "com.jesseahawkins:responsive-to:trains_on_customer_data",
          "value": "eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10"
        },
        {
          "name": "com.jesseahawkins:withheld:usage_limits",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:withheld:zero_data_retention",
          "value": "no-value"
        },
        {
          "name": "com.jesseahawkins:quote:ai_subprocessors",
          "value": "For information about models provided by Anthropic as a subprocessor within Microsoft Copilot experiences, see Anthropic models in Microsoft Online Services. For information about models provided by OpenAI as a subprocessor within Microsoft Copilot experiences, see OpenAI as a subprocessor in Microsoft Online Services."
        },
        {
          "name": "com.jesseahawkins:source:ai_subprocessors",
          "value": "https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy"
        },
        {
          "name": "com.jesseahawkins:quote:certifications",
          "value": "Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems."
        },
        {
          "name": "com.jesseahawkins:source:certifications",
          "value": "https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy"
        },
        {
          "name": "com.jesseahawkins:quote:customer_data_retention_period",
          "value": "When you enter prompts using Microsoft Copilot, the information contained within your prompts, the data they retrieve, and the generated responses are processed and stored in alignment with contractual commitments with your organization's other content in Microsoft 365."
        },
        {
          "name": "com.jesseahawkins:source:customer_data_retention_period",
          "value": "https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy"
        },
        {
          "name": "com.jesseahawkins:quote:data_residency",
          "value": "EU traffic stays within the EU Data Boundary while worldwide traffic can be sent to the EU and other countries or regions for LLM processing."
        },
        {
          "name": "com.jesseahawkins:source:data_residency",
          "value": "https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy"
        },
        {
          "name": "com.jesseahawkins:quote:dpa",
          "value": "Microsoft Copilot is upholding data residency commitments as outlined in the Microsoft Product Terms and Data Protection Addendum."
        },
        {
          "name": "com.jesseahawkins:source:dpa",
          "value": "https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy"
        },
        {
          "name": "com.jesseahawkins:quote:trains_on_customer_data",
          "value": "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot."
        },
        {
          "name": "com.jesseahawkins:source:trains_on_customer_data",
          "value": "https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy"
        }
      ]
    }
  ],
  "properties": [
    {
      "name": "com.jesseahawkins:vendor",
      "value": "microsoft-copilot"
    },
    {
      "name": "com.jesseahawkins:record",
      "value": "https://jesseahawkins.com/vendors/microsoft-copilot/"
    },
    {
      "name": "com.jesseahawkins:notice",
      "value": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "name": "com.jesseahawkins:signed",
      "value": "false"
    },
    {
      "name": "com.jesseahawkins:signature-note",
      "value": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}