{
  "@context": "https://spdx.org/rdf/3.0.1/spdx-context.jsonld",
  "@graph": [
    {
      "type": "CreationInfo",
      "@id": "_:creationInfo",
      "specVersion": "3.0.1",
      "created": "2026-11-04T00:00:00Z",
      "createdBy": [
        "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/tool"
      ]
    },
    {
      "type": "Tool",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/tool",
      "creationInfo": "_:creationInfo",
      "name": "jesseahawkins.com vendor record"
    },
    {
      "type": "SpdxDocument",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/document",
      "creationInfo": "_:creationInfo",
      "name": "AI BOM for Microsoft Copilot: Microsoft Copilot for work, formerly Microsoft 365 Copilot",
      "profileConformance": [
        "core",
        "software",
        "ai"
      ],
      "rootElement": [
        "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package"
      ]
    },
    {
      "type": "ai_AIPackage",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package",
      "creationInfo": "_:creationInfo",
      "name": "Microsoft Copilot: Microsoft Copilot for work, formerly Microsoft 365 Copilot"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/ai_subprocessors",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors = Names Anthropic and OpenAI as subprocessors for their models. Evidence snapshot sha256:d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26. Responsive to (not compliant with): dora-roi@2024-2956:B_05.02 iso-42001@2023:A.10.2 iso-42001@2023:A.10.3 nist-ai-rmf@1.0:GOVERN-6.1 nist-ai-rmf@1.0:MANAGE-3.1."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/certifications",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "certifications = ISO 27001 and ISO 42001, listed beside GDPR and HIPAA. Evidence snapshot sha256:d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/customer_data_retention_period",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period = Stored with the organization’s Microsoft 365 content; admins set retention. Evidence snapshot sha256:d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26. Responsive to (not compliant with): iso-42001@2023:A.7.3 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/data_residency",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency = EU traffic stays in the EU Data Boundary, except on Anthropic models. Evidence snapshot sha256:d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/dpa",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa = The Microsoft Product Terms and Data Protection Addendum, named for data residency. Evidence snapshot sha256:d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/trains_on_customer_data",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data = Not used to train foundation LLMs. Evidence snapshot sha256:d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c; recorded 2026-10-26T00:00:00Z; valid from 2026-10-26. Responsive to (not compliant with): eu-ai-act@2026-07-27:annex-iv/2/d eu-ai-act@2026-07-27:annex-xi/s1/2/c iso-42001@2023:A.7.3 iso-42001@2023:A.7.5 nist-ai-rmf@1.0:MEASURE-2.10."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/usage_limits",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "usage_limits is recorded with no value (fact microsoft-copilot/usage_limits@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/zero_data_retention",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "zero_data_retention is recorded with no value (fact microsoft-copilot/zero_data_retention@2026-11-04, 2026-11-04T00:00:00Z)."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/ai_subprocessors/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "ai_subprocessors, in Microsoft Copilot's own words: \"For information about models provided by Anthropic as a subprocessor within Microsoft Copilot experiences, see Anthropic models in Microsoft Online Services. For information about models provided by OpenAI as a subprocessor within Microsoft Copilot experiences, see OpenAI as a subprocessor in Microsoft Online Services.\" Source: https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/certifications/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "certifications, in Microsoft Copilot's own words: \"Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems.\" Source: https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/customer_data_retention_period/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "customer_data_retention_period, in Microsoft Copilot's own words: \"When you enter prompts using Microsoft Copilot, the information contained within your prompts, the data they retrieve, and the generated responses are processed and stored in alignment with contractual commitments with your organization's other content in Microsoft 365.\" Source: https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/data_residency/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "data_residency, in Microsoft Copilot's own words: \"EU traffic stays within the EU Data Boundary while worldwide traffic can be sent to the EU and other countries or regions for LLM processing.\" Source: https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/dpa/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "dpa, in Microsoft Copilot's own words: \"Microsoft Copilot is upholding data residency commitments as outlined in the Microsoft Product Terms and Data Protection Addendum.\" Source: https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/trains_on_customer_data/quote",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/ai-package",
      "contentType": "text/plain",
      "statement": "trains_on_customer_data, in Microsoft Copilot's own words: \"Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.\" Source: https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy"
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/notice",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/document",
      "contentType": "text/plain",
      "statement": "This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."
    },
    {
      "type": "Annotation",
      "spdxId": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/annotation/signature",
      "creationInfo": "_:creationInfo",
      "annotationType": "other",
      "subject": "https://jesseahawkins.com/vendors/microsoft-copilot/aibom/document",
      "contentType": "text/plain",
      "statement": "The AIBOM files of this record are not signed. A signature waits on a signing key held in a key management service. Until then, check each quote against the kept page and its sha256."
    }
  ]
}