Vendors · Questionnaire · Microsoft Copilot
Read Microsoft Copilot’s own answers to nine buyer questions
Microsoft Copilot for work, formerly Microsoft 365 Copilot. Each answer quotes Microsoft Copilot’s own page or feed as kept on the day shown. Each question cites the NIST text that asks it. The answers are not a score and not a verdict.
Microsoft Copilot in the vendor record microsoft-copilot-questionnaire.csv
Q1
Does the vendor train its models on business and API customers’ data?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not used to train foundation LLMs
Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.
Data, Privacy, and Security for Microsoft Copilot, kept 26 Oct 2026 · sha256 d37a9d8c79eb
Q2
Does the vendor train its models on free and consumer use of its products?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not read
The vendor record does not read this point for Microsoft Copilot.
Q3
How long does the vendor keep the data that customers send?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Stored with the organization’s Microsoft 365 content; admins set retention
When you enter prompts using Microsoft Copilot, the information contained within your prompts, the data they retrieve, and the generated responses are processed and stored in alignment with contractual commitments with your organization's other content in Microsoft 365.
The page adds: “Admins can also use Microsoft Purview to set retention policies for the data related to chat interactions with Copilot.” Data, Privacy, and Security for Microsoft Copilot, kept 26 Oct 2026 · sha256 d37a9d8c79eb
Q4
Can a customer have the vendor keep none of its data?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Not published in the pages kept
Searched: Data, Privacy, and Security for Microsoft Copilot.
Q5
Where does the vendor process and store customer data?
NIST AI 600-1, action GV-6.1-009: “Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy …”
NIST AI RMF 1.0, GOVERN 6.1
EU traffic stays in the EU Data Boundary, except on Anthropic models
EU traffic stays within the EU Data Boundary while worldwide traffic can be sent to the EU and other countries or regions for LLM processing.
The next line reads: “Models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary.” Data, Privacy, and Security for Microsoft Copilot, kept 26 Oct 2026 · sha256 d37a9d8c79eb
Q6
Which other companies process customer data for the vendor?
NIST AI 600-1, action GV-6.1-007: “Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.”
NIST AI RMF 1.0, GOVERN 6.1; NIST AI RMF 1.0, MANAGE 3.1
Names Anthropic and OpenAI as subprocessors for their models
For information about models provided by Anthropic as a subprocessor within Microsoft Copilot experiences, see Anthropic models in Microsoft Online Services. For information about models provided by OpenAI as a subprocessor within Microsoft Copilot experiences, see OpenAI as a subprocessor in Microsoft Online Services.
Data, Privacy, and Security for Microsoft Copilot, kept 26 Oct 2026 · sha256 d37a9d8c79eb
Q7
Which independent audits or certifications does the vendor name?
NIST AI 600-1, Appendix A.1.3: “statement on standards for attestation engagement (SSAE) reports to help with third-party transparency and risk management for GAI systems”
NIST AI RMF 1.0, GOVERN 6.1
ISO 27001 and ISO 42001, listed beside GDPR and HIPAA
Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems.
Data, Privacy, and Security for Microsoft Copilot, kept 26 Oct 2026 · sha256 d37a9d8c79eb
Q8
Does the vendor publish a history of its service incidents?
NIST AI 600-1, action GV-6.2-007: “Service Level Agreements (SLAs) in vendor contracts that address incident response, response times, and availability of critical support.”
NIST AI RMF 1.0, GOVERN 6.2
No answer kept
The public page shows current status only. Incident history is in each tenant's admin center, behind a sign-in. The page.
Q9
Does the vendor publish the dates on which it retires its models?
NIST AI 600-1, action GV-6.2-007: “Review vendor contracts and avoid arbitrary or capricious termination of critical GAI technologies or vendor services …”
NIST AI RMF 1.0, GOVERN 6.2
Not read
Microsoft Copilot is an AI application; this site reads model retirement pages of model makers and clouds only.
- Microsoft Copilot, Data, Privacy, and Security for Microsoft Copilot, kept 26 Oct 2026.
- NIST, NIST AI 600-1, 2024-07. Republished courtesy of the National Institute of Standards and Technology.