Copilot for Business is on, company-wide as the default AI. Is this really the safest option? Employees are told: use this, nothing else. To protect our company data.

I hear this often, from European businesses, usually from a well-meaning IT manager who made the call, or inherited it.

4 facts most decision-takers should know:

  1. Your data can be read outside EU jurisdiction. Copilot runs on US models, OpenAI and Anthropic, listed in Microsoft’s own documents as processing data worldwide. That’s the default. And under the GDPR, you’re the one answerable for it. Did your decision take that into account?

  2. “Our data stays in the EU” is half true. Storage stays in Europe. The reading of your emails and files can happen in the US, Canada or Australia. Default for new tenants since March 2026. That matters for the GDPR. And since August 2026, the AI Act is enforceable too. It makes the organisation using the AI responsible for how it’s used. That’s you again.

  3. The fine lands on you. When a US authority compels your data, or a subprocessor moves it outside the EU, the GDPR calls that your transfer. Microsoft’s contract allows it, doesn’t guarantee compliance, and offers no opt-out. The risk is yours, not theirs.

  4. Microsoft can’t guarantee your data stays out of US hands. It handed data on Dutch regulators to the US Congress, unredacted. The ICC prosecutor’s email went dark under US sanctions; Microsoft denied it, then had to correct its testimony to the UK Parliament. Under oath, Microsoft France admitted it cannot guarantee European data stays out of US hands.

European regulators are done waiting. Denmark is pulling ministries off Microsoft. The Dutch parliament voted to halt cloud migration of sensitive data. The EU’s proposed sovereignty rules name healthcare and public-sector data explicitly. If regulators won’t accept “we assumed it was safe” from themselves, why would they accept it from you?

So if not Copilot, then what?

Yes, you can stay on Microsoft and not turn Copilot on. It doesn’t make you safe, you’re still in the Microsoft ecosystem, but it is safer for your data. And it saves roughly €26 to €30 per person per month. For a 150-person organisation, that’s about €50,000 a year.

But most organisations still want AI. Employees want it, and the work seemingly calls for it. So the real questions are: which AI, how far you take it, and how secure is it really?

Count the direct cost of Copilot, plus what it does to your data, your compliance and your duty of care to staff, and there’s a solid case for exploring the alternatives: EU-hosted models, open-weight models on European infrastructure, tools that keep your data under your jurisdiction.

They deserve a serious look before you assume the default cloud option is the safest.

Want the legal and technical detail, and my take on alternatives? Get in touch.