Back to AI Tools
Microsoft Copilot (Free)
Risk Overview
Moderate Risk
3.9
/10
Text Generation
·
Productivity Assistant
·
Document Analysis
·
Conversational AI
·
Top Risks
Consumer Copilot uses conversation data for model training by default (opt-out required). Mandatory arbitration and class action waiver for consumer users. CLOUD Act exposure for US-hosted data. M365 Copilot accesses email, calendar, documents, Teams, and SharePoint — significant agentic data access scope.
Mitigations
Use enterprise M365 Copilot with Entra ID for regulated workloads — the data protection is substantially stronger. Consumer users should opt out of training in privacy settings. Enterprise customers should review the Microsoft DPA and Online Services Terms. The Copyright Commitment for commercial Copilot is a valuable IP protection.
Get started
Is your team using
Microsoft Copilot (Free)
safely?
Highest Risk Categories
The highest-scoring risk categories identified in this assessment.
Legal Terms
Microsoft Services Agreement includes binding arbitration clause and class action waiver for US residents. AAA Mass Arbitration Supplementary Rules apply for related cases. Microsoft reimburses filing fees for claims under $75,000. Copilot terms designate the product as 'entertainment' in some legal contexts (noted in press coverage), limiting reliability warranties. Enterprise governed by separate Online Services Terms without consumer arbitration provisions.
7
/10
Training Use
Critical distinction: (1) ENTERPRISE/M365 Copilot: Microsoft does NOT train on data from users signed in with an Entra ID organizational account. Prompts, responses, and Microsoft Graph data are NOT used to train foundation models. (2) CONSUMER Copilot: AI model training applies by default. Users can opt out of training while keeping personalization enabled. Personal identifiers are anonymized before use in training. Score reflects the consumer default opt-in; enterprise is effectively a 1.
4
/10
3rd-Party Sharing
Microsoft Online Services Terms and DPA govern enterprise data. Consumer version subject to Microsoft Services Agreement. Data shared with Microsoft affiliates and service providers. No data sales. Microsoft is a PRISM program participant — government data requests possible under national security orders.
4
/10
Unlock the complete assessment
Run a free assessment to access the full AI tool risk analysis.
Updated July 2026 • AI-assisted research • Reviewed by Verax • Report an issue
Reference Documentation
Official documentation and policies referenced as part of this assessment.
Privacy Policy
https://privacy.microsoft.com/en-us/privacystatement
End User License Agreement (EULA)
https://www.microsoft.com/en-us/servicesagreement/