EU AI Act compliance for companies using Microsoft Copilot

Are you a provider or a deployer?

Microsoft is the provider. Your company is the deployer. Microsoft’s Responsible AI documentation and contractual terms cover their side and do not discharge your Article 4 obligation.

How this is classified under the Act

Productivity assistance across documents, email, and meetings does not sit in an Annex III domain. Nothing in that use makes or influences a decision about a person in a regulated field, so the assessment concludes minimal risk with the reasoning recorded.

Documents you need

• AI Literacy Policy Article 4

  A written policy covering which AI tools you use, which roles interact with them, what those people need to understand, who owns the document, and how it gets updated. Enforceable since 2 February 2025.

• Risk Classification Memo Articles 6, 9 and Annex III

  A documented assessment placing each AI system in the Act’s risk tiers, including the Article 5 prohibited-practice check and the Article 6(3) exception assessment, with article citations.

• Transparency Disclosure Article 50

  Informs people when they are interacting with an AI system and labels AI-generated or manipulated content. Article 50 applies from 2 August 2026. The narrower Article 50(2) duty on general-purpose models generating synthetic content applies from 2 December 2026.

Obligations that apply

• Article 4 Role-based literacy across the organisation

  Copilot typically reaches many roles at once, so the literacy policy has to cover tiers of user rather than one job title. Name who can use it, what they need to understand, and how new starters are brought up to speed.

• Article 4 Keeping the tool inventory current

  Microsoft ships Copilot features continuously. Your policy needs a review trigger so the document does not silently fall out of date as capabilities expand.

• Article 50 AI-generated content that reaches third parties

  Where Copilot drafts customer correspondence or public material that goes out substantially as generated, Article 50 transparency obligations apply from 2 August 2026.

Common mistakes

• Believing the Microsoft Product Terms make you compliant. They address Microsoft’s duties as provider only.
• Rolling Copilot out to a whole tenant with no written policy, then discovering the Article 4 deadline passed in February 2025.
• Leaving the AI tool inventory out of the policy, so nobody can answer which systems are in scope when asked.
• Overlooking Teams meeting summaries, which process what colleagues said and often surprise staff who never consented to it.

Where the deadlines stand

The AI literacy obligation under Article 4 and the Article 5 prohibitions have been enforceable since 2 February 2025. General-purpose AI model rules applied from 2 August 2025. The Omnibus, published in the Official Journal on 24 July 2026, moved the high-risk dates: standalone high-risk systems under Annex III to 2 December 2027, and high-risk AI embedded in regulated products under Annex I to 2 August 2028. Article 50 transparency obligations still apply from 2 August 2026. Only the narrower Article 50(2) duty on general-purpose models generating synthetic content moved, to 2 December 2026, which is also when the new prohibition on AI-generated intimate imagery and child sexual abuse material takes effect.

The delay applies to the high-risk obligations. It does not move Article 4, which is why a written AI literacy policy is the document most companies are missing today.

This page describes obligations under Regulation (EU) 2024/1689 as amended by the Omnibus published in the Official Journal on 24 July 2026, and was verified on 29 July 2026. It is general information rather than legal advice, and classification depends on your specific configuration and use. Review by qualified legal counsel is recommended before formal adoption of any compliance document.