In this guide
What Microsoft Copilot Actually Does (and Where Your Data Goes)
Microsoft 365 Copilot is an AI assistant embedded into Word, Excel, Outlook, Teams, and other M365 applications. It uses OpenAI's GPT-4 models to generate text, summarise documents, draft emails, analyse spreadsheets, and transcribe meetings. The marketing is compelling. The data architecture deserves scrutiny.
How Copilot processes your data
When a user invokes Copilot, the prompt and relevant context (documents, emails, calendar entries, chat history) are sent to Microsoft's AI infrastructure for processing. Microsoft states that Copilot uses the Microsoft Graph — the same API layer that connects all M365 services — to pull context from your tenant. This means Copilot can access anything the user has permission to see across SharePoint, OneDrive, Exchange, and Teams.
Microsoft makes several commitments about this data:
- Prompts and responses are not used to train foundation models
- Data is processed within the Microsoft 365 service boundary
- Tenant isolation is maintained between customers
- EU/UK data residency options are available for eligible tenants
These commitments are real, but they operate within a framework that has structural limitations for regulated UK organisations. The processing happens on Microsoft's infrastructure, using Microsoft's models, under Microsoft's operational control. You cannot inspect the inference pipeline, audit the model weights, or verify that no intermediate state is retained.
The Microsoft Graph exposure
Copilot inherits the user's permissions via Microsoft Graph. In organisations with overly permissive SharePoint or OneDrive configurations — which is most of them — Copilot can surface and summarise documents the user technically has access to but would never have found manually. This is a data exposure amplifier, not just an AI tool.
CLOUD Act Exposure for UK Organisations
The Clarifying Lawful Overseas Use of Data (CLOUD) Act, enacted in the United States in 2018, compels US-headquartered companies to disclose data in their possession, custody, or control — regardless of where that data is physically stored. Microsoft is a US-headquartered company.
This means that even if your M365 tenant is configured with UK data residency and your data physically sits in Microsoft's London data centres, a US law enforcement request under the CLOUD Act can compel Microsoft to produce it.
The UK-US Data Access Agreement
The UK and US signed a bilateral Data Access Agreement in 2019 (effective 2022) that creates a framework for cross-border data requests. UK organisations should not assume that UK data residency alone provides protection against US government access.
What this means for NHS and regulated data
For organisations handling NHS patient data, the CLOUD Act creates a tension with several obligations:
- Common law duty of confidentiality — patient data shared in confidence should not be accessible to foreign governments
- UK GDPR Article 48 — transfers based on foreign government orders are not recognised as lawful transfer mechanisms
- Caldicott Principles — the duty to justify the purpose of every use of patient data
- DSPT Standard 10 — suppliers must be accountable for data protection
Schrems II is still relevant
The CJEU's Schrems II ruling invalidated Privacy Shield because US surveillance laws provided insufficient protection for EU personal data. The ICO has not ruled that the CLOUD Act is incompatible with UK GDPR, but neither has it provided a safe harbour. The risk sits with the data controller.
Self-Hosted AI Alternatives
The open-source AI landscape has matured to the point where self-hosted alternatives to Copilot are not just viable — they are production-ready.
Open-source models worth considering
| Model | Parameters | Strengths | GPU Requirement |
|---|---|---|---|
| Llama 3.1 70B | 70B | General-purpose, strong reasoning, permissive licence | 2x A100 80GB or equivalent |
| Mistral Large / Devstral | Various | Code generation, EU-headquartered, Apache 2.0 | Single A100 for smaller variants |
| Qwen 2.5 72B | 72B | Multilingual, strong document analysis | 2x A100 80GB or equivalent |
| DeepSeek-V3 | 671B MoE | Near-frontier performance, mixture-of-experts efficiency | 8x A100 80GB (MoE reduces active params) |
| Phi-3 / Phi-4 Mini | 3.8–14B | Lightweight, runs on consumer GPUs | Single RTX 4090 or equivalent |
Inference infrastructure
Running these models requires an inference server and GPU compute. The key components:
- vLLM — high-throughput inference server with PagedAttention. Production-grade.
- Ollama — simplified model management for development and smaller deployments.
- Text Generation Inference (TGI) — Hugging Face's production inference server.
- LiteLLM — unified API gateway with model routing, cost tracking, and rate limiting.
What self-hosted AI can do today
- Document summarisation and analysis (clinical notes, contracts, policies)
- Email drafting and response suggestion
- Code generation and review
- Meeting transcription and action extraction (with Whisper)
- Knowledge base search and question answering (RAG pipelines)
- Data classification and labelling
- Translation
These cover the core Copilot use cases. The integration is different — you will not get the in-app Word/Excel/Outlook embedding that Copilot provides. But you get full control over what data touches the model, where inference happens, and what logs are retained.
DSPT and GDPR Implications of Each Approach
If your organisation is DSPT-assessed or handles data subject to UK GDPR, the choice between Copilot and self-hosted AI has direct compliance consequences.
| Requirement | Microsoft Copilot | Self-Hosted AI |
|---|---|---|
| Data residency (UK) | Available but requires specific tenant configuration | Guaranteed — you choose the physical location |
| CLOUD Act exposure | Yes — Microsoft is a US company | None — no US entity in the processing chain |
| Data Processing Agreement | Microsoft's standard DPA (non-negotiable) | You are the processor — no third-party DPA needed |
| DSPT Standard 10 | Microsoft holds its own DSPT, but verify scope | No additional supplier to assess |
| DPIA requirement | Required — high-risk automated processing | Required — but you control all variables |
| Audit trail | Limited to Microsoft's audit logs | Full control — log every prompt and response |
| Model transparency | Closed-source GPT-4 | Open weights; reproducible |
| Right to erasure | Dependent on Microsoft's processes | Direct control — delete from your own systems |
DPIA is mandatory for both
Under UK GDPR Article 35, a Data Protection Impact Assessment is required for any “systematic and extensive evaluation of personal aspects” based on automated processing. This applies whether you use Copilot or self-hosted models. The difference is that a self-hosted DPIA has fewer unknowns.
Cost Comparison: Per-Seat Licensing vs Self-Hosted Infrastructure
Copilot's per-seat model scales linearly. Self-hosted infrastructure has a fixed base cost that serves many users. The crossover point comes quickly.
Microsoft 365 Copilot pricing
- £25/user/month (approximately, on top of existing M365 E3/E5 licensing)
- Requires M365 E3, E5, Business Standard, or Business Premium as a prerequisite
- No option to buy for a subset of use cases — it is the full Copilot or nothing
- Annual commitment typically required
| Organisation Size | Copilot Annual Cost | Self-Hosted Compute Cost* | Compute Saving* |
|---|---|---|---|
| 50 users | £15,000 | £2,400–4,800 | £10,200–12,600 |
| 200 users | £60,000 | £4,800–9,600 | £50,400–55,200 |
| 1,000 users | £300,000 | £14,400–28,800 | £271,200–285,600 |
| 5,000 users (NHS Trust) | £1,500,000 | £36,000–72,000 | £1,428,000–1,464,000 |
*Raw GPU compute cost from third-party European providers (Hetzner, netcup, OVH) only. Excludes integration, build, and ongoing maintenance, which is priced per engagement — complex or regulated-environment builds are priced separately, see pricing.
What self-hosted infrastructure actually costs
Self-hosted costs are dominated by GPU compute and staff time, not per-seat licensing. A representative setup:
- GPU server (dedicated) — £200–400/month from European providers (Hetzner, netcup, OVH). Includes 1–2 GPUs with 48–80GB VRAM each.
- Inference software — free (vLLM, Ollama, TGI are open-source)
- Models — free (Llama, Mistral, Qwen are open-weight)
- Integration and maintenance — initial setup 5–10 days, ongoing maintenance 2–4 hours/month.
- Scaling — add GPU servers as throughput requires. No per-user cost.
The hidden Copilot cost
Copilot's £25/user/month is on top of M365 licensing (£20–50/user/month depending on tier). For organisations already questioning their M365 spend, Copilot adds 30–50% to the existing bill. Self-hosted AI can run alongside any productivity suite — or alongside a migration away from M365 entirely.
When Copilot Is Fine vs When Self-Hosted Is Essential
This is not a binary choice. Some organisations can use Copilot safely. Others cannot. The deciding factors are data classification, regulatory obligations, and risk appetite.
Copilot is likely acceptable when:
- Your data is not special category under UK GDPR (no health, legal, financial personal data)
- You have no DSPT obligations and do not handle NHS patient data
- Your organisation has accepted the CLOUD Act risk in its DPIA
- Microsoft's standard DPA meets your contractual obligations
- Deep M365 integration is a genuine productivity requirement, not just convenience
- Your data classification allows third-party processing by a US entity
Self-hosted is essential when:
- NHS patient data — DSPT, Caldicott Principles, and common law duty of confidentiality create obligations that are difficult to satisfy with US-controlled AI processing
- Legal professional privilege — law firms cannot risk foreign government access to privileged client communications
- Financial regulated data — FCA-regulated firms have specific outsourcing and operational resilience requirements
- Defence and national security — classified or OFFICIAL-SENSITIVE data must not be processed by foreign-owned infrastructure
- Research data — academic and scientific research with confidentiality obligations
- Any organisation that has committed to data sovereignty — if your privacy policy, contracts, or board decisions state that data stays on UK/EU infrastructure, Copilot may violate that commitment
The hybrid trap
Some organisations attempt a hybrid approach: Copilot for non-sensitive work, self-hosted for sensitive data. This is theoretically sound but operationally dangerous. It requires staff to correctly classify data in real time, every time, before choosing which AI tool to use. In practice, people use whatever is most convenient. A single misclassification sends sensitive data to Microsoft. If you handle sensitive data at all, the default should be self-hosted.
Practical Steps to Deploy Private AI
Deploying self-hosted AI is not a research project. The tooling is mature. Here is a practical path from zero to production.
Phase 1: Assessment (1–2 weeks)
- ☐ Identify the AI use cases that would deliver the most value
- ☐ Classify the data each use case touches (personal, special category, confidential, public)
- ☐ Determine regulatory obligations (DSPT, FCA, legal privilege, contractual)
- ☐ Estimate concurrent users and throughput requirements
- ☐ Complete a Data Protection Impact Assessment
Phase 2: Infrastructure (1–2 weeks)
- ☐ Provision GPU compute from a UK/EU provider (Hetzner, netcup, OVH, or on-premises)
- ☐ Deploy Kubernetes or Docker-based inference stack
- ☐ Install inference server (vLLM or Ollama) with API gateway (LiteLLM)
- ☐ Download and configure chosen open-source models
- ☐ Configure TLS, authentication, and network isolation
- ☐ Implement logging and audit trail for all AI interactions
Phase 3: Integration (2–4 weeks)
- ☐ Build or deploy a user-facing interface (web chat, VS Code extension, API endpoints)
- ☐ Connect document stores for RAG (retrieval-augmented generation) if needed
- ☐ Integrate with existing authentication (SSO, Active Directory, Zitadel)
- ☐ Set up role-based access controls for different AI capabilities
- ☐ Pilot with a small group of users and gather feedback
Phase 4: Production (ongoing)
- ☐ Roll out to all users with training and documentation
- ☐ Monitor usage, performance, and cost
- ☐ Upgrade models as new open-source releases appear (quarterly cycle typical)
- ☐ Maintain audit logs for DSPT/GDPR evidence
- ☐ Review and update DPIA annually
Total timeline: 4–8 weeks
A competent team can go from zero to production self-hosted AI in 4–8 weeks. This is comparable to a Copilot rollout once you factor in tenant configuration, DPIA completion, user training, and the inevitable permission cleanup that Copilot forces you to do anyway.