Microsoft Copilot vs Self-Hosted AI
Cost, Compliance & Data Sovereignty
Microsoft Copilot is convenient. But convenience has a price — in pounds, in data exposure, and in regulatory risk. Here's what you're actually choosing.
Feature Comparison
| Capability | Microsoft Copilot | Self-Hosted AI (Genitco) |
|---|---|---|
| AI capabilities | Summarisation, drafting, search across M365 apps | Summarisation, drafting, search, plus custom models fine-tuned to your domain |
| Model choice | OpenAI GPT-4o — Microsoft chooses, you consume | Any model — Qwen, Llama, Mistral, Phi, or your own fine-tuned variant |
| Data residency | Microsoft EU Data Boundary (processing may still route via US infrastructure) | Your servers, your jurisdiction — UK or EU, fully auditable |
| Data access | Microsoft processes your prompts, documents, and emails server-side | Data never leaves your infrastructure — zero third-party access |
| Training on your data | Microsoft states no training on enterprise data (trust their policy) | Technically impossible — no external party has access |
| Integration scope | M365 suite only — Word, Excel, Outlook, Teams, PowerPoint | Any system — ERP, CRM, clinical, legal, proprietary databases |
| Customisation | Copilot Studio for basic plugins and prompt engineering | Full fine-tuning, RAG pipelines, domain-specific agents, custom tool calling |
| Vendor lock-in | High — tied to M365 stack and Microsoft licensing | None — open-source models, standard APIs, swap any component |
| Offline / air-gapped | Not possible — requires Microsoft cloud | Fully supported — runs without internet connectivity |
| Audit trail | Microsoft admin logs — limited prompt-level visibility | Complete observability — every prompt, every token, every decision logged locally |
Cost Comparison: Copilot vs Self-Hosted
Copilot costs £25/user/month as an add-on — but requires an M365 E3/E5 or Business Standard/Premium licence (from £23/user/month). Self-hosted AI has a fixed infrastructure cost that doesn't scale with headcount.
| Seats | Copilot Add-on | M365 Prerequisite | Copilot Total /mo | Self-Hosted /mo | Annual Savings |
|---|---|---|---|---|---|
| 50 | £1,250/mo | £1,150/mo | £2,400/mo | £400–800/mo | Up to £24,000/yr |
| 200 | £5,000/mo | £4,600/mo | £9,600/mo | £600–1,200/mo | Up to £108,000/yr |
| 1000 | £25,000/mo | £23,000/mo | £48,000/mo | £1,500–3,000/mo | Up to £558,000/yr |
Assumptions: Copilot add-on at £25/user/month. M365 E3 at ~£23/user/month (minimum qualifying plan). Self-hosted pricing includes EU-hosted GPU compute, storage, and management. One-off deployment fee (£8,000–25,000) not included in monthly figures. Prices as of early 2026.
Where Does Your Data Go?
Microsoft Copilot
- ⚠Prompts and document content sent to Microsoft Azure for processing
- ⚠Processed by OpenAI GPT-4o on Microsoft-controlled infrastructure
- ⚠EU Data Boundary available, but processing paths are opaque
- ⚠Microsoft retains logs and telemetry — scope governed by their DPA
- ⚠Subject to US CLOUD Act — US government can compel disclosure
Self-Hosted AI
- ✓All processing happens on your infrastructure — UK or EU hosted
- ✓No data leaves your network — ever
- ✓Open-source models — fully inspectable, no black-box processing
- ✓Complete audit trail — every prompt, response, and token logged locally
- ✓Not subject to foreign government data access requests
Regulatory Compliance
If you operate in healthcare, legal, financial services, or another regulated sector, AI compliance isn't optional. Here's how each option aligns.
| Framework | Microsoft Copilot | Self-Hosted AI |
|---|---|---|
| GDPR / UK DPA 2018 | Relies on Microsoft DPA and EU Data Boundary. You remain controller but delegate processing to Microsoft. | Full controller and processor. No third-party data processing. Data stays in your jurisdiction. |
| DSPT (NHS Digital) | Not designed for DSPT. Patient data in Microsoft cloud requires extensive IG assessment and risk acceptance. | Deployable on NHS-approved infrastructure. Data never leaves your N3/HSCN network. |
| SRA Standards (Legal) | Client legal privilege at risk — Microsoft processes document content. SRA guidance warns against cloud AI on client files. | Client data remains under your control. Privilege maintained. Full audit trail for regulatory review. |
| DORA (Financial) | Adds Microsoft as a critical ICT third-party provider. Requires concentration risk assessment and exit strategy. | No additional third-party ICT risk. Full operational resilience control. |
| ISO 27001 | Covered by Microsoft’s certification, but your ISMS must document the dependency and assess residual risk. | Fully within your ISMS boundary. No external dependencies to document. |
The Verdict: When Each Wins
Copilot Makes Sense When
- ✓You’re already committed to the M365 stack with no plans to leave
- ✓AI use is limited to non-sensitive internal productivity tasks
- ✓You have fewer than 20 users and don’t need custom models
- ✓You don’t operate in a regulated industry
- ✓Speed of deployment matters more than data sovereignty
Self-Hosted AI Wins When
- ✓You handle patient data, client legal files, or financial records
- ✓Regulatory compliance (DSPT, SRA, DORA) is mandatory
- ✓Cost at scale matters: 50+ seats and Copilot fees compound
- ✓You need AI across non-Microsoft systems (ERP, CRM, clinical)
- ✓Data sovereignty is non-negotiable; you can’t have a US company processing your data
- ✓You want to fine-tune models on your own domain knowledge
- ✓You need offline or air-gapped operation
Want the full technical breakdown?
Our in-depth guide covers migration paths, architecture options, deployment models, and a step-by-step framework for replacing Copilot with private AI.
Read the full guide: Private AI vs Copilot →Find out what Copilot is really costing you
30-minute call to audit your M365 AI spend, map what should stay on Copilot, and scope what's better self-hosted.