Microsoft Teams Copilot and GDPR / AI Act: the enterprise framework for AI meetings

Overview and data processed

Copilot in Teams is Microsoft's AI assistant applied to meetings: transcription, summaries, 'intelligent recap', action items and questions about meeting content, within the Microsoft 365 environment.

Copilot processes transcription and meeting content to generate summaries and actions. Microsoft states that this data remains within the tenant and is not used to train foundation models, with the EU Data Boundary. US publisher: the CLOUD Act remains applicable.

Risks for your organisation

The Microsoft foundation is solid, but two points remain: information/consent of participants (especially external) and internal over-exposure (access to recaps according to permissions). Residual transfer (CLOUD Act) must be assessed.

Main GDPR risks:

• Insufficient information; internally, employee consent rarely valid (legitimate interest/contract).
• Meetings with third parties: information and consent essential.
• Governance of access to recaps (permissions); retention.
• Residual transfer (CLOUD Act) despite EU Data Boundary.

GDPR obligations

1. Inform participants of Copilot activation; consent of third parties.
2. Activate EU Data Boundary; use the DPA; audit access to recaps.
3. Define retention of transcriptions/recaps.
4. Consult works council if monitoring/assessment; record in the record of processing activities; DPIA if behavioural analysis.
5. Involve the DPO; train teams. No DPO? See our outsourced DPO.

AI Act obligations

Transparency (Article 50): inform about AI and flag AI-generated reports. GPAI; AI literacy required. Prohibition (Article 5): analysis of tone/mood/stress/emotional engagement prohibited at work — disable these functions. Participation analyses feeding HR decisions become high-risk (Annex III). See the AI Act guide.

AI Act risks: participants not informed about AI; any emotion analysis (prohibited); participation analyses for HR purposes (high-risk).

Cybersecurity and best practices

Cyber risks: recaps accessible according to permissions that are sometimes too broad; residual transfer (CLOUD Act); prompt injection via ingested content; NIS 2 depending on size.

Best practices: activate EU Data Boundary; audit access to recaps; information + consent of third parties; controlled retention; disable all emotional analysis; supervision of sensitive summaries; AI charter, record of processing activities, AI training.

Checklist:

• Participants informed of Copilot activation, third-party consent, EU Data Boundary activated
• DPA verified and access to recaps audited, retention defined, no emotion analysis
• Works council consulted if monitoring/assessment, DPIA if behavioural analysis, teams trained

Sanctions, conclusion and recommendations

Sanctions: GDPR (up to €20m or 4%); AI Act (€35m/7% or €15m/3%); criminal provisions (Article 226-1 of the Criminal Code); obstruction offence (works council).

Recommendation: Teams Copilot offers a solid enterprise framework (tenant, EU Data Boundary, no foundation model training). The key lies in participant information/consent and governance of access to recaps. Activate the EU, audit access, inform, minimise, and assess residual exposure to the CLOUD Act for sensitive meetings. Compare with Zoom AI Companion and tl;dv. See the AI tools comparison.