Templates pre-filled by our experts

1. 1

   What is the outcome of the application?

   Content, such as written text, video, audio, images or machine-readable data.

2. 2

   Is the design of the application based on data?

   Yes, the application contains components derived from data. This involves fitting or learning a model or automatic variable selection using statistics, optimization, simulation, machine learning, or a similar technique.

   Explanation

   Microsoft M365 Copilot runs on a language model that has been trained on very large amounts of text. As a result, the model has learned patterns in language: how sentences are built, what a summary looks like and which answer fits which question. This lets Copilot handle questions that were not anticipated in advance. The model is trained before it is put into use. Microsoft 365 Copilot is configured at tenant level so that user input is not used to train the underlying models.

3. 3

   Are personal data being processed by the application?

   Yes, personal data are processed by the application.

   Explanation

   Copilot processes personal data in at least the following ways: input from employees (prompts may contain names, email addresses or details about citizens and colleagues) and data about the user themselves (the employee’s account and usage data).

   “No” is only defensible here if Copilot is fully shielded from the M365 environment and employees demonstrably do not enter any personal data – in practice, a claim that cannot be proven.

4. 4

   Are personal aspects relating to a natural person being evaluated, analyzed or predicted?

   No, personal aspects are not evaluated, analysed or predicted.

   Explanation

   Copilot is a tool for creating content. It generates, summarises and rephrases text. It does not assign scores to people, create segments or rankings, or predict characteristics such as performance, reliability, health or behaviour. There is no target variable per person, and no profile of anyone is built or stored.

   The fact that the input may contain personal data (emails, reports, calendar items) does not change this. What matters is the purpose of the processing, which is content-related, not evaluative.

5. 5

   Is the output of the algorithm shared with other organizations?

   No, the output of the algorithm is not shared with other organisations.

   Explanation

   Copilot’s output goes only to the employee who asked the question, and stays within the organisation’s own Microsoft tenant. There is no integration that automatically passes results on to another organisation.

   What an employee does with the text after reviewing it – sending a letter, sharing a report – does not count here. The follow-up questions cover how the employee assesses the output and uses it in the work process.

6. 6

   Is the output of the algorithm stored for longer than the duration of the primary process for which the algorithm is used?

   No, the output of the algorithm is not stored for longer than the duration of the primary process for which the algorithm is used.

   Explanation

   The retention policy requires users’ prompts and responses to be deleted once the session or task has ended.

7. 7

   Is a decision made in the process for individuals (consumer or citizen), organizations, or employees?

   Yes, a decision is made in the process for individuals (consumer or citizen), organisations or employees.

   Explanation

   It cannot be ruled out in advance that the work process involves a decision for individuals (consumer or citizen), organisations or employees. The follow-up questions address the effect the application has on the outcome.

8. 8

   What kind of decision is made in this process?

   Decision on formal complaints and objections.

   Explanation

   One of the most far-reaching types of decision has been chosen here, because it cannot be ruled out in advance that Copilot is used in the work process for formal complaints and objections. The next questions address the effect the application has on the outcome.

9. 9

   Which of the following options best describes the effect of the application on the outcome?

   The outcome is entirely determined by a human; the application is one of several factors and is not decisive.

   Explanation

   Copilot provides a draft or a suggestion, not a decision. The employee remains responsible for the final content. That judgement draws on factors Copilot knows nothing about: professional expertise, knowledge of the case file, applicable laws and regulations, internal guidelines and work instructions, and possibly consultation with colleagues. The application is therefore one of several sources of information and never the deciding factor. Without Copilot the same work would still be done, just with more time and effort – the application affects the pace of the work, not its outcome.

Based on these answers, the Identification questionnaire indicates that both the AI Act and the GDPR apply. This is not an high-impact algorithm, because the outcome is determined entirely by a human; the application is one of several factors and is not decisive. A separate follow-up questionnaire determines that transparency requirements also apply.