An AI governance framework for Microsoft 365, mapped to the EU AI Act

An AI governance framework is the set of roles, records, rules and reviews that decides which AI tools and agents your organisation uses, what data they can reach and who answers for them. In Microsoft 365, it turns Microsoft Copilot (formerly Microsoft 365 Copilot), its agents and connected assistants into owned, documented and regularly checked services.

The best-known AI governance frameworks come from NIST and ISO. Both are useful, and both are written for any organisation and any kind of AI. This article describes a narrower framework you can run inside a Microsoft 365 tenant, in five layers, each tied to the Microsoft controls that support it, to what the EU AI Act asks of an organisation that uses AI, and to where GDPR, NIS2 and DORA come in. For the daily checks and audit exports behind it, see how we approach Microsoft 365 compliance.

One caveat runs through everything below. Controls produce evidence. Whether you comply is a judgement for your organisation, your legal team and your auditors, and no tool can make it for you.

What is an AI governance framework?

It is a working answer to a few practical questions: which AI is in use, who owns it, what it may touch, and how you know the rules hold. The label matters less than the fact that each answer has a named owner and leaves a record.

In a Microsoft 365 tenant, those questions take a concrete form. Copilot only shows people content they can already open, as Microsoft explains in its Copilot privacy documentation. Your permissions set the limit of what AI can surface, and overshared content becomes easier to find. Agents add a second layer: people with a Copilot licence can create agents from SharePoint sites and files, and makers build their own in Copilot Studio.

A framework that stops at the assistant misses the tenant underneath, which is why the layers below spend as much time on sites, labels and owners as on AI.

How does it relate to NIST AI RMF and ISO/IEC 42001?

Those two sit above a Microsoft 365 framework and give it a method. Neither tells you which tenant setting to change.

The NIST AI Risk Management Framework (AI RMF 1.0) was published in January 2023 and is voluntary. It is organised around four functions: Govern, Map, Measure and Manage. NIST is revising it, without a published date for the next version. In July 2024, NIST added a Generative AI Profile (NIST AI 600-1) that applies the framework to generative AI.

ISO/IEC 42001:2023, the ISO standard for AI management systems, sets requirements for an AI management system: how an organisation establishes, implements, maintains and improves the way it manages AI.

Use them as your reference for method, and the five layers to apply it day to day in Microsoft 365. If you already work towards ISO/IEC 42001, the records each layer produces can feed your management system; they do not replace it.

What are the five layers of an AI governance framework for Microsoft 365?

Scope and roles, inventory, rules, evidence and review. Each layer answers one question, and each depends on the one before: you cannot write rules for tools you have not listed, or show evidence for rules nobody owns.

1. Scope and roles: what is covered, and who decides?

Start by naming what the framework covers. The list can include Microsoft Copilot, Copilot Chat, agents built in Copilot Studio or from SharePoint sites, Power Platform apps and flows, and third-party assistants such as ChatGPT Enterprise or Claude Enterprise connected to your directory. Copilot Chat is included for work accounts on eligible plans, so it may already be in use before any formal roll-out decision.

Then write down the roles, on one page, for each tool or family of agents:

• An owner who answers for it and approves changes
• Who may build agents, and who approves sharing them widely
• Who reads the audit records, and how often
• Who is consulted on data protection and security

Microsoft gives these roles a technical anchor. In the Microsoft 365 admin center, approving agent requests and assigning owners are reserved for the AI Administrator and Global Administrator roles. Admins can see every agent with the AI Reader role, without an extra licence. In Microsoft Entra ID, admins can block or limit user consent to apps, and people can ask for admin approval instead. That turns "who decides" into a setting.

Scope also covers the law. Which frameworks reach you depends on where you operate and what you do, and your legal team confirms it; the sections on the EU AI Act, GDPR, NIS2 and DORA below give the starting points.

2. Inventory: which AI is in use, and what can it reach?

List every AI tool and agent with its owner, its purpose, the people who use it and the data it can reach. This list tells you who needs training, and it feeds your GDPR record of processing activities.

Microsoft supplies much of the raw material:

• The Microsoft 365 admin center has an agent registry that lists the agents available in your organisation. The registry and basic agent actions, such as approving, blocking or reassigning an owner, come with Microsoft 365 plans, and the registry flags agents that have lost their owner. Our article on Microsoft Agent 365 explains what the licensed layer adds.
• The Power Platform inventory lists every agent, app and flow in the tenant, and lets admins block a published agent while they investigate.
• Microsoft Defender for Cloud Apps can list the generative AI apps people use, including tools nobody approved. Our guide to shadow AI covers what to do with that list.

The purpose of each tool, and the data it should reach rather than the data it can reach, is something only your organisation can write down. The next layer starts from that line.

3. Rules: what may AI touch, and who may build and share?

Rules turn the inventory into decisions. Keep them few and testable: a rule nobody can check is a wish.

Data rules come first, because Copilot works with whatever each person can already open:

• Data access governance reports in the SharePoint admin center show where sites may be overshared, and can start a site access review with the owner. SharePoint Advanced Management, which provides them, is available once at least one user has a Microsoft Copilot licence.
• Restricted Content Discovery keeps a site out of Copilot and organisation-wide search without changing who has access. Microsoft describes it as a temporary control while permissions are fixed.
• When sensitivity labels encrypt content, Copilot respects each user's usage rights.

Agent rules come next. In the Power Platform admin center, data policies control which connectors and knowledge sources agents may use, and Managed Environments limit how widely agents that require sign-in are shared. Admins can also block public website knowledge with a data policy. Three starting rules are worth considering: every agent has a named owner and a stated purpose; agents grounded on public websites need approval; agents shared with the whole organisation get a second look.

Usage rules complete the set, and this is where the EU AI Act reaches everyday work. Most transparency duties sit with the provider, but organisations must label deepfakes, and AI-written text published to inform the public on matters of public interest, unless a person has reviewed it and someone takes editorial responsibility for it. One clear line in the guidance for teams that publish news or public statements covers it.

4. Evidence: how do you show the rules are applied?

Evidence is the record that a rule ran, what it found and who decided what. It should come out of the work itself, not be assembled the week before an audit.

Microsoft records part of it for you. Copilot interactions are recorded in the Microsoft Purview audit log, including which files were used. Microsoft Purview Data Security Posture Management (DSPM) shows how AI apps and agents use sensitive data. The agent registry and the Power Platform inventory can both be exported to CSV.

The rest comes from your own process: owner decisions, review dates, exceptions and training. For AI literacy, a dated list of who was trained on which tool is the simplest way to show your measures exist.

5. Review: how do you keep the framework current?

Review stops the framework from turning into a document nobody opens. Three things need a regular look.

• Owners and access. A SharePoint admin starts a site access review from a data access governance report; the site owner fixes access and marks the review complete, and the admin sees the outcome. SharePoint Advanced Management can also flag inactive or ownerless sites, ask owners to confirm them, then set them to read-only or archive them.
• Agents. Work through the agents the registry flags as ownerless, ask owners to confirm the ones they keep, and retire the ones nobody uses.
• The rules themselves. The EU AI Act was amended in July 2026 and the dates of its high-risk rules changed. Put a date in the calendar to re-read the rules that apply to you, rather than relying on what was true when the framework was written.

What does the EU AI Act actually require from a deployer?

Less than many summaries suggest, and more than nothing. The Act calls an organisation that uses an AI system under its authority a deployer; only personal, non-professional use falls outside that definition. Unless a use is high-risk, a deployer's duties are few. The dates, from the AI Act and its July 2026 amendment:

• The EU AI Act entered into force on 1 August 2024.
• Prohibited practices and AI literacy have applied since 2 February 2025.
• Rules for general-purpose AI models have applied since 2 August 2025 (for their providers).
• Most of the Act, including its transparency rules, has applied since 2 August 2026.
• The EU amended the Act in July 2026 with the "AI Omnibus", Regulation (EU) 2026/1744. High-risk rules now apply from 2 December 2027, and from 2 August 2028 for AI built into regulated products.

For a typical Microsoft 365 tenant, three points matter.

1. AI literacy. Organisations using AI are expected to take measures that support AI literacy among their staff. The July 2026 amendment simplified this duty and gave the Commission and Member States a stronger role. It did not remove it.
2. Transparency. Most transparency duties sit with the provider. As a user of AI, you label deepfakes, and AI-written text published to inform the public on matters of public interest, unless a person has reviewed it and someone takes editorial responsibility for it.
3. High-risk uses. Detailed deployer duties apply to high-risk AI systems. The Act ties high-risk status to uses it lists and to AI built into regulated products, so the question is what you use a tool for. Review your use cases with your legal team before 2 December 2027.

What the Act does not require is a formal AI inventory. Reading it as a demand for a register of every tool, with a risk file for each, applies high-risk thinking to tools that may not be high-risk. The inventory is still worth keeping, as good practice rather than as a legal duty. Note also that the Act can apply to UK and Swiss organisations whose AI output is used in the EU.

Where do GDPR, NIS2 and DORA come in?

They cover the data and the systems AI works with, so most of the evidence you build for them also serves your AI governance. None of them names Copilot. Each one asks, in its own words, who can reach which data, who decided and when.

• GDPR. Processing through AI assistants belongs in your GDPR record of processing activities. A data protection impact assessment is required where the processing is likely to result in a high risk. GDPR applies to organisations established in the EU, and to others that offer goods or services to people in the EU or monitor their behaviour.
• NIS2. As a rule, NIS2 covers medium-sized and large organisations in the critical sectors it lists. EU Member States had to apply it from 18 October 2024. On 8 July 2026, the Commission referred four Member States, France among them, to the Court of Justice for failing to transpose it. Check the national law that applies to you.
• DORA. DORA has applied to financial entities since 17 January 2025, including how they manage ICT providers.
• United Kingdom. NIS2 does not apply as such. UK GDPR and the Data Protection Act 2018 apply, as do the NIS Regulations 2018 for the organisations within their scope. In October 2026, the Cyber Security and Resilience Bill was still before Parliament.
• Switzerland. The revised Federal Act on Data Protection applies directly to AI processing.

How do you produce evidence without a spreadsheet?

Let the checks run on their own and keep what they produce. Spreadsheets appear when evidence is gathered by hand from several admin centres just before an audit, and they age as soon as they are sent.

A pattern that holds up:

1. Turn each written rule into a check against the tenant, with a severity.
2. Run the checks on a schedule, not only before an audit.
3. Send each finding to the owner of the object concerned, who fixes it or explains why it should stay.
4. Record each decision with its date and reason.
5. Export the inventory, the findings, the decisions and the trend on a schedule, to the people who need them.
6. Keep Microsoft's own records, such as the Purview audit log and the registry and inventory exports, next to yours.

Agree early with your auditors which exports they want.

How Neptune helps

Neptune is an integrator. We select the governance tool that fits your tenant and the frameworks you answer to, implement it with your team, train your admins and owners, and support you after go-live, with professional services during the engagement and a customer success manager afterwards. We also configure the Microsoft controls above, starting with those you already have.

For this framework, the tool we put in place gives you:

• One inventory of teams, sites, apps, flows and agents, with the links between them, so each agent is seen with the content it relies on.
• An AI register in the tenant: each Copilot deployment and agent is recorded with an owner, a purpose and the data it can reach. This is good practice and a practical basis for AI Act and GDPR records, not a legal requirement in itself.
• Owner reviews in Microsoft Teams: owners review and approve where they already work, so IT is no longer the bottleneck.
• Evidence over time: findings are tracked by service, and the evidence can be exported on a schedule or on demand.

Controls produce evidence; whether you comply is a judgement for your organisation and its auditors, and no tool can make it for you. See how we run Microsoft 365 compliance checks and audit evidence, and how the same approach applies to Microsoft AI governance.

Sources

• Regulation (EU) 2024/1689, Artificial Intelligence Act
• Regulation (EU) 2026/1744 (Digital Omnibus on AI)
• European Commission: AI Omnibus enters into force
• Regulation (EU) 2016/679, General Data Protection Regulation
• European Commission: who does the data protection law apply to?
• European Commission: NIS2 Directive
• European Commission: referral of four Member States to the Court of Justice over NIS2
• Regulation (EU) 2022/2554, Digital Operational Resilience Act
• Data Protection Act 2018
• The Network and Information Systems Regulations 2018
• UK Parliament: Cyber Security and Resilience Bill
• FDPIC: current data protection law is directly applicable to AI
• NIST AI Risk Management Framework
• NIST AI 600-1, Generative Artificial Intelligence Profile
• ISO/IEC 42001:2023, AI management system
• Microsoft Learn: data, privacy and security for Microsoft Copilot
• Microsoft Learn: manage Microsoft Copilot
• Microsoft Learn: Agent 365 in the Microsoft 365 admin center
• Microsoft Learn: agent registry
• Microsoft Learn: Microsoft Agent 365 service description
• Microsoft Learn: configure user consent to applications
• Microsoft Learn: Power Platform inventory
• Microsoft Learn: manage generative AI apps
• Microsoft Learn: data access governance reports
• Microsoft Learn: Restricted Content Discovery
• Microsoft Learn: data policies in Copilot Studio
• Microsoft Learn: audit logs for Copilot and AI applications
• Microsoft Learn: Microsoft Purview Data Security Posture Management
• Microsoft Learn: site access review
• Microsoft Learn: site lifecycle management