Classified examples · Everyday AI tools · Po polsku
Microsoft 365 Copilot across email, Teams and documents
Minimal riskDeployer
Copilot is switched on for the whole company. It drafts replies, summarises meetings and answers questions from files the user can access.
How we classify it
- The company deploys an AI system supplied by Microsoft under its own authority: deployer.
- Office productivity is neither prohibited nor listed in Annex III: not high-risk.
- The main practical risk is not the AI Act but access rights: Copilot can surface any file a user is technically allowed to open, including files shared too widely.
- Result: minimal risk under the AI Act; AI literacy and data protection work are what matter.
What applies now
- AI literacy measures, especially on checking output and on what Copilot can see
- Review sharing permissions before roll-out (over-shared folders, 'everyone' links)
- Register entry, owner, and a vendor review of data residency and retention
- GDPR: security of processing and data minimisation
What would change the answer
- Using Copilot outputs to rate employees' performance makes that use high-risk (Annex III point 4(b))
- Any feature that infers employees' emotions from voice or video in meetings would be prohibited at work (Article 5(1)(f))
Evidence to keep
- Register entry
- Permission review record
- Vendor questionnaire
- Training register
In the AI Compliance Kit: 02AI Acceptable Use Policy · 03AI System Inventory · 06AI Literacy Programme · 07Vendor Due Diligence Questionnaire.
Dates and sources
- AI literacy duty, Article 4: 2 February 2025
Legal basis: AI Act art. 4; GDPR art. 5, 32.
Similar examples
- Staff use ChatGPT, Claude or Gemini for drafting and summaries Minimal risk
- AI note-taker that records and summarises meetings Depends on the use
- Developers use an AI coding assistant Minimal risk