Microsoft Copilot in a GxP Company: Where It Fits and Where It Must Not

What Is Switched On Today: A Status Check

Before writing a policy, it helps to know what product you are writing it for. Copilot has changed names, tiers, and features several times since its launch, and most internal guidance written in 2024 or early 2025 is now out of date. Here is what Microsoft’s own documentation says as of late October 2026.

The Product Names Changed Again

Microsoft now uses “Microsoft Copilot” as the main product name in its admin and privacy documentation. The overview page notes that the app formerly called the Microsoft 365 Copilot app is now called Microsoft Copilot, that the Microsoft 365 Copilot Chat app is now called Microsoft Copilot Chat, and that the main web address is moving to copilot.cloud.microsoft.¹ The license names still carry “Microsoft 365 Copilot,” so you will see both forms. In this article we use “Copilot” for the family and name the tier when the tier matters.

The naming matters for one practical reason. Policies that say “Microsoft 365 Copilot is approved for X” may not, on a plain reading, cover Copilot Chat, Copilot in Teams, agents, or the newer task features. Write the policy around what the tool does and what data it reaches, not around a product label that may change again.

Three Tiers, Three Different Data Reaches

Microsoft describes several license levels, and the differences are about how much of your company’s data Copilot can reach on its own:¹²

The first premise to correct, then, is that Copilot is something a company “switches on” in one decision. For many organizations, Copilot Chat and standard in-app Copilot are already present through existing licenses. The decision in front of quality and IT leaders is how to govern a tool that is already in use, and whether to extend it with the Premium tier that reaches across the tenant.

Agents and Cowork Change the Question

Early Copilot governance focused on drafting and summarizing. That is no longer the whole picture. Microsoft’s overview describes Cowork as a feature that carries out tasks across the Microsoft 365 environment on the user’s behalf, and describes agents as scoped versions of Copilot that can automate business processes.¹ Microsoft’s privacy documentation says admins control which agents are allowed in the organization through the Integrated apps section of the admin center, and that users can only reach agents their admin allows.³

For a GxP company this is the most important change in the last year. A tool that drafts text leaves a human between the output and the record. A tool that moves files, edits documents, or sends messages can change a record directly. Your policy needs a separate rule for anything that acts.

Which Models Answer the Prompt

Copilot no longer runs on a single model family. Microsoft’s documentation describes third-party models from OpenAI and Anthropic offered as subprocessors, plus Microsoft-hosted models, and a default “Auto” mode in Copilot Chat that routes each prompt to a model based on the prompt.²³ Microsoft’s Anthropic page states that Anthropic models are on by default for most commercial cloud customers but off by default in the EU, EFTA, and UK, that they are currently excluded from the EU Data Boundary, and that a separate category labeled “Anthropic models with Data Retention” falls under Anthropic’s own terms rather than Microsoft’s Data Protection Addendum and must always be separately enabled.⁴

None of this is a reason to avoid Copilot. It is a reason for IT to check the model provider settings in the admin center, decide them on purpose, and record the decision. For a company with EU clinical or manufacturing data, the data-boundary point alone is worth a documented review.

One Familiar Control Is Being Retired

Many 2024 Copilot rollout plans relied on Restricted SharePoint Search, which limited organization-wide search and Copilot to an allow list of up to 100 sites. Microsoft’s page now says the feature is retiring and that new enablement is blocked starting July 31, 2026, and it points customers to Restricted Content Discovery instead.⁵ If your rollout plan still names Restricted SharePoint Search as the safety measure, that plan needs updating before anything else.

What GxP Rules Say About a Tool Like Copilot

No regulation names Copilot, and none needs to. The existing rules on records, computerized systems, and data integrity already tell you where the lines are. The useful work is reading them against what Copilot does.

The Record Test Comes First

FDA’s data integrity guidance gives the simplest test. In answer to the question of when electronic data becomes a CGMP record, it says: “When generated to satisfy a CGMP requirement, all data become a CGMP record.”⁷ Part 11 defines its own scope the same way: it applies to electronic records that are created, modified, maintained, archived, retrieved, or transmitted under records requirements in FDA regulations, along with records submitted to the agency.⁸

That gives you the first question for any Copilot use. Is the output, or the thing Copilot touches, a record that a GxP rule requires you to create or keep? A draft email to a vendor about a meeting date is not. A batch record entry, a laboratory result, a deviation conclusion, a signed training record, or a safety case narrative is. Most of the three-zone map in the next section follows from this one question.

Shared Systems Need an Assessment

Microsoft 365 is used for both GxP and non-GxP work in nearly every life sciences company. FDA addresses this directly in the same guidance: “When the same system is used to perform both CGMP and non-CGMP functions, the potential for non-CGMP functions to affect CGMP operations should be assessed and mitigated appropriately.”⁷

That sentence is, in effect, a call for a written Copilot risk assessment. If your SharePoint tenant holds GxP documents, records, or working files, then a feature that reads, summarizes, and in some cases edits that content is a non-CGMP function that can affect CGMP operations. Assess it, and write down the mitigations.

Annex 11: Validation, Risk, and Change Control

EU GMP Annex 11, in its 2011 revision, opens with a principle that applies cleanly here: “Where a computerised system replaces a manual operation, there should be no resultant decrease in product quality, process control or quality assurance.”⁹ It also requires that risk management be applied across the system lifecycle, with the extent of validation and data integrity controls based on a justified and documented risk assessment, and that changes to a computerized system, including its configuration, be made in a controlled way under a defined procedure.⁹

One practical consequence is easy to miss. If your company has qualified SharePoint or another part of Microsoft 365 as a GxP repository, enabling Copilot, agents, or Cowork for the users of that repository is a configuration change to a qualified environment. It belongs in change control with an impact assessment, not only in an IT release note.

Draft Annex 22 and Large Language Models

The draft EU GMP Annex 22 on artificial intelligence, put out for consultation in 2025, addresses large language models directly. EMA’s report on a June 2026 expert workshop restates the draft’s position: the draft does not apply to generative AI and large language models, models with probabilistic output, or models that adapt during use, and says such models should not be used in critical GMP applications.¹⁰

Two status points matter. First, this is still a draft, with no final text and no implementation date as of this writing. The same report describes the drafting group’s next step as using the workshop outcomes to inform the ongoing revision of Annex 22.¹⁰ Second, the position on generative AI is being reconsidered. According to the report, consultation comments supported allowing generative AI and large language models in GMP applications, and the drafting group has discussed widening the scope to allow them, provided they meet the annex’s requirements and are backed by a fully documented, risk-based control strategy. The report concludes that, subject to appropriate controls, there may be viable pathways for these technologies in GMP-regulated applications.¹⁰

For Copilot governance, the practical reading is the same either way. If the final text opens a path for generative AI in GMP applications, that path runs through a documented intended use, a risk-based control strategy, validation, and human oversight. General Copilot chat, used as delivered, comes with none of those for your specific use. So the sound planning assumption is to keep general-purpose generative AI out of critical GMP decisions, and to require a qualified human to own every output that enters a GMP process.

FDA’s AI Guidance Points the Same Way

FDA’s January 2025 draft guidance on AI to support regulatory decision-making is also still a draft. Its scope is narrower than many readers assume. It says it does not address AI used for “operational efficiencies (e.g., internal workflows, resource allocation, drafting/writing a regulatory submission)” that do not affect patient safety, drug quality, or the reliability of study results.¹¹ That is not permission to use Copilot carelessly for submission writing. It does mean the agency’s AI credibility framework is aimed at AI that produces data or information supporting a regulatory decision, which is roughly the third zone of our map, not the first.

Microsoft’s Own Position on GxP

Microsoft’s GxP compliance page is direct: “There’s no GxP certification for cloud service providers.”¹² It explains that Microsoft’s cloud services undergo independent audits such as ISO 9001 and ISO/IEC 27001, that Microsoft commissioned qualification guidelines for Office 365 that describe a shared responsibility, and that customers should determine the GxP requirements for their systems based on intended use and follow their own qualification and validation procedures.¹² In other words, the validation decision for any GxP use of Copilot belongs to you.

The UK MHRA’s data integrity guidance adds a point that applies to any cloud AI service. Where cloud or virtual services are used, it says companies should understand the service provided, data ownership, retrieval, retention, and security, consider where the data is physically held and the laws that apply there, and define responsibilities in a technical agreement or contract.¹³ The model provider and data-boundary settings described above are exactly the kind of facts that guidance expects you to know.

A Three-Zone Map of Copilot Uses

Most Copilot policies fail in one of two ways. Either they ban everything near GxP work, which pushes people toward unapproved tools, or they approve Copilot in general terms and leave each user to judge what “appropriate” means. A zone map avoids both. It tells people plainly what they can do today, what they can do inside an existing control, and what they cannot do.

Three Questions That Decide the Zone

Ask these in order. The first “yes” decides the zone.

1. Does Copilot act inside a GxP repository, or create or change a GxP record? This includes writing into a batch record, LIMS, eTMF, safety database, or eQMS, and also includes an agent or Cowork task that edits, moves, renames, or deletes files in a GxP library. If yes, the use is in Zone 3.
2. Will someone make a GxP decision based on the output without checking it against the source? If a disposition, an impact assessment, a root cause, a causality assessment, or a reported result rests on what Copilot said, the use is in Zone 3.
3. Will the output enter a GxP process at all? If yes, but only after a qualified person reviews and owns it inside an existing control (document control, change control, deviation review, training approval), the use is in Zone 2. If no, it is in Zone 1.

Zone 1: Open Use

Zone 1 covers most of what people want Copilot for: drafting and replying to routine email, summarizing a long thread, preparing for a budget meeting, outlining a slide deck, turning rough notes into a clear paragraph, or recapping a non-GxP meeting such as an IT planning session or a commercial forecast review. None of this creates or changes a GxP record, and nobody makes a GxP decision based on it.

Zone 1 still has rules. Microsoft’s own documentation says that generative AI responses “aren’t guaranteed to be 100% factual” and that users should review output before sending it to others.³ Confidentiality rules still apply, and so do any limits on personal data, especially in Copilot Chat (Basic), where the main risk is what users paste or upload.

Zone 2: Controlled Use

Zone 2 is where quality, regulatory, and clinical teams get most of the value, and where most of the design work goes. The principle is that Copilot can help produce a draft, but the draft only becomes part of a GxP process through a control you already run and already trust.

Take SOP drafting. An author uses Copilot in Word to restructure an SOP, tighten the wording, or draft a new section from a change request. The draft then goes through document control: technical review, QA review, approval, training, and effective date. Copilot never touches the effective document. The approvers sign for the content they reviewed, and their signature means what it always meant. The control that catches errors is the review you already require.

Deviation notes work the same way, with one more condition. An investigator can ask Copilot to summarize interview notes, organize a timeline from emails, or list open questions. Those are working aids. The investigator still decides the problem statement, the scope, the root cause, the product impact, and the CAPA, and records those decisions in the quality system. Copilot’s summary is not evidence and should not be pasted in as if it were. (We cover the investigator’s accountability in more depth in our piece on AI drafting in deviation investigations, linked at the end of this article.)

Other common Zone 2 uses include first drafts of training materials that a subject matter expert then checks against the effective procedure, draft minutes of a quality review meeting that the meeting owner corrects and approves, and help writing Excel formulas for a spreadsheet that will then go through your spreadsheet validation process.

What makes a use Zone 2 rather than Zone 3 is not the topic. It is the presence of a named control between the Copilot output and the record, owned by a qualified person who checks the output against source information. If you cannot name the control, the use is not Zone 2.

Zone 3: Off-Limits Without Validation

Zone 3 is anything where Copilot creates or changes a GxP record, or where a GxP decision rests on Copilot output without independent checking. Examples:

• Entering, correcting, or transcribing data into a batch record, LIMS, eTMF, safety database, or eQMS.
• Writing the conclusion, root cause, or product impact into a deviation, CAPA, or change record.
• Using a Copilot analysis in Excel as the reported result for stability trending, out-of-specification calculations, or release testing.
• Coding adverse events, assessing causality, or drafting case narratives that go to a regulator without full medical review against source documents.
• Letting an agent or a Cowork task edit, rename, move, or delete documents in a GxP library, or send GxP communications on someone’s behalf.
• Treating a Copilot meeting recap as the approved record of a GxP decision, such as a batch disposition or a deviation classification, without review and approval by the decision owner.

“Off-limits without validation” does not mean “forbidden forever.” It means general-purpose Copilot, used as delivered, is not the right tool for these jobs, and that a purpose-built solution would need its own intended use, risk assessment, validation, and change control. Microsoft’s documentation explains why the general product is a poor fit: the AI models behind Copilot are regularly updated, and the default Auto mode chooses a model per prompt.²³ A validated state assumes you know and control what is running. In general Copilot chat, you do not.

Copilot Studio, where Microsoft says agent creators must select the model when they build an agent, gives you more control over that variable.⁴ Choosing a model does not make an agent validated, but a narrow agent with a fixed model, defined data sources, and a defined task is a far more realistic candidate for validation than open-ended chat. That work follows the same risk-based computerized system validation approach you already use, applied to the agent’s intended use.

The Map in One Table

Permission Hygiene: Copilot Sees What the User Can See

The zone map controls what people do with output. Permission hygiene controls what Copilot can find in the first place. This is the single most common gap we see in Copilot rollouts, and it is not a Copilot defect. It is an old SharePoint problem that Copilot makes visible.

Why Oversharing Becomes Visible

Microsoft’s privacy documentation states: “Microsoft Copilot only surfaces organizational data to which individual users have at least view permissions.”³ The same page notes that this includes permissions given to people outside your organization through features such as shared channels in Teams.³

That sounds reassuring, and in one sense it is: Copilot does not bypass access controls. The problem is that many tenants have far broader access than anyone intended. A site shared with “Everyone except external users” years ago, a folder shared through a “People in the organization” link, a project site where nobody removed former team members. Before Copilot, a user would have had to know the file existed and go looking for it. With Copilot, a plain question can return a summary of content the user never knew they could open. For a GxP company, the content at risk includes unblinded study information, investigation files, audit reports, supplier quality data, and HR records of GxP staff.

Find the Overshared Sites

Microsoft’s deployment guidance for Copilot is organized around three pillars: remediate oversharing, set up guardrails, and meet regulations. It also notes that SharePoint Advanced Management is included with a Microsoft Copilot license.¹⁴ Within SharePoint Advanced Management, the data access governance reports are the starting point. Microsoft describes snapshot reports of site permissions across the organization, including sites with thousands of users, external guests, or “Everyone except external users” access, plus activity reports covering the last 28 days of sharing links and content shared with all internal users.¹⁵

For a GxP company, run these reports with a GxP lens. Start with sites that hold GxP content: quality, regulatory, clinical operations, pharmacovigilance, manufacturing, and laboratory sites, plus any site used as a GxP repository. For each, confirm that membership matches a defined role list and that broad groups and organization-wide links are gone. Record the review. It is evidence of the risk assessment FDA and Annex 11 expect.

Use Temporary Restrictions, Then Fix the Permissions

Restricted Content Discovery is now Microsoft’s interim control. It is a site-level setting that keeps content from a site out of organization-wide search and Copilot responses, and it removes Copilot entry points from those sites, while the site’s permissions are reviewed.¹⁶ Microsoft is clear about its limits: it does not change permissions, users can still open content they already have access to, it does not apply to OneDrive, and it is intended as a temporary governance control.¹⁶

Microsoft’s page on the retiring Restricted SharePoint Search makes the same point more bluntly, saying that it “isn’t a security boundary and doesn’t change any permissions on SharePoint sites.”⁵ Treat both features as temporary restrictions, not fixes. The fix is correct permissions on the sites. Restricted Content Discovery gives you time to do that work on the most sensitive sites without holding up the whole rollout.

OneDrive and Personal Copies

Restricted Content Discovery does not cover OneDrive.¹⁶ In many companies, local copies of SOPs, exported data, and draft reports live in personal OneDrive folders and are shared by link. Copilot will find shared OneDrive content for anyone who has access. Include OneDrive sharing in the review, and remind people through the usage policy that a personal copy of a controlled document is not the controlled document.

Sensitivity Labels and DLP: The Second Layer of Control

Permissions decide who can open a file. Sensitivity labels and data loss prevention (DLP) decide what Copilot may do with what it finds. They are the second layer of control, and they matter most for content that many people legitimately need to open but that Copilot should not process freely.

How Copilot Respects Labels

Microsoft’s Purview documentation describes several protections when content carries a sensitivity label. When a label applies encryption, the user needs both the VIEW and EXTRACT usage rights for Copilot to return the data. Copilot Chat shows the sensitivity labels of items it cites and displays the highest-priority label from the data used in a response. And when a user creates new content in Word, PowerPoint, or Outlook with Copilot from a labeled source, the new content inherits the source’s label and its protection settings.¹⁷

The same page notes two limits. A user can override or replace an inherited label (or remove it, unless mandatory labeling is in place), and password-protected documents cannot be read by AI apps unless the user already has them open, and their passwords are not carried to new content.¹⁷ Labels are only as good as the labeling policy behind them.

Default Labels for GxP Libraries

Relying on users to label each file is the weak point. A better pattern for GxP content is a default sensitivity label on the document library. Microsoft describes this as location-based labeling: when SharePoint is enabled for sensitivity labels, new or edited files in the library receive the default label if they have no label or a lower-priority one, though a label a user applied by hand is not overridden.¹⁸ Set a default label on the libraries where GxP working files, investigation material, and unblinded data live, and the protection follows the location rather than each person’s judgment.

DLP Rules Written for Copilot

Purview DLP now has a policy location for Microsoft 365 Copilot and Copilot Chat. Microsoft’s documentation describes four controls: blocking Copilot from using external web search when a prompt contains sensitive information types, blocking Copilot from processing prompts that contain sensitive information types, blocking Copilot from using files and emails with specific sensitivity labels to build responses, and, in preview, blocking Copilot from using email from external domains as grounding data.¹⁹

For a GxP company, the label-based rule is the most useful. Create a label such as “Restricted: No AI Processing” for the content you never want Copilot to summarize (for example, unblinded randomization data, active inspection correspondence, or legal hold material) and add a DLP rule that keeps Copilot from processing items with that label. The external-email rule is also worth a look: it reduces the chance that a crafted message from outside the company shapes Copilot’s answers.

Web Search Is a Separate Data Flow

Web grounding deserves its own decision. Microsoft explains that when web search is on, Copilot generates a short search query from the prompt and sends it to Bing, with user and tenant identifiers removed. Bing operates outside Microsoft 365, under the Microsoft Services Agreement and Privacy Statement, with Microsoft acting as an independent data controller rather than as your processor.²⁰²¹ Microsoft’s enterprise data protection page also notes that HIPAA coverage and the EU Data Boundary do not apply to web search queries.²⁰

Microsoft says the query sent to Bing is a few words rather than the whole prompt, and does not include entire files. It also says the query can be informed by an open document or one the user references.²¹ So a prompt like “summarize the open questions in this deviation and check against current guidance” could send terms drawn from the deviation to an outside search service. Decide whether web search should be on for users who handle GxP content, and use the DLP web search rule for prompts that contain sensitive information types. Web search queries are logged and searchable with audit and eDiscovery tools, which helps if you ever need to show what was sent.²¹

Retention, Audit, and the Copilot Interaction Record

Every Copilot conversation produces data: the prompt, the response, and references to the files used. Two questions follow. How long do you keep it, and is it ever a GxP record?

Where Prompts and Responses Are Stored

Microsoft’s privacy documentation says Copilot stores the user’s prompt and response, including citations, as the user’s Copilot activity history, processed and stored under the same contractual commitments as other Microsoft 365 content, and not used to train foundation models.³ Microsoft’s retention documentation adds the mechanics: data from Copilot messages is stored in a hidden folder in the user’s Exchange mailbox, not designed for users or admins to open directly, but searchable by compliance administrators with eDiscovery tools.⁶

Users Can Delete Their History

Microsoft’s privacy page states that users can delete their Copilot activity history, including prompts and responses, from the My Account portal.³ Without a retention policy, that deletion is the end of the data. With a retention policy, Microsoft’s retention page explains that deleted messages move to a hidden SubstrateHolds folder and are kept until the retention period ends, remaining searchable by eDiscovery.⁶ The same page offers a warning that every quality leader should read: “Messages visible in your AI apps are not an accurate reflection of whether they are retained or permanently deleted for compliance requirements.”⁶

Microsoft also notes that Copilot retention policies are now a separate location from Teams chats. Newly created policies cover locations under “Microsoft Copilot experiences,” including Microsoft 365 Copilot and Copilot Studio.⁶ If your existing retention plan covered Copilot only through the Teams chat location, check that it still does.

Should Copilot Interactions Be Kept as GxP Records?

Apply the record test. In Zones 1 and 2, the Copilot conversation is not a GxP record. In Zone 2, the GxP record is the approved SOP, the investigation report, or the approved minutes, which live in their own controlled systems with their own retention. The chat that helped produce a draft is a working note. Retain Copilot interactions under your general business retention schedule and legal hold process, and do not ask the chat history to serve as a GxP record, which it was never designed to be.

There is a practical reason for that position. Copilot retention keeps prompts and responses in a hidden mailbox folder for eDiscovery. It is not organized by product, batch, or study, does not link to the record it informed, and when a user leaves it moves with their mailbox into an inactive mailbox that is reached through eDiscovery.⁶ If a procedure requires you to document that AI helped with a GxP document, record that fact in the GxP record itself (for example, a field in the document change request), not by pointing an inspector at a chat log. Our article on AI output retention under GxP, linked below, covers what to keep when an AI output does become part of a regulated record.

What the Audit Log Tells You

Microsoft’s audit documentation says Copilot interactions are logged automatically under Audit (Standard) when auditing is on. The audit records show which user interacted with Copilot, when, and where, and include references to the files, sites, and other resources Copilot accessed to answer. Records for Copilot and Copilot Chat can also include the model provider and model name, though Microsoft notes this may not be available for every request when the user is in Auto mode.²² Microsoft’s Purview overview adds that these events feed the activity explorer in Data Security Posture Management for AI, where prompt and response data can be displayed.¹⁷

The audit log is useful for two GxP purposes. First, it shows whether Copilot touched content in GxP sites, which tells you whether your zone rules are being followed in practice. Second, it gives evidence for an investigation if someone reports that Copilot surfaced content it should not have. The audit page also points admins to audit retention policies, so set one that matches how long you need the evidence.²² Note that the audit log is a security and compliance log for Microsoft 365. It is not a GxP audit trail in the 21 CFR Part 11 sense, which must record changes to GxP records in the system that holds them.⁸

Teams Meetings Need Their Own Rules

Meeting recaps are the Copilot feature people ask for first, and they carry the most context to manage. Microsoft’s support page for Teams describes three organizer settings. “During and after the meeting” requires transcription. “Only during the meeting” uses temporary speech-to-text data, and interactions with Copilot are not available after the meeting ends. “Off” disables Copilot, and it also disables recording and transcription for that meeting.²³ Microsoft’s admin documentation adds that, depending on Purview retention policies, Copilot prompts and responses during meetings might be retained even if recording and transcription are off, and that admins can set the default to Off while organizers manage it per meeting.²⁴

A sensible GxP default: allow Copilot in non-GxP meetings, and for meetings where GxP decisions are made (deviation review boards, change control boards, batch disposition meetings, safety review committees), let the meeting owner choose, with the approved minutes as the only record. If a recap is used to draft the minutes, the owner corrects and approves them. The transcript and recap are working material, not the record of the decision.

Copilot Pages and Notebooks

Copilot Pages and Copilot Notebooks let users save and share Copilot output as editable content. Microsoft’s compliance summary shows that retention policies apply through the “All SharePoint Sites” location, eDiscovery and legal hold are supported, sensitivity labels apply to Pages only, and information barriers are not supported.²⁵ If you use information barriers, for example between blinded and unblinded study teams, that gap is a reason to restrict Pages and Notebooks for the affected groups until it closes.

Writing the Copilot Usage Policy

A usage policy is where the zone map, the technical controls, and people’s daily work meet. It should be short enough that people read it and specific enough that they can follow it without asking. In our experience, two to four pages plus a one-page quick reference works better than a long procedure.

What the Policy Must Answer

Each person who uses Copilot should be able to answer these from the policy alone:

• Which Copilot features am I allowed to use? Name them by function (chat, in-app drafting, meeting recap, agents, task features) rather than by product name alone.
• What can I use it for? The three zones, with examples drawn from your own departments.
• What must I never put in a prompt or upload? For example, patient identifiers beyond what your privacy rules permit, unblinded data outside the unblinded team, credentials, or content labeled for no AI processing.
• Who is responsible for the output? The person who uses it, always.
• When do I have to record that I used Copilot? Only where a GxP procedure asks for it, and in the GxP record itself.
• What do I do if Copilot shows me something I should not see? Stop, do not share it, and report it to a named contact so the permission can be fixed.
• Can I build or use an agent? Only agents approved through a defined route, and never one that acts in a GxP repository without validation.

Sample Clauses

Who Owns the Policy

Copilot governance fails when it belongs only to IT or only to quality. IT owns the tenant settings, permissions, labels, DLP, retention, and audit. Quality owns the zone definitions, the GxP risk assessment, and the decision on any Zone 3 use. Legal and privacy own the data rules for prompts and for meeting recording consent. Name one accountable owner for the policy as a whole, and a working group of those three functions that meets on a set schedule. If you keep an AI use case register, Copilot uses belong in it as approved patterns, so each department does not have to file a separate request for the same Zone 2 use.

Training That Changes Behavior

Training should be short and concrete. Show people real examples of each zone from their own work. Show them what an inherited label looks like in Word, what a cited source looks like in Copilot Chat, and how to open the controlled version of a procedure Copilot mentions. Teach them to check citations, since a summary can be fluent and still wrong. FDA’s CGMP regulations require each person in drug manufacturing to have the education, training, and experience to perform their assigned functions, with training in the particular operations they perform and in CGMP as it relates to their work.²⁶ Where Copilot becomes part of how people draft GxP content, the usage policy is part of that training. A short attestation that the user has read the policy, followed by a few scenario questions, is a reasonable way to document it.

Review Triggers

Copilot changes faster than most GxP procedures. Set a fixed review date for the policy (every six months is reasonable while the product is changing this quickly), and add event-driven triggers: a new Copilot feature that acts rather than drafts, a change in model provider settings, a change in Microsoft’s data-handling terms, a new regulatory text such as a final Annex 22, or an incident where Copilot surfaced content it should not have. Microsoft’s privacy page notes that model updates do not change your security, privacy, or compliance settings.³ They can still change the quality of outputs, which is one more reason Zone 2 uses depend on human review rather than on the model’s past behavior.

A Rollout Sequence Quality and IT Can Share

The sequence below assumes some form of Copilot is already in use, which is true for most companies, and that you want to bring it under control and then extend it. Each step produces a record you can show an auditor.

Common Mistakes to Avoid

• Treating a temporary restriction as the control. Restricted Content Discovery and the retiring Restricted SharePoint Search do not change permissions. Fix the permissions.
• Writing a policy around one product name. The names have changed several times. Write around functions and data reach.
• Assuming the chat is retained because it is still visible. Microsoft says visibility in the app is not a reliable sign of retention. Set a policy and check it with eDiscovery.
• Approving agents through the same route as chat. An agent that acts is a different risk from a chat that drafts. Give agents their own approval route.
• Skipping change control for qualified repositories. If SharePoint is a qualified GxP repository, enabling Copilot for its users is a change to that environment.

Conclusion

Copilot in a GxP company is less about the AI and more about the boundaries you already have. Your record rules tell you which outputs matter. Your document control, deviation, and change control processes are the controls that make Zone 2 safe. Your SharePoint permissions decide what Copilot can find, and your labels, DLP, retention, and audit settings decide what it can do with what it finds. The work is mostly applying existing GxP thinking to a tool that many companies already use, and writing the result down in a way people can follow.

Sakara Digital works with pharma and biotech organizations that want to put AI tools like Copilot to work without putting their GxP records at risk. If you are deciding how to govern Copilot across quality, regulatory, and clinical teams and want an independent perspective on where to start, we are happy to have that conversation.

For Further Reading