Microsoft 365 Copilot

Municipality of Breda

Copilot supports writing, summarising, e-mailing and preparing for meetings. With Copilot, we work more efficiently and improve our services. Less time is spent on routine tasks, more space is created for content, cooperation and our communication becomes clearer and more consistent. We deploy Copilot responsibly and actively invest in employees' AI knowledge.

Last change on 10th of December 2025, at 15:59 (CET) | Publication Standard 1.0

• Publication category: Impactful algorithms
• Impact assessment: DPIA
• Status: In use

General information

Theme

Organisation and business operations

Begin date

11-2024

Contact information

https://www.breda.nl/contact

Responsible use

Goal and impact

The purpose of deploying Microsoft 365 Copilot is to support employees with standard tasks, such as writing texts, creating summaries, drafting e-mails and preparing for meetings. Copilot helps perform routine tasks faster so that employees have more time for substantive work and collaboration.

Using Copilot leads to higher efficiency and better quality of documents and communication. Residents and businesses notice this indirectly, for example because letters are clearer and response times are shorter. In addition, the application contributes to developing digital skills and increasing knowledge about generative AI within the organisation.

The municipality is also experimenting with AI agents to further speed up work processes. These agents support specific tasks, but are always used with explicit human intervention and assessment.

Considerations

The municipality chooses Microsoft 365 Copilot to support employees in day-to-day work. It saves time, improves the quality of documents and gives employees more room for content. It also contributes to job satisfaction and digital skills.

At the same time, there are risks. Copilot answers may contain errors and should always be checked. There is a focus on privacy and safe handling of data. Dependence on technology requires clear agreements and conscious use. Therefore, our employees are trained in responsible use of AI.

Alternatives such as ChatGPT or Claude have been considered but not found suitable. Copilot is integrated into frequently used programmes (the office apps such as Word, Excel, etc.). In addition, the governance capabilities and Enterprise Data Protection (EDP) offered by Microsoft are important reasons for this choice.

Human intervention

Microsoft 365 Copilot provides suggestions, but employees always remain fully responsible for the content they use. Every outcome of Copilot must be checked for accuracy by an employee. Copilot does not make decisions or perform tasks without human intervention. The use of Copilot is solely supportive and always requires a conscious review by the user. Employees are trained in the responsible deployment of generative AI so that they can properly assess and correct the output.

Risk management

There are technical, legal and ethical risks when using Microsoft 365 Copilot. Examples include incorrect or misleading output, incorrect data use and the risk of employees relying too much on automatically generated information. To mitigate these risks, employees are trained in responsible use of generative AI. They learn to critically assess output, handle information carefully and follow the applicable rules of the game.

During the pilot phase, extensive research was done on which applications could be used responsibly. Data use, privacy, security and possible impact on decision-making were examined. Riskier forms of deployment are tested in advance by the data protection team so that it is clear what measures are needed and what is or is not allowed.

Legal basis

The European AI Regulation forms the basis of municipal policy around the responsible development and deployment of AI and algorithms. It aims to ensure that AI systems are safe, work transparently and respect people's fundamental rights. The regulation distinguishes between different levels of risk of AI systems. The higher the risk, the stricter the rules. For generative AI such as Microsoft 365 Copilot, there are especially obligations around transparency and human oversight.

Besides the AI regulation, municipal policy rests on existing information security and privacy legislation, such as the General Data Protection Regulation (GDPR). In addition, internal ground rules have been drawn up for the use of Copilot. These laws ensure that personal data is properly protected and that employees handle data and Copilot with care.

Links to legal bases

AI-Act: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

Link to Processing Index

https://www.breda.nl/privacyverklaringen

Impact assessment

Data Protection Impact Assessment (DPIA): Data Protection Impact Assessment (DPIA): Link naar externe paginahttps://surf.nl/nieuws/privacyrisicos-microsoft-365-copilot-naar-oranje

Operations

Data

Microsoft 365 Copilot only uses data that an employee can access himself via the Microsoft Graph. This could be documents, e-mails, calendar items or chats, for example. So it does not work with all data within the organisation, but only up to the documentation the employee has rights to.

Employees are strongly advised against sharing personal data and business-sensitive information with generative AI. Information from subject applications should not be shared with Copilot. This helps to mitigate risks and handle confidential data carefully. Personal data may appear indirectly in documents or communications, but is not structurally stored or shared.

Copilot also processes prompts (user input). These prompts and responses are temporarily stored to support functionality, but not used for training AI models. This is a big difference from other AI tools, which do use your information to train their models.

The municipality ensures that employees handle data in Copilot consciously. The use of Copilot falls under the existing information security and privacy policy and has been supplemented with specific ground rules

The data used by Copilot remain within the municipal Microsoft environment.

Technical design

Microsoft 365 Copilot combines user input with context from Microsoft Graph, such as documents, e-mail and calendar items, for which the user is already authorised. The Copilot orchestrator enriches the command, checks access rights and forwards it to a large language model (LLM) within the Microsoft cloud. This model generates a draft response that returns to the relevant Microsoft 365 app. All processing takes place within the secure tenant and the output is not used for model training.

More information can be found on Microsoft's website, including in this resource:

https://learn.microsoft.com/nl-nl/copilot/microsoft-365/microsoft-365-copilot-overview

External provider

Microsoft