Microsoft 365 Copilot

Regional Environment Agency Middle Holland

Supports staff in drafting texts, analysing information and carrying out tasks within Microsoft 365.

Last change on 3rd of August 2026, at 12:28 (CET) | Publication Standard 1.0

• Publication category: Other algorithms
• Impact assessment: Field not filled in.
• Status: In use

General information

Theme

Field not filled in.

Begin date

Field not filled in.

Contact information

[e-mail]

Responsible use

Goal and impact

The Midden-Holland Environmental Agency (ODMH) uses Microsoft 365 Copilot, amongst other things, to simplify complex texts, such as standard letters, policy documents and website content.

Copilot operates solely on the basis of user input and has no access to internal data or systems within ODMH’s Microsoft 365 environment. No automated decisions are made, and the application is not used for processes that have a direct impact on residents, businesses or policy-making.

Considerations

The Midden-Holland Environmental Agency has opted to deploy Microsoft 365 Copilot as a generative AI application because it integrates seamlessly with the organisation’s existing Microsoft 365 environment. This allows the agency to utilise the technical and security infrastructure that is already in place. Furthermore, the conversations that staff have with Copilot remain within their own tenant, and the data is not used to train the underlying AI model.

Copilot is being deployed because of the value the application offers for cognitive tasks. It supports staff in organising and analysing information, retrieving relevant knowledge, exploring ideas and drafting or editing texts. This enables substantive tasks to be carried out more efficiently and consistently.

Human intervention

Microsoft 365 Copilot acts solely as an advisory tool and supports staff in carrying out their work. The employee remains ultimately responsible for the content, interpretation and application of the output generated by Copilot. This ensures that Copilot does not make independent decisions and that human oversight is maintained in all cases.

Risk management

As Microsoft 365 Copilot is integrated within the existing Microsoft 365 platform, the system operates within the ODMH’s secure tenant. This means that conversations and generated output are not used to train the underlying language model, and the data remains within the organisation’s own Microsoft environment. Despite these advantages, responsible use remains important, as Copilot generates text based on pattern recognition rather than on substantive knowledge or legal frameworks.

Responsible use of Copilot therefore requires a comprehensive approach that takes technical, organisational, legal and ethical aspects into account. By implementing the measures described below, the ODMH can effectively manage the risks and deploy Copilot in a safe, valuable and reliable manner to support staff.

Summary of key risks and measures (from our public policy document “Policy on the Use of AI within the ODMH”):

- The ODMH instructs staff not to enter personal data or confidential information into Copilot or other open AI applications.

- To counter bias and ensure transparency, the AI policy is reviewed periodically. Furthermore, the staff member always bears ultimate responsibility, and any decision must be justifiable.

- Staff receive regular further training in their specialist fields. The ODMH encourages the use of AI as a tool and ensures that staff do not become entirely dependent on AI. Staff are enabled to keep abreast of the latest developments in their field through coordination meetings and the exchange of knowledge, both internally and externally, as well as by following newsletters and specialist journals.

Legal basis

The use of Microsoft 365 Copilot within the Midden-Holland Environmental Agency takes place within the framework of the General Data Protection Regulation (GDPR). Copilot is used exclusively as a support tool and does not process any personal data in this application, as staff are not permitted to enter any confidential or privacy-sensitive information in accordance with internal guidelines. Consequently, there is no automated decision-making within the meaning of the GDPR (Article 22).

As Copilot operates solely on the basis of information that staff enter voluntarily and within the established parameters, and as personal data is not shared with or stored outside the Microsoft tenant, its use remains in compliance with these legal requirements.

Operations

Data

Microsoft 365 Copilot within the Midden-Holland Environmental Agency (ODMH) operates exclusively using the data available within the organisation’s Microsoft 365 environment.

Data processing takes place solely for the purpose of supporting staff in their work. Data is not stored or shared outside ODMH’s Microsoft 365 tenant, nor is it used to train the underlying AI models.

Staff remain responsible for handling confidential and privacy-sensitive information with care. In doing so, they follow the internal guidelines for the secure and responsible use of AI applications, including the principle that sensitive information is only entered where permitted within the agreed frameworks.

Technical design

Microsoft 365 Copilot uses OpenAI’s large language models (LLMs), which are offered as a service via Microsoft Azure. These models have been trained on vast amounts of text data and are therefore able to understand and generate natural language. Within the Microsoft 365 environment, Copilot can call upon these models to assist users in answering questions, writing text and structuring information. Processing takes place within Microsoft’s secure cloud infrastructure, in accordance with applicable privacy and security standards. Further information on the architecture and operation can be found at: Microsoft Copilot Architecture and Azure OpenAI Service.

External provider

Microsoft