EU AI Act & GDPR
Copilot and the AI Act, without the legal jargon
The EU AI Act also applies to organisations that use Microsoft Copilot and agents. AI literacy is already mandatory, and since 2 August 2026 the transparency rules for chatbots and agents apply. We translate the rules into your Copilot configuration; this is not a substitute for legal advice.
Timeline
The timeline that matters
The digital omnibus — Regulation (EU) 2026/1744, in force since 27 July 2026 — moved some of the deadlines, but far from all. These are the dates that matter for Copilot users.
- 1
Feb 2025
AI literacy (Article 4) and the prohibited AI practices start to apply.
- 2
Aug 2025
Rules for providers of general-purpose AI models (GPAI), such as the models behind Copilot.
- 3
Aug 2026
Transparency obligation (Article 50) for chatbots, agents and generated content. The AI Office can now also enforce against model providers.
- 4
Dec 2027 & Aug 2028
High-risk rules: first for uses such as HR and recruitment (2 December 2027), then for AI in regulated products such as medical devices (2 August 2028).
Your obligations
What applies to you as a Copilot user
Most organisations are deployers: they use AI that someone else built. These are the five topics that matter then.
AI literacy
You make sure employees know enough about AI to work with it responsibly. Since 27 July 2026 this is a best-efforts obligation: demonstrable measures such as training and policy, not a guaranteed level per person.
Transparency for agents
If a chatbot or agent talks to people, it states at the start of the conversation that it is AI — audibly for a voice agent. This has applied since 2 August 2026.
Labelling generated content
You always label deepfakes. The same goes for AI text published on matters of public interest, unless it has undergone genuine editorial control.
Deployer or provider?
A deployer uses an AI system under its own authority; a provider develops it or places it on the market. If you release an agent under your own name or substantially modify an AI system, you can become a provider — with heavier obligations.
High-risk use cases
If you use Copilot or agents for HR and recruitment, the high-risk rules apply from 2 December 2027. According to draft guidance, you assess a chain of collaborating agents as a whole, not part by part.
Shared responsibility
Microsoft covers a lot, but not everything
Since 2 August 2026, Microsoft and other model providers have been supervised by the AI Office, the European supervisory body that can question and fine them. That covers the models under Copilot, but not how your organisation uses them.
Your obligations as a user stay with you: a usage policy, demonstrable training, the opening notice in your own agents and a register of what you use. Technical measures sometimes need a deliberate choice too. Microsoft 365 has an admin setting to watermark AI-generated audio and video, but an admin has to turn it on.
2 Aug 2026
Since then, chatbots and agents must disclose that you are talking to AI.
GDPR
The GDPR side: DPA advice and DPIA
Alongside the AI Act, the GDPR still applies — and for Copilot that is currently the most concrete risk. Three documents shape the conversation in the Netherlands.
20 July 2026
Dutch DPA advice on Haarlemmermeer
In its first advice on Microsoft 365 Copilot, the Dutch Data Protection Authority (AP) concluded that the processing as described by the municipality would breach the GDPR. The AP identified four high risks, including inaccurate generated personal data and too little transparency from Microsoft about data and retention periods. It asks for concrete use cases, Copilot only on labelled and classified data, meaningful human oversight and clarification from Microsoft.
May 2026
DPIA by SLM Rijk and SURF
A DPIA (data protection impact assessment) maps the privacy risks of a processing activity. The update by Strategic Vendor Management for the Dutch central government (SLM Rijk) and SURF leaves two medium risks: the Workplace Harms filter and the retention of pseudonymised diagnostic data. The advice: deploy cautiously, per use case.
July 2026
Dutch DPA guidance and tool
The AP published guidance on generative AI and the GDPR, with an assessment tool built around three questions: do we want it, can we do it, and are we allowed to. A practical starting point for any Copilot DPIA.
Use the AP advice and the SLM Rijk/SURF DPIA side by side, with the AP guidance as your checklist; the AP advice is the strictest and most recent. How to handle labels, DLP and oversharing technically is covered under data security & Purview. Working with confidential client files? Then see Copilot for professional services.
Our conviction
Postponed is not exempt.
Our approach
How we make it demonstrable
Complying with the rules is one thing, being able to show it is another. This is what we put on record with you.
AI register
One overview of all AI systems and agents, with owner and risk profile. We manage it through the AI Council and Microsoft Agent 365.
AI usage policy
Clear ground rules: which tools, which data and which tasks are in and out. Short enough to actually be read.
Documented training programme
Training per role, recorded per employee and date — that is how you demonstrate your AI literacy efforts. Open training runs through Copilotcursus.nl.
Opening notice and labelling
Every agent we deliver states at the start of the conversation that it is AI, and labels generated content where required.
DPIA with model choice
We record which models you allow and which exceptions to the EU Data Boundary apply, such as Anthropic models. They are off by default in the EU; turning them on is a deliberate choice.
Human oversight
For decisions about people, such as in HR, a human always decides. We design that oversight into the process, not as a box ticked afterwards.
We place the register and the policy with your AI Council; we link the training to our adoption approach. Open training is available at Copilotcursus.nl.
FAQ
Frequently asked questions
On the EU AI Act, the GDPR and Microsoft Copilot.
Does the AI Act apply if we only use Microsoft Copilot?
Yes. As a user you are a “deployer”: you need to work on AI literacy and, for agents that talk to people, on transparency. For ordinary office tasks with Copilot the obligations are limited; if you use agents for decisions about people, it gets heavier.
Has the AI Act been postponed?
Only partly. The omnibus of July 2026 moves the high-risk rules to December 2027 and August 2028. AI literacy, the transparency obligation and the rules for model providers still apply.
What must a Copilot Studio agent on our website disclose?
That the visitor is talking to AI, at the start of the conversation and clearly — not hidden in the terms, and audibly for a voice agent. This has applied since 2 August 2026. We build that notice into every agent we deliver as standard.
Is AI literacy still mandatory after the omnibus?
Yes. Since July 2026 it is a best-efforts obligation: you take demonstrable measures such as training and policy, but you do not have to guarantee a level per employee. Record what you do, for whom and when.
Do we become a provider if we build our own agent?
Possibly. If your organisation releases an agent under its own name, or substantially modifies an AI system or uses it for a different purpose, you can become a provider, with heavier obligations. An internal agent on Copilot Studio usually makes you a deployer. Have this checked legally per agent.
Who supervises the AI Act in the Netherlands?
The Dutch Data Protection Authority (AP) and the Dutch Authority for Digital Infrastructure (RDI) coordinate supervision. The national law that enables fines was still being prepared in the summer of 2026. The AP can already act through the GDPR, and for Copilot that is currently the most concrete risk.
What did the Dutch DPA say about Copilot at the municipality of Haarlemmermeer?
In July 2026 the AP concluded that the processing as described by the municipality would breach the GDPR, and identified four high risks. The AP asks for concrete use cases, Copilot only on labelled and classified data, meaningful human oversight and clarification from Microsoft. It did view a small-scale pilot positively.
Want to know where you stand?
In an AI Act check we hold your Copilot and agent use up against the rules, and you get a concrete action list.