Microsoft’s Copilot: New Modes, New Compliance Headaches

Microsoft is trying to turn Copilot from a chat box into a co-worker that can actually move your day forward inside Word, Outlook, Teams, and your calendar. Its new Cowork feature can draft emails, schedule meetings, create documents, and post in Teams, but Microsoft says each action still needs your approval before it happens. (microsoft.com) That approval step is the giveaway that this is still an assistant, not an autopilot. Microsoft’s own Cowork documentation says the feature is in the Frontier early-access program and is available before official release under preview terms. (learn.microsoft.com) Microsoft is also adding a deeper research layer for office work. In March 2025 it introduced Researcher and Analyst as reasoning agents for Microsoft 365 Copilot that can search across emails, meetings, files, chats, and the web to produce reports and analysis. (microsoft.com) Researcher has now been upgraded with two new modes called Critique and Council. Microsoft says Critique checks a draft like an editor looking for weak spots, while Council uses multiple models with different roles to compare answers before giving you one result. (techcommunity.microsoft.com) The pitch is simple: keep the work where people already live instead of making them jump to a separate artificial intelligence tool. Cowork is built to ground tasks in Microsoft 365 data like emails, meetings, messages, files, and business data, then carry out steps across those same apps. (microsoft.com) Microsoft is not rolling all of this out as normal, finished software. The company’s Frontier program gives Microsoft 365 Copilot customers phased access to new features before general availability, and Microsoft said Researcher and Analyst first entered that program in May 2025 under enterprise preview terms. (techcommunity.microsoft.com) That matters because preview software is awkward for big companies that need predictable controls, support terms, and audit trails before buying at scale. Even after Researcher and Analyst became generally available in June 2025, Microsoft capped usage at 25 combined queries per user per month, which shows the company is still managing capacity and risk tightly. (microsoft.com) The bigger headache is not the new features but where the data may travel when those features run. Microsoft now says that for customers in the European Union and the European Free Trade Association, a setting called flex routing can let large language model processing happen outside the European Union data boundary during peak demand. (learn.microsoft.com) Microsoft says customer data at rest stays inside the European Union data boundary, except for limited pseudonymized data kept outside for security and operations. But the company also says prompts, responses, and grounding data may be processed outside that boundary for artificial intelligence inferencing, including in the United States, Canada, and Australia. (learn.microsoft.com 1) (learn.microsoft.com 2) That creates a procurement problem for banks, governments, hospitals, and multinationals that wrote “European Union only” into internal rules or supplier contracts. A tool can still be secure and encrypted, but if the prompt handling crosses borders during busy periods, legal and compliance teams have to re-check whether the deployment fits their policies. (learn.microsoft.com) (cybernews.com) So Microsoft’s Copilot story now has two tracks running at once. On one track, it is making Copilot more useful by turning it into a supervised worker inside Microsoft 365; on the other, it is asking regulated customers to accept more complexity about where artificial intelligence processing happens when demand spikes. (microsoft.com) (learn.microsoft.com)