Microsoft 365 Copilot (pilot phase)

The ICO is trialling the use of Microsoft 365 Copilot (Copilot) to enhance staff productivity and efficiency. Approximately 15% of our staff are using Copilot within various Microsoft productivity applications such as Teams, Word, Excel and PowerPoint.  

Copilot utilises large language models (LLMs), a type of artificial intelligence (AI) algorithm that uses deep learning techniques to understand, summarise, predict, and generate content.   

Our use of Copilot will cover several activities including:  

• Generating pre-read material in preparation for meetings.  
• Summarising lengthy documents, emails or when used during meetings to summarise the meeting so far. 
• Post-meeting to produce meeting notes or minutes, and to provide a summary of the meeting to staff who were not able to attend.  
• Text and other content generation. For example, to produce the first draft of an email, briefing paper or presentation.  
• The formatting of documents to ensure their content and style adhere to the ICO's style guide.  
• The analysis and presentation of data. 
• General notetaking and idea generation.  

The ICO’s data, used with Copilot, is stored within our secure Microsoft Azure tenant, which is held within the UK and is not used for training Microsoft models.   

Where the ICO uses customers’ personal data with Copilot, this is processed under the lawful basis of 'public task' to fulfil our legal and statutory duties under the legislation, eg to consider a complaint, provide you with guidance, or investigate a breach. In other circumstances, your personal data will be processed under the lawful basis of “legitimate interest” eg in recruitment. For more information, please refer to the relevant sections in our privacy notice.   

We may collect audio and visual recordings, as well as transcripts, of conversations. The transcription function in Teams allows Copilot to produce some of the outputs referred to above. Recordings and transcripts are automatically deleted after 21 days. Copilot prompts and responses are deleted after 7 days.  

No decision affecting a customer will be taken based on the Copilot output. All direct outputs from Copilot come with the statement "AI-generated content may be incorrect" and our training stipulates that human oversight is always required to verify outputs.  We will continue to monitor our use of Copilot to review the risks and benefits of this deployment. Any extension of our use will be considered under our risk assessment processes and this privacy notice will be updated accordingly.