Your people are already using AI. Some of it you approved. Some of it showed up inside a browser or a search bar.

You want your team to spend less time drafting emails and summarizing documents. You also need to know where customer data goes when they do. Those two goals pull in different directions.

Banning AI doesn’t settle anything, and neither does pretending it isn’t already in use. The work is understanding what happens behind the prompt, then governing it like everything else you answer for.

Here’s what that looks like with Microsoft Copilot.

Start With One Tool, Not All of AI

A policy that tries to cover all of “AI” won’t hold up. It’s like writing one policy for “the internet.”

Start narrower. For most community banks, that means Copilot, because it lives inside the Microsoft 365 tools your staff already use.

Accept one thing up front: this moves fast. Microsoft switched Copilot users from commercial data protection to enterprise data protection practically overnight. What’s true today needs checking again next quarter.

Not Every Copilot Is the Same Copilot

The different versions of Copilot look similar on the surface, but they don’t protect data the same way underneath.

• Copilot in Bing, used without signing in, has no data protections.
• Microsoft Copilot, signed in with a work identity, has enterprise data protection. Prompts are logged, audited, and discoverable.
• Microsoft 365 Copilot adds access to a bank’s own email, files, and Teams.

Microsoft’s position is clear: making sure staff use the right version is the administrator’s job.

The check is simple: look for the shield icon. If it’s not there, the protections aren’t either.

Your Prompt Doesn’t Go Straight to the AI

When someone presses enter, the prompt goes to the Copilot orchestrator first. The orchestrator talks to the language model, applies logging and auditing, and screens for harmful content, copyrighted material, and prompt-injection attacks.

It also runs web grounding, which means it builds search queries from the prompt and sends them to Bing. Bing sits outside the Copilot boundary. A short, simple prompt may go to Bing word for word.

If a document carries a sensitivity label or data loss prevention rule, Copilot won’t build queries from its contents. If it doesn’t, Copilot will.

Bank Data Gets In Through Your People

It’s easy to assume the general version of Copilot can’t reach bank data, but it can, through the people using it. Staff can:

• Paste or type it into the prompt.
• Upload an internal document.
• Use Copilot in Edge on an intranet page or a PDF.

None of that is careless. It’s a lender trying to finish a credit memo before a customer meeting. That’s why policy and training matter more than any single setting.

What’s Protected

• Your data isn’t used to train Microsoft’s foundation models.
• Prompts are stored in the user’s mailbox, so your retention policies and eDiscovery apply.
• Microsoft’s access to your data is the same as it already is for Microsoft 365.
• Uploaded documents aren’t kept after the session ends.
• Microsoft 365 Copilot only sees what the user can already see. A teller can’t ask it for the CEO’s inbox.

That last point cuts both ways. Copilot is only as tight as an institution’s file permissions. If a drive is shared more broadly than it should be, Copilot will surface content from it just as broadly.

Where the Gaps Are

• Third-party apps. Users can grant outside apps access to Copilot under their own login. Remove their ability to register enterprise applications.
• Outside identities. B2B guests and Teams shared channels can reach Copilot. If there’s no business need, turn them off.
• Data leaving the US. Web grounding runs through Bing’s global network, and model processing can shift to other regions when a data center is busy. The EU has a documented data boundary; Microsoft hasn’t documented one for the US. Data isn’t stored abroad, but it can be processed there.
• Connected experiences. These can be turned off, but it’s all or nothing across Microsoft 365. For most banks, that costs more than it protects.

The AI You Didn’t Buy

The harder problem is everywhere else. Google search has AI built in. So does Chrome. So does a growing list of vendor tools.

For each one, an institution would need to know what happens to the prompt and the page. Most won’t say.

So a policy may need to steer staff toward tools an institution can actually see into. That could mean signed-in Bing over Google, or Edge over Chrome.

Vendors are the open question. If one says they use Copilot behind the scenes, there’s no clean way yet to confirm they’ve set it up safely. Put it on the due diligence list: ask how their staff sign in, whether prompts are logged, and whether the data is labeled.

What to Do Now

1. Write an AI policy, or update the one already in place. Say what’s allowed and what isn’t.
2. Name the approved tool. For most banks today, that’s Copilot, signed in, shield showing.
3. Train on the why, not just the rules. Your people know customers by name. Show them how that data can slip out, and they’ll guard it.
4. Tighten Microsoft 365 settings. Block user app registration. Close outside access that isn’t in use. Label sensitive data.
5. Review file permissions before rolling out Microsoft 365 Copilot.
6. Add AI questions to vendor due diligence.
7. Re-check every quarter.

Governance Is What Lets You Say Yes

Controls don’t hold AI back at your bank. They’re what let you use it with your name on the line.

We watch how Microsoft’s settings and defaults shift, so your team can keep its attention on the customers in front of them.

You set the policy. We’ll keep the systems steady.