{"id":73423,"date":"2026-08-05T22:33:35","date_gmt":"2026-08-05T20:33:35","guid":{"rendered":"http:\/\/adiumento.local\/?page_id=73423"},"modified":"2026-08-05T22:33:35","modified_gmt":"2026-08-05T20:33:35","slug":"copilot-governance-shadow-ai","status":"publish","type":"page","link":"https:\/\/adiumento.de\/en\/themen\/regulatorik-sicher-umsetzen\/ki-governance\/copilot-governance-shadow-ai\/","title":{"rendered":"Copilot governance and Shadow AI"},"content":{"rendered":"
\"KI-Governance<\/span>

\u2190 AI governance<\/a><\/p>

Copilot governance and Shadow AI<\/h1>

Place Copilot use on a reliable data, authorisation and operational basis.<\/strong><\/p><\/div><\/div>\n\n\n\n

This page covers Microsoft Copilot, Microsoft 365 Copilot, Copilot Chat and agents where they are used in or connected to the Microsoft 365 environment. A controlled introduction begins not with licence assignment but with readiness in terms of data, access, responsibilities and use. Microsoft 365 Copilot can reference content within existing permissions and policies; inappropriate sharing may therefore become more visible. Plugins, agents, connectors and additional data sources each require their own assessment. Governance therefore combines permission clean-up, information protection, policies, training, monitoring and a controlled lifecycle.<\/p>\n<\/div>\n\n\n

Relationship to services and technologies<\/h2>\n\n
\"KI-Governance<\/figure>
\n

This is about the regulatory and operational control issues when using Copilot that is already planned or ongoing: permissible data, approvals, evidence and the handling of Shadow AI. You can find the start of the consultation and introduction in the solution AI Readiness \/ Copilot Governance<\/a>.<\/p>\n<\/div><\/div>\n\n\n<\/div>\n\n\n

Background<\/h2>\n\n

Departments often use generative AI before central specifications, data classification or approval processes are established. Shadow AI refers here to non-coordinated or non-controlled AI use; the term is not a fixed legal term. It can lead to unclear data flows, incomprehensible decisions and inconsistent usage. A blanket ban rarely solves the underlying needs; An uncontrolled rollout, on the other hand, reinforces existing weaknesses in approvals and content ownership.<\/p>\n\n\n\n

Microsoft describes the data access architecture for Microsoft 365 Copilot and the consideration of existing permissions, sharing settings and policies. Governance must therefore address both the AI scenario and the quality of the existing data and access control.<\/p>\n<\/div>\n\n\n

Technical context<\/h2>\n\n
\"Abstrakte<\/figure>
\n

Copilot Governance is the control of the entire usage cycle: needs and target image, data and authorisation readiness, release, secure use, monitoring, adjustment and orderly termination. It differs from a pure product configuration. The classification according to the EU AI Act or other requirements must also be assessed on a case-by-case basis and by the responsible specialist and legal functions.<\/p>\n<\/div><\/div>\n\n\n\n

Oversharing is a key operational risk: Content is not necessarily accessible without authorisation, but may be too widely visible due to historically broad groups, sharing links, unclear ownership, or broken permission inheritance. Microsoft describes, among other things, reports on data access governance, access restrictions and limited content recognition as possible technical aids.<\/p>\n<\/div>\n\n\n

What companies need to clarify specifically<\/h2>\n\n