Microsoft quietly changes Copilot: your data is processed outside the EU—unless you opt out

Wednesday, 15 April 2026 at 23:29

Microsoft verandert Copilot stilletjes data buiten EU verwerkt, tenzij je dit uitzet

Starting April 17, Microsoft will change Copilot so that data may be temporarily processed outside the EU during peak demand. This applies by default to all organizations unless admins actively disable it. In practice, Microsoft shifts data localization responsibility squarely to the customer.

The change directly affects organizations that rely on European data processing for compliance. Companies must now verify whether their AI usage still meets internal policies and laws like the GDPR. Without action, Copilot can temporarily handle workloads outside Europe.

What does Copilot data outside the EU actually mean?

Copilot processes data outside the EU during peak loads to maintain performance. Microsoft calls this “flex routing,” which automatically sends requests to other regions when European data centers are overloaded.

This approach means:

AI requests may be processed outside Europe, temporarily
Data travels across international infrastructure
The European data boundary is no longer guaranteed by default

Microsoft stresses that data remains encrypted in transit and at rest. Encryption provides technical protection, but it does not change the geography of processing.

For many organizations, that’s still a problem. Data residency—where data is physically processed—is a core requirement in many compliance frameworks.

Why is Microsoft making this change?

Microsoft is introducing flex routing to safeguard Copilot’s scalability and speed. Generative AI is compute-hungry, especially at peak times.

Surging AI use within Microsoft 365 is pressuring European data centers. By temporarily using capacity outside Europe, Microsoft aims to prevent slowdowns and outages.

The priority is clear:

Performance and availability over strict data localization
Infrastructure flexibility over regional constraints

For organizations, this is the classic trade-off between speed and compliance.

How do you prevent Copilot from processing data outside Europe?

Organizations can manually turn off flex routing in the Microsoft 365 admin center. It’s enabled by default, so it requires deliberate action.

Follow these steps:

Sign in to the Microsoft 365 admin center
Go to Copilot
Open Settings
Select “Flex routing during peak load periods”
Choose: “Do not allow flex routing”

After this change, data remains within the EU, but performance may dip during peak hours.

What compliance risks arise?

Using Copilot outside the EU can introduce compliance risks, especially in tightly regulated sectors like government, healthcare, and financial services.

Key risks include:

Potential breaches of data localization requirements
Uncertainty about processing under European law
Additional audits and documentation burdens

While encryption helps, the processing location remains legally relevant. Regulators assess not just security, but also where data is physically processed.

What does this mean for Dutch organizations?

Dutch companies must actively govern AI use within Microsoft 365. Copilot is not compliant out of the box without configuration.

The change highlights a broader trend:

AI services are becoming more dynamic and less predictable
Cloud providers are shifting responsibility to customers
Governance and settings are becoming critical

For IT and compliance teams, Copilot is not just a productivity tool—it’s a risk factor.

Time for action—or overreaction?

This change demands immediate attention from organizations that depend on EU data processing. Doing nothing means implicitly accepting international processing during peak times.

For many organizations, the right move is to: