Is using Microsoft Copilot at work covered by the EU AI Act?

What applies to every use?

• Two things, whatever Microsoft Copilot is used for: the AI literacy duty and the prohibitions.
• Chapters I and II, which hold Articles 4 and 5, apply from 2 February 2025 (Article 113, third paragraph, point (a), as replaced by Regulation (EU) 2026/1744).
• That point keeps two later dates: Article 5(1), first subparagraph, points (ba) and (bb) apply from 2 December 2026, as do Article 5(1a) and (1b).

• Article 4(1), as replaced by Regulation (EU) 2026/1744: providers and deployers of AI systems take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context of use, and considering the persons or groups of persons on whom the systems are to be used. The obligation does not require them to guarantee any specific level of AI literacy of any individual.
• Article 5(1), first subparagraph, point (f): placing on the market, putting into service for this specific purpose or using AI systems to infer the emotions of a natural person in the areas of workplace and education institutions is prohibited, except where the use is intended to be put in place or into the market for medical or safety reasons.

When does a Microsoft Copilot use become high-risk?

• When it is used for a purpose Annex III lists.
• Drafting, summarising, searching and writing formulas are not in it.
• Evaluating employees’ performance or behaviour, allocating tasks by personal traits and filtering job applications are, and the company that repurposes a general-purpose assistant that way can become the provider of a high-risk system.
• Chapter III, Sections 1, 2 and 3, which hold the high-risk requirements and the deployer duties of Article 26, apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, with the exception of Article 6(5) (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744).

• Point 4 of Annex III: AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications and to evaluate candidates, and AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics or to monitor and evaluate the performance and behaviour of persons in such relationships.
• Article 25(1), point (c): any distributor, importer, deployer or other third party that modifies the intended purpose of an AI system, including a general-purpose AI system, which has not been classified as high-risk and has already been placed on the market or put into service, in such a way that it becomes a high-risk AI system in accordance with Article 6, is considered a provider of a high-risk AI system and is subject to the provider obligations under Article 16.

What else can apply?

• Article 50(4) is the deployer’s transparency duty for content you publish.
• Article 26(7) is the employer’s duty to inform workers before a high-risk system is used at the workplace.
• Article 50 applies from 2 August 2026, the general date in Article 113, second paragraph, except that a provider of a system generating synthetic audio, image, video or text content placed on the market before that date has until 2 December 2026 to comply with Article 50(2) (Article 111(4)).
• Whether you are the deployer at all: am I a deployer if we just use ChatGPT at work?.

• Article 50(4): a deployer of an AI system that generates or manipulates image, audio or video content constituting a deep fake discloses that the content has been artificially generated or manipulated. Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the duty is limited to disclosing the existence of such content in an appropriate manner that does not hamper the display or enjoyment of the work. A deployer of an AI system that generates or manipulates text published with the purpose of informing the public on matters of public interest discloses that too, unless the text has undergone human review or editorial control and a natural or legal person holds editorial responsibility for its publication. Neither duty applies where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences.
• Article 26(7): before putting into service or using a high-risk AI system at the workplace, a deployer that is an employer informs the workers’ representatives and the affected workers that they will be subject to it, where applicable under the rules and procedures of Union and national law and practice on informing workers.

What about the company that makes the tool?

• Whoever provides the AI system or the general-purpose AI model behind a tool carries the provider’s duties, and they are that provider’s own.
• This page says nothing about how any vendor meets them: nothing here was read from a vendor’s own terms, and the duties above are yours whatever those terms say.