Microsoft Copilot vs. Bare-Metal Private AI: A Data Sovereignty Comparison for UK Regulated Firms | Insights

Microsoft 365 Copilot is the AI product most regulated organisations will evaluate first. It is already embedded in their Microsoft tenant. It carries enterprise branding, a Data Protection Addendum, and the implicit trust of a vendor the firm has used for decades. It is also a system in which every prompt, every document summary, every drafted paragraph transits through Microsoft’s cloud infrastructure — making Microsoft a Data Processor under UK GDPR Article 28 — with a sub-processor chain that now includes Anthropic as a default-enabled third party.

For the full technical definition of the technical definition of zero-egress AI architecture, read our parent article. This piece delivers the head-to-head comparison: where does the data go, who processes it, and what does each model demand from your Compliance Officer?

Where the Data Goes: Two Fundamentally Different Architectures

Microsoft 365 Copilot operates as an orchestration layer across the Microsoft 365 ecosystem. When a solicitor asks Copilot to summarise a document in Word, the prompt is transmitted from the user’s browser to Microsoft’s cloud infrastructure. Copilot queries Microsoft Graph to access the user’s emails, files, calendar, and chats. The prompt and retrieved context are sent to a large language model hosted on Azure OpenAI. The response is generated on Microsoft’s servers and returned to the user.

At every stage, client data is in transit across Microsoft’s infrastructure. Microsoft processes it. Microsoft stores interaction metadata. Microsoft’s abuse monitoring systems may review prompts and completions.

Bare-metal sovereign AI operates entirely within the firm’s own contracted server. When a solicitor asks the AI to summarise a document, the prompt never leaves the firm’s own server. An open-weight large language model runs locally on the firm’s own compute. The document is embedded locally into the firm’s vector database. The response is generated on the same machine. The only connection in is the authenticated session from the user’s browser — through the firm’s own controlled access layer.

No data transits to any third party. No cloud vendor processes the prompt. No sub-processor chain exists at the AI layer.

The Sub-Processor Problem: Anthropic Enabled by Default

This is the detail most firms have missed. Since January 2026, Anthropic’s Claude models have been enabled by default within Microsoft 365 Copilot for most commercial tenants. Anthropic operates as a Microsoft sub-processor under the Microsoft Product Terms and Data Protection Addendum.

For UK and EU/EFTA tenants, the toggle defaults to off — but the implication is critical: Microsoft’s AI stack is no longer a single-vendor processing chain. Copilot features including Agent Mode in Word, Excel, and PowerPoint, the Researcher tool, and Copilot Studio leverage Anthropic models. If a firm’s admin enables the toggle (or if Microsoft changes the default in future), client data processed through these features may be routed through Anthropic’s infrastructure — an additional sub-processor that sits outside the EU Data Boundary and outside Microsoft’s in-country processing commitments.

Microsoft’s own documentation confirms: Anthropic models are currently excluded from the EU Data Boundary and, when applicable, in-country processing commitments.

Your firm’s Compliance Officer must now track not only Microsoft’s DPA obligations but Anthropic’s sub-processor status, its data handling practices, and the jurisdictional implications of data processed outside the EU Data Boundary. Every new sub-processor is a new link in the compliance chain — and a new point of failure.

With bare-metal sovereign AI, there is no sub-processor chain at the AI layer. No OpenAI. No Anthropic. No Google. The model is an open-weight artefact stored on the firm’s own encrypted storage. It does not call home. It does not transmit data. It runs locally, in isolation, on hardware the firm controls.

Processor Liability: The Contractual Burden

When a firm deploys Microsoft 365 Copilot, Microsoft becomes a Data Processor under UK GDPR Article 4(8). This triggers mandatory obligations:

The firm must rely on Microsoft’s Data Protection Addendum as its Article 28 DPA
The firm must monitor Microsoft’s sub-processor list (which now includes Anthropic) and assess each sub-processor’s data handling
The firm must ensure appropriate international transfer mechanisms are in place for any data processed outside the UK
The firm bears ultimate accountability as Data Controller if any link in the chain fails

Microsoft’s DPA is comprehensive. It is also 40+ pages of dense contractual language that your Compliance Officer must read, interpret, and reconcile with the firm’s own data protection policies. Every sub-processor change requires re-assessment. Every new Copilot feature that routes data through a new model requires review.

With Private AI Ltd’s Zero-Touch Provisioning model, the compliance picture is radically different. After deployment, Private AI Ltd holds no credentials, no access, and no processor role. The firm’s only Data Processor at the AI layer is a UK-registered bare-metal infrastructure provider — contracted directly by the firm under a domestic Article 28 DPA. No third party in the access path. Private AI Ltd provides a pre-filled DPA template alongside the Standing DPA, DPIA template, and Data Flow Narrative. No international transfer mechanism is required.

Single processor. Directly contracted by the firm. No sub-processor chains. No 40-page addenda to reconcile.

Data Residency vs. Data Sovereignty

Microsoft advertises data residency — the geographic location where data is stored at rest. For UK customers, this means data stored in Microsoft’s UK data centres. But data residency is not data sovereignty.

Data residency answers the question: where is my data stored?

Data sovereignty answers: who controls my data, who can access it, and can any third party compel its disclosure?

Microsoft is a US-headquartered corporation. Its infrastructure spans dozens of jurisdictions. Its sub-processor list is global. US law enforcement agencies can, under certain statutory instruments, compel disclosure of data held by US corporations regardless of where that data is physically stored. Microsoft’s DPA addresses some of these scenarios, but the legal risk is structural — it exists because of Microsoft’s corporate domicile, not because of any failure of intent.

The infrastructure provider is a UK-registered, UK-owned company with no US corporate parent. Its bare-metal infrastructure is located exclusively within the United Kingdom. No US jurisdictional exposure applies at the compute or storage layer. The firm’s data resides on UK soil, controlled by a UK entity, under a domestic UK GDPR DPA. UK GDPR Article 44 international transfer provisions are not engaged.

That is the difference between residency and sovereignty.

The Bottom Line for the Managing Partner

Microsoft 365 Copilot is a powerful productivity tool. It is not sovereign. It requires your firm to trust Microsoft’s contractual commitments, monitor a growing sub-processor chain that now includes Anthropic, and accept that your client data is processed on infrastructure you do not control, operated by a US-headquartered corporation.

Bare-metal sovereign AI requires your firm to trust physics. The data does not leave — by design, not by promise. The compliance posture is architectural, not contractual.

Talk to our team to see how the two architectures compare for your organisation — and what the compliance posture looks like in practice.

Private AI Ltd (SC881079)