1. Purpose
The purpose of this policy document is to provide a framework for the use of Microsoft Copilot and other Generative Artificial Intelligence Large Language Models (GenAI) such as, Gemini, GPT Series, Grok and other similar tools by Council employees, Councillors, contractors, developers, vendors, temporary staff, consultants or other third parties, hereinafter referred to as ‘users’.
This policy is designed to ensure that the use of Copilot and GenAI is ethical, complies with all applicable laws, regulations, and council policies, and complements the Council’s existing information and security policies.
The pace of development and application of all GenAI is such that this policy will be in a constant state of development.
Following a thorough review of organisational usage scenario and expected implementation of Gen AI across the council, the Council has updated the AI policy.
As of 2026, Microsoft 365 Copilot is recognised as the Council’s designated environment for using AI with organisational information. Copilot runs entirely within the Council’s Microsoft 365 environment and, through Microsoft Graph (Microsoft’s secure system that links together data across Microsoft 365), can only access information that users already have permission to see. This means Copilot stays within existing security and access controls and does not introduce any new or external data sources. This is important because it ensures that the use of AI remains fully aligned with the Council’s data governance, privacy, and security obligations. It also means councillors and staff can use Copilot with confidence, knowing that no additional data risks or external systems are being introduced.
The Council also acknowledges the Information Commissioner’s Office (ICO) Data Protection Impact Assessment (DPIA) for Microsoft 365 Copilot, which confirms that Copilot processes organisational information under the same contractual protections that already apply to Microsoft 365, including the Product Terms and Data Protection Addendum. This provides assurance that Copilot is governed by the same legal, privacy and security safeguards the Council already relies on, meaning its use does not introduce new or untested data‑handling risks.
This policy applies to all users who access generative AI tools for council work, whether they do so on council‑owned devices or on personal devices used for council activities. These tools may also appear within other software the Council already uses. For example, Copilot is now integrated across Microsoft 365 applications. This ensures that the policy covers both direct use of AI tools and any AI features embedded within everyday systems that staff and councillors use to undertake Council business.
Use of generative AI must promote fairness and avoid bias, helping to prevent discrimination and support equal treatment. AI tools should be used in ways that align with and positively contribute to the Council’s goals and values. Users may use GenAI for work‑related purposes, provided they follow this policy. Appropriate uses include generating text or content for reports, emails, presentations, images, and customer service communications.
GenAI must not be used in ways that could cause harm, mislead others, or compromise confidentiality. For example, creating inaccurate information, generating content that could disadvantage individuals or groups, or inputting sensitive personal data that should not be processed by AI.
When working with internal documents, confidential information or any data relating to Council operations or personal information, users must use Microsoft 365 Copilot. This ensures that all AI activity stays within the Council’s secure Microsoft environment. Public AI services must not be used for organisational or personal data, as they operate outside our controlled environment and do not provide the same security, privacy or governance protections. This helps safeguard sensitive information and reduces the risk of data loss, unauthorised access or compliance breaches.
The ICO DPIA confirms that Copilot only uses organisational data already held within Microsoft 365 and does so under the same safeguards that apply to the rest of the platform. This means the risk of information being accessed inappropriately is low, provided staff continue to follow existing permissions and access controls.
If users want to explore the possibility of using AI for any other purpose, then they must contact the Projects Team, who will verify whether its purpose is covered by this policy.
What are the rules that MUST be followed?
1. Copilot should be the exclusive AI tool used, and only whilst logged into a work Microsoft account.
2. Personal information may only be used with Microsoft 365 Copilot when it is appropriate to do so under Council data‑protection policies.
3. Sensitive data, personal data, financial data and medical data used in Copilot systems must be minimised, secured, and processed in accordance with data protection principles. More information on this is found in the next section.
4. Do not input personally identifiable information into external GenAI tools.
5. Do not use for non-rule-based automated decision making.
6. Do not input any commercially sensitive local authority data (e.g. payment card data, data that effects the operational security of the organisation, etc).
7. Do not use a personal account for work related purposes.
8. Where the Microsoft Copilot tool has cited where it has obtained information from, then this must be referenced in user’s document/work.
9. The user is responsible for evaluating the output generated by Microsoft Copilot. The user must check for accuracy, coherence, and appropriateness.
10. Any decisions informed by AI resources must be verified and approved by an authorised human employee prior to implementation. These should otherwise be treated as simply indicative.
11. Be clear with other staff and service users (your Privacy Notice could need amending) when you have used Microsoft Copilot as part of your work if:
a. You directly quote or use a significant proportion of the Microsoft Copilot output.
b. You use the Microsoft Copilot output to meaningfully inform a decision you make.
c. You need to ensure trust with particular groups you are communicating with (residents, political or senior leaders etc.).
12. Follow any legal and regulatory requirements of the tool you are using, including any other policies set by SBC.
Personal Data and AI Use
To ensure organisational compliance with the AI policy, all users of AI and Copilot that plan on entering any personal or identifiable data must follow instructions found within the table below:
|
For each purpose of AI data processing, users must complete the following: |
|
Document each use case by completing the Data Protection by Design for AI use document, which includes: · Confirmation that they have read the AI policy in its entirety. · Documenting SBC’s purpose for using the AI for the specified usage. · Determining and documenting a retention time for any recordings/ transcripts /other documents made in connection with AI and personal data. · Identifying, and documenting, the risks to the data subjects (individuals whose personal data is captured by the AI), and consideration of the relevant Privacy Notice to see if it requires amendment to be clear that AI will be used. · Provide their manager’s sign off for the use case. |
|
· Ensure that the projects and data protection teams are provided with this information by emailing g.projects@spelthorne.gov.uk and data.protection@spelthorne.gov.uk |
How to use Microsoft Copilot
Microsoft Copilot is most commonly used to support individual tasks and act as a personal assistant. For example, it can help you to:
Copilot can also help staff and councillors be more productive by reducing time spent on administrative work and enabling them to focus on decision‑making, service delivery and resident engagement.
Particular attention should be given to Governance, Vendor Practices, Copyright, Accuracy, Confidentiality, Disclosure and Integration with other tools.
Human oversight and checking of output.
All output generated by Copilot must be reviewed carefully by the user before it is shared, used to support decision‑making, or added to Council systems. Copilot is a support tool, not an autonomous decision-maker, and it can occasionally produce inaccurate, outdated or incomplete information. For this reason, a human must always remain in the loop, applying judgement, context and experience to confirm whether the output is appropriate and reliable.
Copilot must not be used to make final decisions, particularly those that affect residents, services, budgets or staff. Instead, it should be seen as a way to speed up early drafting, summarise information, or generate options, with users responsible for validating the final content.
Keeping a human in the loop ensures decisions remain accountable and are made by people, not automated tools. It also reduces the risk of errors, bias or misleading information finding its way into reports or communications. By requiring human review, the Council is better protected from reputational, legal and compliance issues that could arise from unchecked AI output. Most importantly, it reinforces that AI is an assistant to professional judgement and not a substitute for it.
Appropriate use (with human review):
· Using Copilot to create the first draft of a report, then editing it to ensure accuracy and neutrality.
· Asking Copilot to summarise a long document, then checking the summary against the original for correctness.
· Generating a list of possible project risks, then adding, removing or amending items based on professional knowledge.
· Turning bullet points into a briefing note, followed by a manual check to ensure the meaning has not changed.
Inappropriate use (not allowed):
· Relying on Copilot to determine eligibility for a service, benefit or decision outcome.
· Using Copilot’s output as factual without checking it against trusted sources.
· Allowing Copilot to draft communications that include sensitive, political, legal or resident‑specific information without careful human review.
· Feeding confidential or personal data into non‑approved public AI tools, or using AI output as the final version without oversight.
Users must declare their responsible and ethical usage of Microsoft Copilot by completing the ICT Personal Commitment Statement form. Users must also agree to responsible and ethical use of GenAI when accessing the network during user logon. Users must take responsibility for their use of AI by ensuring they verify information, use it ethically, and remain aware of potential biases. It is crucial to protect privacy and maintain human oversight to prevent misuse and unintended consequences. The Project Team has a risk evaluation document that addresses the risks associated with using all AI.
Microsoft 365 Copilot is the Council’s only designated AI platform for work involving organisational information.
Any use of other GenAI technology in pursuit of Council activities should not be done, unless authorised through the MAT process in consultation with the data protection team.
Users must adhere to copyright laws when utilising Microsoft Copilot. It is prohibited to use Copilot to generate content that infringes upon the intellectual property rights of others, including but not limited to copyrighted material. If a user is unsure whether a particular use of Copilot constitutes copyright infringement, they should contact Legal before using Copilot for this purpose.
As set out in the Human oversight and checking of output section above, Copilot can occasionally generate content that appears confident but is not factually correct (“hallucinations”). Hallucination is a term given to when AI predicts likely wording from patterns rather than verifying facts, this can happen when the prompt is ambiguous, context is incomplete, or there’s no authoritative source for the model to rely on.
For this reason, all Copilot output must be reviewed and edited for accuracy before it is used, shared, or stored in Council systems. Users remain responsible and accountable for the content they submit or publish. If there is any doubt about the accuracy or reliability of Copilot’s output, even after checking, the output must not be used.
This approach ensures that Copilot supports drafting, summarising and idea generation, while final judgements and decisions remain with people, in line with the Council’s governance, privacy and professional standards.
Confidential or personal information must only be processed using Microsoft 365 Copilot. Copilot keeps all data within the Council’s Microsoft tenant and is protected by Microsoft’s existing enterprise‑level privacy and security controls.
Organisational data processed by Microsoft 365 Copilot is treated as ‘Customer Data’ under Microsoft’s Product Terms and Data Protection Addendum, so it is protected by the same contractual, security and international‑transfer safeguards that apply across Microsoft 365, including GDPR and UK GDPR commitments. The ICO’s DPIA for Microsoft 365 Copilot confirms this position, noting that Copilot operates under existing Microsoft 365 protections rather than creating new data‑handling regimes.
2.6 Climate Change Impact
Generative AI, including Microsoft Copilot has the potential to have a significant environmental impact, through its role of increasing energy demand and consumption, and therefore reliance on an energy supply. GenAI models consume large amounts of energy during the training and inference phases and require a substantial amount of energy to cool GenAI processors. As these models grow in size and complexity, and demand for AI services rise, the energy demands will continue to increase.
As a Local Authority, there is a duty to report on our Green House Gas (GHG) emissions. We currently report on Scope 1 emissions (emissions that a company makes directly e.g. burning of fossil fuels and fleet vehicles) and Scope 2 emissions (emissions used indirectly e.g. purchasing electricity). However, there is a drive to also report Scope 3 emissions (all the associated emissions that an organisation is indirectly responsible for e.g. buying products from suppliers which then produce emissions when customers use them), in which AI is included. Although there is uncertainty around the future environmental impact of AI, with possibilities of companies investing in clean energy sources to power data centres and therefore offsetting some of the projected increase in power demand, AI encompasses a carbon footprint which needs to be accounted for.
2.7 Social Impact and Equality
Users must be aware of how the use of GenAI, including Microsoft Copilot, may impact different groups of people in different ways, as it may have inherent social bias or have been trained in stereotypes. It may have inappropriate cultural values or display sensitive content. For example, GenAI must not be allowed to solely determine which customers have access to services. Human involvement remains essential in decision-making, and the Council should establish an appeal process for any automated or AI-informed decisions.
Microsoft Copilot must be used ethically and in accordance with all relevant laws, regulations and Council policies. Users must not use Copilot to generate content that is discriminatory, offensive, misleading or inappropriate. This includes avoiding outputs that reinforce harmful stereotypes, misrepresent individuals or groups, or could undermine trust in Council services. Copilot should never be used to create content intended to influence decisions unfairly, imitate individuals, or fabricate information.
If users are unsure whether using Copilot is appropriate in a particular context, they should seek advice from their manager or the data protection team before proceeding.
Content produced via Microsoft Copilot must be identified and disclosed as containing GenAI-generated information.
Footnote example: Note: This document contains content generated by Artificial Intelligence (AI), through Microsoft Copilot. AI generated content has been reviewed by the author for accuracy and edited/revised where necessary. The author takes responsibility for this content.
Where Microsoft 365 applications include Copilot features, staff may work with Council data in those tools because the processing remains within the Council’s secure Microsoft environment. This covers applications such as Teams, Word, Outlook and Excel, all of which the ICO DPIA identifies as suitable for Copilot‑supported tasks when configured appropriately
Use of GenAI carry inherent risks, particularly GenAI models other than Microsoft Copilot that fall outside the organisational tenant of Microsoft 365. A comprehensive risk assessment must be conducted for any project or process where use of an external to Copilot GenAI is proposed. The risk assessment should consider potential impacts including legal compliance; bias and discrimination; security (including technical protections and security certifications); and data sovereignty and protection.
Data entered into public or non‑approved GenAI tools may enter the public domain. This can expose non‑public information, breach regulatory requirements, violate service‑user or vendor contracts, or compromise intellectual property. Any release of confidential or personal information could also result in a breach of UK data protection law. Use of GenAI to compile content may further infringe intellectual property rights if material is reused without proper checks.
In contrast, Microsoft 365 Copilot keeps all processing within the Council’s secure Microsoft environment, meaning organisational data remains protected under existing contractual and GDPR‑aligned safeguards. However, this does not remove the need for care: users must still ensure that any information they input or generate complies with legislation and Council policy, and must follow the Human oversight and checking of output requirements set out above.
Any potential or suspected breach of this policy must be reported to the Information Governance Team or senior management. Failure to report may result in disciplinary action in line with Council HR procedures.
GenAI may make use of and generate biased, discriminatory, or offensive content. This can occur as a result of information entered by users or be an inherent fault of the tool because it has been trained on stereotypes. Users must use GenAI responsibly and ethically, in compliance with council policies and applicable laws and regulations.
While a GenAI platform may be hosted internationally, under data sovereignty rules information created or collected in the originating country will remain under jurisdiction of that country’s laws. The reverse also applies. If information is sourced from GenAI hosted overseas, the laws of the source country regarding its use and access may apply. GenAI service providers should be assessed for data sovereignty practice by any organisation wishing to use their GenAI.
3.4 Use of Microsoft 365 Copilot
The ICO’s DPIA confirms that Microsoft Copilot presents no new high‑risk processing when used within an organisation’s Microsoft 365 tenant. The main risks relate to access permissions, configuration and user behaviour, rather than the technology itself.
The DPIA also highlights the value of a phased and controlled rollout, which the ICO carried out internally before enabling broader access. This approach ensured that Copilot was tested for functionality, alignment with existing controls, and suitability for real‑world use cases.
Public AI tools remain unapproved for internal or sensitive work because they fall outside these protections.
Any violations of this policy should be reported to the council’s data protection team or senior management. Failure to comply with this policy may result in disciplinary action, in accordance with council’s Human Resources policies and procedures.
· Staff must not use external or public AI tools for organisational or personal information unless a specific DPIA and security assessment has been completed and formally approved.
This policy will be reviewed periodically and updated as necessary to ensure continued compliance with all applicable legislation, regulations, and organisational policies.
By using Copilot, users acknowledge that they have read and understood these guidelines, including the risks associated with the use of Copilot.
ICO DPIA for Microsoft Copilot 365 (ICO internal assessment): https://ico.org.uk/media2/ob4ncmpz/ic-359252-x5s0-copilot-dpia.pdf
Data, Privacy, and Security for Microsoft 365 Copilot: https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy