Shop / A · Copilot and Microsoft 365 adoption
Copilot usage policy
The document your lawyer, DPO, CISO and works council expect before licences are switched on. Ready to adapt, appendices included. In French, for French companies.
For: CIOs, HR directors, lawyers and DPOs preparing a Microsoft 365 Copilot pilot or rollout.
The problem
Your Copilot licences are bought. Before switching them on, four people ask their questions: legal about liability, the DPO about personal data, the CISO about access, the works council about working conditions.
Each expects a document. Nobody wants to write it alone. The project waits, or starts without rules.
Copilot sees everything the user can open. Without written rules on data and checking, an overshared document or an invented figure becomes your problem the day it leaves the company.
Free excerpt
Copilot sees everything you can open. A document shared too widely becomes findable with a simple question. Before asking, check who can access your folders.
Forbidden: entering client data, employee data, unpublished financial information or any document classified “confidential” or above into an AI tool outside the company’s Microsoft 365.
Allowed: summarising, rewording, drafting or searching the documents you can already access, inside the company’s Microsoft 365 environment.
Anything Copilot produces that leaves your team (client, regulator, management) is reviewed and approved by a person, who remains accountable for it.
Appendices cite the texts: GDPR art. 35 (DPIA), French Labour Code L1222-4 and L2312-8 (information and consultation), AI Act art. 4 (AI literacy). This template does not replace your lawyer’s advice.
Download the excerpt as a PDF (article 4 and the 12 CISO checks, in French)
Full version
€290excl. VAT
Format: editable Word and PDF, in French. Volume: a 9-article policy and 4 appendices, 7 A4 pages.
- 01Preamble and article 1: scope, groups covered, effective date.
- 02Article 2: the four principles of use.
- 03Article 3: allowed uses, with space for your use cases by department.
- 04Article 4: data, classification, personal data, forbidden outside tools.
- 05Article 5: human review, double review for regulated functions.
- 06Articles 6 and 7: transparency and content ownership.
- 07Article 8: what the company commits to: training, measurement without individual tracking, support.
- 08Article 9: breaches, with the note on attaching the policy to the company rules.
- 09Appendix 1, DPO: processing record, 6 questions to decide on an impact assessment, staff information.
- 10Appendix 2, CISO: 12 checks before licences go live, with owner and status.
- 11Appendix 3, works council: 8-point information-consultation note and sample timeline.
- 12Appendix 4: announcement message to staff.
Invoice and file sent by email within 24 working hours.
Your objections
- “Our lawyer can write it.”
- Yes. They start from a complete text instead of a blank page. The DPO, CISO and works council appendices are separate: each reviews their part.
- “Microsoft already provides documentation.”
- It describes the tool. It does not say what your staff may do, or what the company commits not to measure. That is what a policy is for.
- “Does it comply with French law?”
- The template cites the applicable texts (GDPR, French Labour Code, AI Act) and flags each choice to validate. It does not replace your lawyer’s advice. It gives them a text to review.
Short fixed-price first milestone
The policy sets the rules. The diagnostic checks they are applied and that the tool is used.
Start with the diagnostic: €1,200 excl. VAT, 10 working days, a written report.
You judge the work on paper before deciding to go further. No commitment beyond this milestone.