Home / Safety / Copilot for water management
MicrosoftHow safe is Copilot for water management?
Copilot has a concrete GDPR concern. The Claude models within Copilot officially sit outside the EU Data Boundary. If you want strictly EU-only processing, exclude the Claude models in the admin panel. Weigh this heavily before using it in water management.
Where does Copilot stand in water management?
Shared place 19 of 25 options for water management (professional tools and general assistants) on GDPR profile. 7 options, like Copilot, have a caution profile. Each tile is an option we track for this field; click for the check.
Published safeguards
Microsoft 365 Copilot (business) falls under the EU Data Boundary and does not train on tenant data. Consumer Copilot does train by default, with an opt-out.
How to use Copilot safely
- Use the business variant and sign a data processing agreement (DPA).
- Do not enter unnecessary personal data into prompts; anonymise where possible.
- Enable EU data residency where the provider offers it.
- Keep a professional in the loop: water management is critical infrastructure: water boards and drinking water companies fall under the NIS2 rules (in the Netherlands, the Cybersecurity Act), and an AI system running as a safety component in water management may count as high risk under the EU AI Act.
Stronger or equally strong in water management
SIWA Leak FinderSiemens AG (Munich, Germany)InfoTilesInfoTiles AS (Stavanger, Norway)HULOHULO B.V. (Leeuwarden, Netherlands)AquasuiteRoyal HaskoningDHV / Haskoning (Amersfoort, Netherlands)QatiumDeep Tech Solutions SL (Castellón, Spain)Latest developments
Copilot Cowork relies on Anthropic's Claude models for demanding tasks. Because that processing takes place outside the EU Data Boundary, Anthropic is switched off by default in European Microsoft 365 tenants. Anyone who turns it on has data processed outside the EU Data Boundary; at the same time, pay-per-use (Copilot Credits) is coming, in the Netherlands postponed until 1 December 2026. source
Research lab Air Security publicly disclosed Plugin4Shell on 18 September 2026: a zero-click RCE in the plugin mechanism of AI coding agents. The agent pins a plugin to a commit hash but does not verify that the retrieved code belongs to that hash; whoever controls or takes over the upstream repository can thus have code executed during the automatic background update, without any action by the user. GitHub Copilot had no patch at the time of publication, although the report was made to all vendors in June 2026. GDPR relevance: plugins run with the developer's rights (source code, cloud credentials, SSH keys, internal repositories, production systems). If you process personal data on or via development machines, this directly affects your security measures under Art. 32 GDPR. Measures: inventory installed plugins and the owners of those repositories, disable automatic plugin updates where possible, and restrict credentials on development machines. Note: this concerns the GitHub Copilot coding agent, not Microsoft 365 Copilot. source
The Claude models within Microsoft 365 Copilot fall outside the EU Data Boundary; 'flex routing' can route outside the EU during peak load and can be switched off by administrators. source
Questions
- How safe is Copilot for water management?
- Copilot has a concrete GDPR point of attention. The Claude models within Copilot officially fall outside the EU Data Boundary. If you want to process strictly EU-only, exclude the Claude models in the admin panel. Weigh this heavily before deploying it in water management. There is a concrete GDPR point of attention, read the details on the page.
- Does Copilot train on my data?
- Microsoft 365 Copilot (business) falls under the EU Data Boundary and does not train on tenant data. Consumer Copilot does train by default, with an opt-out.
- What should I look out for with AI in water management?
- Water management is critical infrastructure: water boards and drinking water companies fall under the NIS2 rules (in the Netherlands, the Cyber Security Act), and an AI system that runs as a safety component in water management may count as high risk under the AI Act. So ask about certification, data storage and who keeps control during an outage. HULO is ISO 27001 certified, holds the SC30 NIS2 mark, stores data in the client's region and does not train on client data. TaKaDu (Spain) is ISO 27001 certified. KISTERS WISKI can run on-premise. With many other providers, such as Qatium, Siemens and FIDO Tech, the hosting location is not publicly stated: record it in the data processing agreement. Personal data mainly sits in consumption data from smart water meters; keep it separate from network data where possible.
Source documents
Everything about Copilot Best AI for water management
Summarised by the editorial team from provider documentation · not legal advice
Last checked: 15 October 2026 · How we check
Source: , checked on 15 October 2026
Every Friday: what changed in AI for water management
New models, prices, oversight and tools, with sources and what it means for you. One email a week, unsubscribe with one click.