Evaluate compliance risks for AI usage
AI technologies can create new compliance risks. Prompts might include sensitive data, and generated responses can surface regulated content or raise jurisdictional concerns. Organizations need a way to evaluate whether their AI use meets regulatory and industry standards. Microsoft Purview includes Compliance Manager, which provides a structured way to assess AI-related risks and track progress toward meeting obligations.
Use Compliance Manager to assess AI-specific risks
Compliance Manager works as a risk assessment framework. It allows compliance and risk teams to evaluate how well their organization is meeting regulatory expectations, including those affected by AI.
For example, a legal team might need assurance that Copilot prompts are being retained and can be audited. Compliance Manager includes assessments that identify whether those controls are configured. Assessments cover areas to:
- Protect sensitive data during AI interactions
- Enforce audit and retention policies
- Govern non-Microsoft and API access
- Align AI usage with regulatory and jurisdictional standards
Each assessment produces a compliance score and lists recommended improvement actions. These actions can be assigned to responsible staff, creating accountability and making progress measurable over time.
Apply templates to manage compliance for AI tools
Compliance Manager also includes prebuilt templates that map common AI scenarios to specific control requirements. These templates give organizations a starting point for understanding where their protections align with regulatory standards and where gaps remain. Examples include:
- Microsoft 365 Copilot Data Protection Baseline
- Microsoft Copilot for Microsoft 365 (preview)
- AI and Large Language Model usage
- ISO/IEC standards such as ISO/IEC 42001 for AI management systems (where applicable)
Templates can be tailored to reflect organizational priorities. They also allow teams to demonstrate how Purview features such as sensitivity labels, data loss prevention, and retention policies serve as evidence during audits or regulatory reviews.
By using assessments and templates together, compliance and risk teams maintain visibility into AI-related risks and can demonstrate due diligence when questioned by auditors or regulators.