Microsoft Copilot is showing up in the tools your attorneys and staff already use, and the sales pitch is easy to understand: faster drafts, shorter meetings, less time digging through email. For a law firm the harder question is not whether it is clever. It is whether it is safe to turn on, and whether it will pay for itself in recovered time.
This post covers what Copilot is, what Microsoft says it does with your data, the single biggest risk for law firms, and a practical way to decide whether it earns a place in your firm.
First, which Copilot are we talking about?
Microsoft uses the Copilot name for several different products. Microsoft 365 Copilot is the paid add-on that works inside Word, Outlook, Teams, and other Microsoft 365 apps, and it draws on your firm's own data: files, email, chats, and meetings. Separately, Microsoft offers free, chat-style Copilot experiences, and the data protections differ depending on the product and on whether the person is signed in with a work account or a personal one.
The first thing to confirm is which of these your staff are already using. A fair number of firms discover that someone has been pasting client information into a free consumer AI tool well before any official decision was made. That is a policy issue, and it is worth addressing whether or not you ever buy Copilot.
What Microsoft says it does with your data
Based on Microsoft's own published privacy documentation for Microsoft 365 Copilot, the main points are these:
- Your prompts and the data Copilot accesses are not used to train the underlying foundation language models.
- Copilot respects the permissions of the person using it. It can only surface content that user already has access to.
- It honors sensitivity-label encryption set through Microsoft Purview, so protected content stays governed by those rules.
- Interaction data is encrypted, and administrators have retention controls over it.
There are caveats worth reading before you sign anything. Data residency commitments come with exceptions, such as processing in other regions in some cases. Features that use web search send queries out to Bing. Some features rely on third-party model providers operating as subprocessors, and agents or extensions can carry their own terms. Content in shared Teams channels involves more people than you might assume. And, importantly, Microsoft does not guarantee that Copilot's outputs are accurate. These details change, so have your IT provider check current documentation rather than relying on a blog post, including this one.
The real risk: Copilot finds what your permissions already allow
Because Copilot respects permissions, it sounds like the safety problem is solved. In practice it exposes a different one. Copilot is very good at finding things, and it will find anything the user can technically open. If a file share has loose permissions, an old folder contains partner compensation, or an HR document was shared with "everyone" years ago, an ordinary search in Copilot can now surface it in seconds.
Law firms have an extra layer of concern. Ethical walls and conflict screens only work if the underlying access is correctly set. A matter that should be restricted to a small team needs to actually be restricted to that team before an AI assistant starts summarizing everything in reach.
A checklist before you turn it on
- Audit permissions on file shares, SharePoint sites, and Teams, and fix anything shared more broadly than intended.
- Confirm matter-level access and ethical walls are enforced in the systems Copilot can reach.
- Apply sensitivity labels to the categories that need them, such as privileged materials and firm financials.
- Require multi-factor authentication and review conditional access rules.
- Adopt a written AI use policy that says what staff may and may not do, and who reviews output before it goes anywhere.
- Decide what gets retained and for how long, and confirm administrators can retrieve it if needed.
That list takes real effort, and most of the value of the exercise has nothing to do with Copilot. A clean permission structure is a security improvement on its own.
Where it helps and where it does not
The strongest early use cases tend to be administrative: summarizing a long email thread, pulling action items from a recorded meeting, drafting routine correspondence, and producing a first pass at an internal memo. These save time without putting legal judgment at risk.
It is a poor substitute for legal research or for citing authority. Generative tools can state wrong things with confidence, and the American Bar Association's 2024 formal opinion on generative AI emphasizes the lawyer's duties of competence, confidentiality, and supervision. Every output still needs human review by someone qualified to catch a mistake.
How to decide if it is worth it
Skip the firm-wide purchase. Run a pilot with a small group, usually a mix of attorneys and administrative staff, for a defined period. Before it starts, decide what you are measuring: minutes saved on specific recurring tasks, whether people keep using it after the novelty fades, and any incident where the tool surfaced something it should not have.
Then compare the time recovered against the licensing cost for those seats. If the answer is yes for some roles and no for others, that is a fine outcome. Not every seat needs a license.
Frequently Asked Questions
Is Microsoft 365 Copilot the same as the free Copilot?
No. They are different products with different data protections. The paid Microsoft 365 Copilot works inside your firm's Microsoft 365 environment and your data, while free chat experiences operate differently. Confirm which one your staff are using and under which account.
Will Copilot train on our client data?
Microsoft states that prompts and data accessed through Microsoft 365 Copilot are not used to train the foundation models. Review the current documentation and your agreement with your IT provider to confirm the details for your configuration.
Can Copilot see files an attorney is not supposed to access?
It is designed to respect existing permissions, so it should only surface what the user can already open. The catch is that many firms have permissions that are broader than anyone realized, which is why a permission audit comes first.
Does using Copilot require telling clients?
That depends on your jurisdiction's rules, your engagement letters, and how the tool is used. Check your state bar's current guidance and talk with your firm's ethics counsel. We are an IT company, not a source of legal advice.
Should we wait?
Waiting is a reasonable choice if your permissions and policies are not ready. The preparation work is worth doing either way, so you can decide on your own timeline rather than because staff started using AI tools on their own.
Next Step
If you are weighing Copilot and want to know what your current permissions would expose, we can talk through it. We offer a 15-minute call to see if we're a fit. No pitch, no obligation.
Managing partners and office administrators can reach us at 325-643-8184 or through the contact form at apollocomputers.com.
