{"id":32496,"date":"2026-05-08T18:00:10","date_gmt":"2026-05-08T18:00:10","guid":{"rendered":"https:\/\/www.europesays.com\/ai\/32496\/"},"modified":"2026-05-08T18:00:10","modified_gmt":"2026-05-08T18:00:10","slug":"microsoft-copilot-flex-routing-your-data-is-leaving-the-eu-by-default","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/ai\/32496\/","title":{"rendered":"Microsoft Copilot: Flex Routing \u2013 Your Data Is Leaving the EU. By Default."},"content":{"rendered":"<p>In April 2026, Microsoft introduced a new feature for Microsoft 365 Copilot: \u201e<a href=\"https:\/\/learn.microsoft.com\/en-us\/microsoft-365\/copilot\/copilot-flex-routing\" target=\"_blank\" rel=\"noopener nofollow\">Flex Routing<\/a>\u201e. The name sounds harmless. The data protection implications are not.<\/p>\n<p>What Is Flex Routing?<\/p>\n<p>Flex Routing allows Microsoft to reroute Copilot AI requests to data centres in the US, Canada, or Australia when European data centre capacity runs short. What is affected is so-called LLM inferencing \u2013 the step where the language model actually processes your input. At that point, your data \u2013 emails, files, metadata, prompts \u2013 has already been assembled and is handed to the model as a package. Flex Routing means: that package can leave the EU.<\/p>\n<p>Microsoft emphasises that data remains encrypted in transit and continues to be stored within the EU. But that does not change the fact that processing takes place outside the EU. And that is what matters.<\/p>\n<p>The Data Protection Problem<\/p>\n<p>Processing personal data in a third country constitutes a data transfer under Articles 44 et seq. GDPR. This requires a legal basis \u2013 such as an adequacy decision (Article 45 GDPR), appropriate safeguards like Standard Contractual Clauses (Article 46(2)(c) GDPR), or a Transfer Impact Assessment. This applies even if the data is only transferred for processing and then stored back in the EU.<\/p>\n<p>Is This Already Happening? You Had No Idea?<\/p>\n<p>Yes \u2013 at least if your tenant was created after 25 March 2026, Flex Routing is enabled by default.<\/p>\n<p>For existing tenants, the feature was rolled out on 17 April 2026. It not clear whether the option came as opt-in or opt-out. The information in Microsoft\u2019s Message Center posts (MC1269219 and MC1269223) is not entirely consistent.<\/p>\n<p>Our recommendation is therefore to actively check whether the feature is enabled in your tenant, to avoid an unnoticed third-country transfer.<\/p>\n<p>NIS2<\/p>\n<p>Organisations subject to NIS2 must control risks in their supply chain \u2013 including the security of acquisition, development, and maintenance of IT systems.<\/p>\n<p>A silent change to the processing location by a key IT service provider (where implemented as an opt-out) constitutes a third-party risk that must be documented in supplier management.<\/p>\n<p>What Should You Do?<\/p>\n<p>First: Check whether Flex Routing is enabled in your tenant. Open the Microsoft 365 Admin Center and navigate to Copilot &gt; Settings &gt; Flexible inferencing during peak load periods. Select \u201eDo not allow flex routing\u201c if you want to rule out processing outside the EU.<\/p>\n<p>Second: If you choose to keep Flex Routing enabled, make sure that appropriate transfer mechanisms are in place for the relevant third countries (US, Canada, Australia). For the US, the EU-U.S. Data Privacy Framework may currently apply (Article 45 GDPR) \u2013 provided Microsoft is listed under the Data Privacy Framework and the transfer falls within its scope. For Canada and Australia, Standard Contractual Clauses or other appropriate safeguards would be required.<\/p>\n<p>Third: Document your decision. The Flex Routing configuration belongs in your Records of Processing Activities and, where applicable, in your Data Protection Impact Assessment for the use of Microsoft 365 Copilot.<\/p>\n<p>Important: Keep an eye on product changes from cloud service providers and review them for data protection implications. The Microsoft Message Center is not just an IT operations channel \u2013 it is a compliance channel.<\/p>\n<p>If you have any questions, please do not hesitate to contact us. We help you operate and assess your Microsoft tenant in a data-protection-compliant manner \u2013 including retention periods, access rights, audits, data processing agreements, and more. Inside and outside the EU.<\/p>\n","protected":false},"excerpt":{"rendered":"In April 2026, Microsoft introduced a new feature for Microsoft 365 Copilot: \u201eFlex Routing\u201e. The name sounds harmless.&hellip;\n","protected":false},"author":2,"featured_media":32497,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11],"tags":[420,7853,416,20792,20793,20794,20795,20796,320,7852,20797,20798,20799],"class_list":["post-32496","post","type-post","status-publish","format-standard","has-post-thumbnail","category-microsoft","tag-azure","tag-azure-copilot","tag-copilot","tag-data-transfer","tag-dpia","tag-english-posts","tag-flex-routing","tag-mb-firstprivacyenglisch","tag-microsoft","tag-microsoft-copilot","tag-pb-international","tag-standard-contractual-clauses","tag-third-country"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/32496","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=32496"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/32496\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/32497"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=32496"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=32496"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=32496"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}