IntelligentHQ
IntelligentHQ
Skip to content

Government and public sector

How public bodies use Microsoft technology: measured Copilot trials, data classification with Purview before AI, government and sovereign cloud options, and the CJIS and EU AI Act duties that apply.

Try the Copilot Readiness Check

The problem

Public bodies must show evidence before spending on AI. The UK Government ran a cross-government experiment with 20,000 Microsoft 365 Copilot licenses across 12 organizations to test effects on satisfaction, effort, quality and time.

Data governance is often fragmented. At the County of Kern in California, each department ran its own IT, and the county had to meet HIPAA, CJIS and more than 20 other regulations, so leaders wanted to limit oversharing and data loss before deploying Copilot.

Some workloads carry strict residency and access rules. Criminal justice information in the United States must be stored and processed in the country and protected under the FBI's CJIS Security Policy, and many governments now ask where data is processed and who can reach it.123

The approach

Microsoft's government page frames its offer around public-facing services, the government workforce, AI-driven decisions and data protection, across transportation, public finance, social services and public health, and public safety and justice. For stricter residency and control needs, the page points to Microsoft Cloud for Sovereignty; Microsoft's June 2025 announcement describes its Sovereign Public Cloud as an evolution of that offering, alongside a Sovereign Private Cloud on Azure Local and national partner clouds such as Bleu in France and Delos Cloud in Germany. For US criminal justice data, Microsoft lists Azure Government, Dynamics 365 U.S. Government and Office 365 U.S. Government as in scope for CJIS.

The UK experiment is a model for evidence: users reported saving 26 minutes a day on average, a self-reported figure built from range midpoints, and the report states that human oversight was required at all times and that the tool struggled with nuanced, context-heavy or data-heavy work. Kern County shows the order of work: it licensed Microsoft 365 Government G5, applied automatic sensitivity labels, data loss prevention and eDiscovery with Microsoft Purview, adopted Security Copilot for alert triage, and then planned about 400 Copilot licenses with access reviews and training.

Not every department needs paid Copilot. Given the UK findings on nuanced work, casework that depends on line-of-business systems may gain more from fixing data and process first, while drafting-heavy teams are the natural starting point.12345

Conceptual architecture

Government and public sector: conceptual architectureCopilot & businessappsSecurity, identity &governanceCloud & hybridinfrastructurePrograms & resourcesStaff assistance in Microsoft 365 Copilot: Drafting, summarizing and meeting supportStaff assistance inMicrosoft 365 CopilotData classification, data loss prevention and eDiscovery (Microsoft Purview): Limits oversharing before AI can reach filesData classification, dataloss prevention and…Alert triage with Microsoft Security Copilot: Speeds investigation of data protection alertsAlert triage with MicrosoftSecurity CopilotTenant in the right environment (commercial, US government, sovereign or national partner cloud): Sets residency, screening and access boundariesTenant in the rightenvironment (commercial, US…Sovereign private cloud on Azure Local for restricted workloads: Hybrid or air-gapped hosting where public cloud is not allowedSovereign private cloud onAzure Local for restricted…Trial evaluation: surveys, usage data and focus groups: Evidence for or against wider rolloutTrial evaluation: surveys,usage data and focus groups
Diagram as a list

  1. Copilot & business apps

    • Staff assistance in Microsoft 365 CopilotDrafting, summarizing and meeting supportConnects to Trial evaluation: surveys, usage data and focus groups

  2. Security, identity & governance

    • Data classification, data loss prevention and eDiscovery (Microsoft Purview)Limits oversharing before AI can reach filesConnects to Staff assistance in Microsoft 365 Copilot
    • Alert triage with Microsoft Security CopilotSpeeds investigation of data protection alertsConnects to Data classification, data loss prevention and eDiscovery (Microsoft Purview)

  3. Cloud & hybrid infrastructure

    • Tenant in the right environment (commercial, US government, sovereign or national partner cloud)Sets residency, screening and access boundariesConnects to Data classification, data loss prevention and eDiscovery (Microsoft Purview)
    • Sovereign private cloud on Azure Local for restricted workloadsHybrid or air-gapped hosting where public cloud is not allowed

  4. Programs & resources

    • Trial evaluation: surveys, usage data and focus groupsEvidence for or against wider rollout
Conceptual: one common way to arrange the parts, not a required design.

Technologies and their roles

  • Microsoft 365 Copilot1

    Staff assistant under evaluation

    Used in the UK cross-government experiment with 20,000 licenses (the app is now named Microsoft Copilot).

  • Microsoft Purview2

    Data protection before AI

    Kern County classified data with automatic labels and enforced DLP and eDiscovery with Purview before planning Copilot.

  • Microsoft Security Copilot2

    Alert triage

    Kern County uses Security Copilot to speed triage and provide automated insights within Purview.

  • Azure Local5

    Sovereign private cloud

    Microsoft's Sovereign Private Cloud runs collaboration and virtualization workloads on Azure Local for hybrid or air-gapped needs.

What you need first1

  • Licensing in the right cloud environment for the data involved
  • Data classified and labeled, with oversharing reviewed, before Copilot is enabled
  • An evaluation design combining surveys, usage data and focus groups
  • Records management and freedom of information processes that cover AI-generated content
  • Engagement with staff representatives on how saved time is used

Risks and how to reduce them

CJIS requirements for criminal justice information3
Use the government clouds Microsoft lists for CJIS, confirm your state's CJIS agreement, and meet MFA, encryption and US data location requirements in CJIS Security Policy v6.1.
High-risk AI under the EU AI Act6
Law enforcement, migration, border control and justice uses are listed as high-risk; Annex III obligations apply from 2 December 2027, so plan human oversight and logging now.
Oversharing through Copilot2
Classify and label data and set DLP policies first, as Kern County did across more than 13 million files.
Self-reported benefits1
The UK 26 minutes a day is a self-reported estimate; publish method and limits with any internal figure.

Documented examples

Related

Sources

  1. Microsoft 365 Copilot Experiment: Cross-Government Findings Report (opens in a new tab)Government Digital Service (GOV.UK) · Customer-reported
  2. Customer story: County of Kern (Microsoft Purview) (opens in a new tab)Microsoft · Customer-reported, Vendor-reported
  3. Criminal Justice Information Services (CJIS) Security Policy - Microsoft Compliance (opens in a new tab)Microsoft · Vendor-reported
  4. Government Solutions | Microsoft AI (opens in a new tab)Microsoft · Vendor-reported
  5. Announcing comprehensive sovereign solutions for European organizations (Official Microsoft Blog, 16 June 2025) (opens in a new tab)Microsoft · Vendor-reported
  6. AI Act: regulatory framework for AI (opens in a new tab)European Commission · Independently verified

Fill out the form below to request your copy.

Name(Required)