Microsoft’s Copilot for Legal writes into records legal teams already govern

Editor’s Note: Microsoft’s Oct. 15 release of over 20 legal skills for Copilot moves drafting, contract review and matter work into Word and Cowork, and names 25 partners whose plugins are beginning to roll out, including Everlaw and Relativity. Approved redlines land as tracked changes in the document. Microsoft’s general Copilot documentation says the prompts and responses behind Copilot work are kept in a hidden mailbox folder that eDiscovery tools can search, and that their permanent deletion is suspended while the mailbox is under a Litigation Hold or eDiscovery hold. Those pages describe Copilot as a whole and do not mention the new legal skills by name.

For cybersecurity, data privacy, regulatory compliance and eDiscovery professionals, that turns a productivity launch into a records, retention and privilege question. Cowork transcripts and scheduled prompts sit in eDiscovery scope, Copilot memory follows its own retention rules, and partner plugins run under their providers’ own controls. Three federal rulings this year reached different results on AI-generated materials, and none decided whether enterprise terms preserve privilege.

Microsoft demonstrates the skills in an Oct. 22 webinar. Legal operations teams should settle plugin access and approvals, retention locations and hold language before lawyers begin delegating work.

News Analysis – eDiscovery Beat

Microsoft’s Copilot for Legal writes into records legal teams already govern

ComplexDiscovery OÜ Staff

When a lawyer approves a redline from Microsoft’s new legal skills, Word enters it as a native tracked change inside the contract. Microsoft’s general compliance documentation for Copilot says the request behind that edit goes somewhere else: a hidden folder in the user’s own Exchange mailbox that eDiscovery tools can search.

That split is the part of Microsoft’s Oct. 15 launch that matters most to the people who preserve, collect and defend legal work. Microsoft announced general availability of over 20 purpose-built legal skills in Microsoft Copilot, working in Word and in Cowork, its agentic workspace. It also named 25 partners whose plugins are beginning to roll out through its plugin registry, among them the eDiscovery platforms Everlaw and Relativity.

What Microsoft shipped on Oct. 15

The skills grow out of Legal Agent, which Microsoft released to its Frontier early-access program in April, and they arrive as two plugins, one for Copilot in Word and one for Cowork. In an Oct. 15 post on the Microsoft Community Hub, the company sorted the new capabilities into five areas. They cover drafting from approved precedents, reviewing agreements against playbooks, tracking obligations and deadlines, turning research into guidance, and moving matters forward with chronologies and formal minutes.

Microsoft describes Work IQ as an intelligence layer linking Copilot to an organization’s knowledge and work. The layer reaches “the matters, standards, and information behind the work, not just the document in front of it,” the company said. For an information governance team, that sentence is a statement of scope, because the context Copilot draws on is meant to extend past the open file.

The company offered self-reported usage figures from the Frontier period. Since April, it said, over 1,800 users generated nearly 100,000 edits and kept roughly seven in ten of the suggestions. Microsoft separately cited internal evaluations scoring the edits above 90 percent on fluency, above 95 percent on conciseness and above 85 percent on relevance. It did not say how many edits were evaluated or how the three measures were defined.

Microsoft’s transparency documentation for the legal skills adds limits the launch post does not mention. It says outputs may be inaccurate or incomplete, including citations, and that Copilot is not jurisdiction-aware by default. Bob Ambrogi of LawSites noted that Microsoft released no results on any independent legal benchmark. By his count, Microsoft is the fourth major artificial intelligence company in five months to launch a dedicated legal offering, after Anthropic in May, Google in August and OpenAI in September. He also observed that the partner list leaves out Westlaw, CoCounsel and LexisNexis, with Thomson Reuters present only through HighQ.

Where the work product lands

Those partner names will draw the market’s attention, but the first records questions start inside Word. Microsoft says Copilot works out the change a clause needs and Word records it as a native tracked change, and that nothing is applied until the user approves it. Its transparency page adds that Copilot works inside documents that already carry tracked changes, keeping prior revisions separate from its new proposals. Neither the announcement nor the transparency page says how Copilot’s revisions are attributed in a document’s revision history, a detail that matters to any team that relies on revision metadata in a contract dispute.

The transparency page also says the legal skills run within the Microsoft 365 security, compliance and governance controls an organization already uses for legal documents and standards. Microsoft’s general Copilot documentation describes how those controls treat Copilot interactions. When a user works with Copilot in apps such as Word, Microsoft stores the prompt and the response, “including citations to any information used to ground Copilot’s response,” according to its privacy documentation, last updated Aug. 18, 2026. Microsoft’s Purview retention guidance, last updated in September 2025, places that data in a hidden mailbox folder. The folder “isn’t designed to be directly accessible to users or administrators,” the guidance says, but compliance administrators can search it with eDiscovery tools.

Microsoft’s two product-specific pages for the legal skills, an administration page and the transparency page, do not describe where interactions are stored, and the general pages do not mention the legal skills by name. The general pages therefore describe Copilot interactions as a class rather than the new plugins specifically. They remain the company’s public account of where Copilot work is kept, and they carry three points for anyone managing holds. First, permanent deletion is suspended when the mailbox is under a Litigation Hold or an eDiscovery hold, among other conditions. Second, a chat that vanishes from the user’s screen proves nothing about deletion, because Microsoft warns that messages visible in AI apps “are not an accurate reflection” of whether they are retained. Third, by Microsoft’s own example, a delete-only policy set to one day could need 16 days to clear an item from eDiscovery searches.

Copilot memory runs on separate rules. Microsoft’s memory documentation, last updated Sept. 2, says saved memories remain until the user deletes them, even if the chat that produced them is deleted. Information Copilot infers from chat history works differently: it is removed from Chat History details within seven days after a user deletes every chat in which it appeared. The same page says Purview retention policies and labels do not apply to Copilot memory and that memory actions generate no Purview audit log entries, though saved and inferred memories are searchable in eDiscovery. A Sept. 24 Microsoft 365 Message Center notice describes retention for inactive memory versions rolling out from late September, with completion expected by mid-October, so teams should confirm which behavior their own tenant shows.

Cowork widens the collection

Memory sits beside the chat record, and Cowork adds whole files to the collection. Cowork is where the legal skills handle multi-file work, such as tracking obligations across a contract portfolio or building a case chronology. Microsoft documents its compliance support separately, because work that runs long and spans many steps “can result in different behaviors and feature support.” The Purview page for Cowork, last updated Sept. 30, 2026, lists four categories in scope for eDiscovery: full conversation transcripts, files Cowork created and saved to the user’s OneDrive, scheduled prompts with the conversations each run produced, and uploaded files retained in OneDrive or the conversation.

The same page lists typical audit events, including a user adding, removing or sharing a skill or plugin. It marks two Purview capabilities as unsupported for Cowork interactions: data classification and Compliance Manager. Cowork activity also appears in activity explorer but not on the Apps and agents dashboard or the AI observability page, so teams that watch AI use through those two views will need to look elsewhere for Cowork.

Two governance details belong in any defensibility memo. When Cowork builds new Word, PowerPoint or Outlook content from sources carrying sensitivity labels, the highest-priority sensitivity label carries over. A user can always replace that inherited label, however, and can remove it where labeling is not mandatory. Separately, under an auto-apply retention label policy for cloud attachments, Microsoft says, the file version retained is the one that existed when Cowork referenced the file, not whatever the file later became.

The partner plugins answer to their own rules

Everything above concerns content Microsoft holds. Microsoft’s announcement says Copilot handles prompts and responses inside the Microsoft 365 service boundary, respects sensitivity labels and keeps prompts, responses and documents out of foundation-model training. That statement describes Copilot’s own processing. Microsoft’s developer guidance for plugins, last updated Sept. 30, 2026, covers the other half: Microsoft services enforce access boundaries for data stored in them, while “externally hosted services remain responsible for enforcing their own identity, permission, privacy, and compliance requirements.”

The privacy documentation spells out what crosses that line. When Copilot calls an agent, one of the components a plugin can contain, it sends a query that, in Microsoft’s words, “is based on the user’s prompt, Copilot activity history, and data the user has access to in Microsoft 365.” Microsoft tells customers to check each agent’s privacy statement and terms of use, and its transparency page cautions that information from third-party connectors may be inaccurate or incomplete. The privacy page also says Anthropic’s models, offered through Anthropic as a subprocessor, currently sit outside the EU Data Boundary. Because the announcement does not say which models power the legal skills, European teams should check their own tenant configuration.

Security teams have their own reason to read the developer guidance. Microsoft warns that when an agent’s custom actions draw on untrusted content, inbound email and support tickets among its examples, a crafted payload could steer the agent, even into invoking actions. It advises against giving such agents sensitive operations without careful human intervention. The warning addresses declarative agents generally rather than the legal skills, but Microsoft describes Cowork’s legal work as running across agreements, emails, meetings and files, which earns the question a place in any pre-deployment security review.

Both eDiscovery partners announced Model Context Protocol integrations with Copilot weeks before the launch. Everlaw said Sept. 2 that its integration was live in the Copilot connectors gallery and applies Everlaw’s own permissions, so an assistant sees only what the authenticated user can see. Data is accessed on demand rather than copied into a separate long-term store, the company said. Relativity’s Aug. 31 announcement, made when its platform was still called RelativityOne, described orchestration and reporting work, such as standing up workspaces, organizing case data and analyzing workspace access.

“This accelerates administration, while aiR continues to transform the high-stakes legal work that demands deep context, and tight governance stays in RelativityOne,” said Chris Brown, Relativity’s president. At the time, aiR was the name of the platform’s AI capabilities; on Sept. 16, Relativity renamed the platform itself Relativity aiR. Read together, the two companies describe governance staying on their own platforms. A Copilot answer drawing on Everlaw evidence is a different matter. Under Microsoft’s general documentation, the response text and references become part of the Copilot interaction it stores, while the underlying record, in Everlaw’s words, “remains governed in Everlaw.”

Privilege questions the product cannot settle

Knowing where AI work lives is only half of a defensibility answer, because storage does not decide whether that work is protected. On that question, three federal rulings this year reached different results on different facts.

In United States v. Heppner, Judge Jed S. Rakoff of the U.S. District Court for the Southern District of New York ruled from the bench Feb. 10, 2026, and followed with a written opinion filed Feb. 17. He held that about 31 documents memorializing a criminal defendant’s exchanges with Anthropic’s Claude platform were neither privileged nor work product. The court found Claude is not an attorney, the defendant had no reasonable expectation of confidentiality in light of the privacy policy Claude users accept, and he used the tool on his own initiative rather than at counsel’s direction.

The same day as the bench ruling, Magistrate Judge Anthony P. Patti of the Eastern District of Michigan reached a different result in Warner v. Gilbarco. He denied most of the defendants’ motion to compel as untimely. In the alternative, he held that a pro se plaintiff’s materials on her use of AI tools were not discoverable under the rule shielding litigation preparation materials, and were not relevant or, if marginally relevant, not proportional. Even if they were discoverable, he added, they were protected work product. Her use of ChatGPT did not waive that protection, he wrote, because generative AI programs are tools rather than persons.

On March 30, Magistrate Judge Maritza Dominguez Braswell of the District of Colorado followed Warner on work product for a pro se plaintiff in Morgan v. V2X, distinguished Heppner and amended the case’s protective order. The AI provision the court wrote bars parties from putting information designated confidential into an AI platform unless the provider is contractually prohibited from two things: storing or using inputs to train or improve its model, and disclosing inputs to third parties except where essential to delivering the service. Any third party that does receive inputs for that purpose must be bound by obligations at least as protective. The provider must also contractually allow deletion of confidential information on request, and a party relying on those terms must keep written documentation of them. The court said the provision would, at least for now, bar most, if not all, mainstream low-cost and no-cost AI from processing confidential information, and it noted that enterprise-tier accounts meeting those terms may be available only through organizational procurement.

Morgan governs a protective order in one case rather than privilege, but it is the only one of the three to set contractual conditions an AI provider must meet before confidential material can be submitted. Neither Heppner nor Warner addressed enterprise data-protection terms of the kind Microsoft sells. Curtis D. Heckman and three colleagues in Orrick’s eDiscovery and Information Governance group wrote in a client alert days before Morgan that part of Rakoff’s analysis turned on a consumer privacy policy. Enterprise platforms with negotiated confidentiality terms “may present a different picture, though this has not been tested in court,” they wrote. Paul, Weiss, in its own client memorandum, described the state of the law as unsettled.

What legal operations teams can do before the webinar

Microsoft will demonstrate the skills in an Oct. 22 webinar, and the configuration questions are better settled before lawyers start delegating work. Deployment differs by surface. Microsoft’s administration page for the legal skills says the Word plugin is enabled by default in Word desktop for commercial Microsoft 365 Copilot subscribers, with access governed by a policy named “Legal Skills in M365 Copilot in Word.” In Cowork, users must add the plugin themselves, and administrators govern it on the Agent Tools page.

Retention comes next. Microsoft’s Cowork guidance points retention policies to the location called Microsoft Copilot Experiences, and a team should confirm that location is covered rather than assume an older Teams chat policy still reaches it. Hold notices and collection templates should name Copilot activity explicitly, because Microsoft’s eDiscovery guidance offers a Copilot activity condition that includes all Copilot and other AI app interactions in a custodian’s mailbox.

The Cowork audit events for adding a skill or plugin help administrators see which partner tools a custodian added in Cowork. Those records can point a legal hold team toward outside platforms that may need separate preservation inquiries, though an installation record alone does not show what data, if any, passed through them. Records created in Copilot and records kept by a partner platform may each need their own assessment.

Microsoft’s plugin planning guidance asks builders to record, for each data flow, the owner, destination, retention and deletion behavior. The same exercise works for buyers deciding which partner plugins to approve, and the AI provision in Morgan shows one court’s version of the contract questions to ask. Where lawyers direct staff or clients to use the skills on a matter, Heppner is a reason to write that direction down, since the absence of counsel’s direction weighed against protection there.

By Microsoft’s account, Copilot creates these records automatically, but keeping them defensible still takes the right policies and holds. The question for the next dispute is narrower and harder: when opposing counsel asks for the prompts behind a contract’s revisions, will your team already know where they are, who can see them and whether they are protected?

News sources

• Introducing Microsoft Copilot for legal (Microsoft)
• Manage Copilot for legal (Microsoft Learn)
• Copilot for Legal: Transparency Documentation (Microsoft Support)
• Data, Privacy, and Security for Microsoft Copilot (Microsoft Learn)
• Learn about retention for Copilot and AI apps (Microsoft Learn)
• Search for and delete AI application data in eDiscovery (Microsoft Learn)
• Manage Copilot personalization and memory (Microsoft Learn)
• MC1478965: Microsoft Purview: Data Lifecycle Management: Retention for Copilot Memory (Microsoft 365 Message Center via M365 Message Center Archive)
• Use Microsoft Purview to manage data security & compliance for Microsoft 365 Copilot Cowork (Microsoft Learn)
• Plan Data, Privacy, and Security for Microsoft 365 Copilot Extensibility (Microsoft Learn)
• United States v. HEPPNER, 1:25-cr-00503 (U.S. District Court for the Southern District of New York via Midpage)
• Warner v. Gilbarco, Inc ., 2:24-cv-12333 (U.S. District Court for the Eastern District of Michigan via Midpage)
• Morgan v. V2X, Inc., Order, Civil Action No. 25-cv-01991-SKC-MDB (U.S. District Court for the District of Colorado)
• Morgan v. V2X, Inc., 1:25-cv-01991 (CourtListener)
• Everlaw and Microsoft Copilot Announce New MCP Integration (Everlaw)
• Relativity Brings Powerful Legal Data Intelligence to Microsoft Copilot, Expanding AI Assistant Support for Legal Teams (Relativity via PR Newswire)
• RelativityOne Is Now Relativity aiR: The AI Platform for Legal Data Intelligence (Relativity)
• Microsoft Launches Copilot for Legal, Becoming the Fourth AI Giant in Five Months to Build Out a Legal Vertical (LawSites)
• Microsoft introduces Copilot for legal with circa 20 purpose-built legal skills (Legal IT Insider)
• Court Rules AI Conversations Are Not Privileged: What United States v. Heppner Means for You (Orrick)
• Paul Weiss Discusses Court Decisions on Whether AI-Generated Materials Warrant Work Product Protection (Paul, Weiss via CLS Blue Sky Blog)
• Still in the Blast Zone: A New Ruling Deflects Some of the Privilege Bomb’s Shrapnel, But Businesses Still Need to Suit Up (Ward and Smith)

Assisted by GAI and LLM Technologies

Additional reading

• Cooley and Google Cloud are building a court-filing redaction agent without a published error rate
• Relativity’s 2028 Server exception meets a Riyadh deployment outside its cloud region table
• Confidence cools, commitment holds: full results from the 1H 2026 eDiscovery Business Confidence Survey
• Complete look: ComplexDiscovery OÜ’s 2025 to 2030 eDiscovery market size mashup
• The workstream of eDiscovery: Considering processes and tasks

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more understandable for practitioners, policymakers, and business leaders.