Microsoft 365 Copilot now supports Anthropic Claude Sonnet and Opus alongside OpenAI GPT as selectable models. For EU organisations, there is a critical decision attached: Claude processes data outside the EU Data Boundary. What you need to know and which admin step is required.
Microsoft 365 Copilot has been running on OpenAI models for two years. That is changing step by step. Since early 2026, users can switch between GPT models and Anthropic Claude in the model selector of Copilot Chat. Not as an experiment, but as production capability for licensed Copilot users. Claude Sonnet is available for general tasks, Claude Opus for deep analysis and reasoning.
For IT administrators in the EU, this is not a functional upgrade that can be silently rolled out. Behind the model choice lies a data protection question that demands attention: Claude processes data outside Microsoft's infrastructure and outside the EU Data Boundary. That requires a deliberate organisational decision, not just a technical setting.
Until recently, the model in Copilot Chat was a given. Microsoft chose, the user followed. With the expansion to Anthropic, Microsoft has introduced a model selector visible in the Copilot Chat interface: users click the model name and choose GPT, Claude Sonnet, or Claude Opus.
The choice is not limited to Copilot Chat. Claude Opus is currently rolling out to Copilot in Excel, and the Researcher agent, the workhorse for deep research within Microsoft 365 Copilot, already uses a combination: OpenAI GPT to draft a response, Anthropic Claude to verify and refine it. That makes the multi-model approach not just a user preference but an embedded architectural choice by Microsoft.
Adding Anthropic Claude is not a marketing move. The models currently complement each other. Claude Opus performs strongly on tasks requiring extensive context, such as analysing longer legal documents, financial reports, or technical specifications, and on structured output where step-by-step reasoning is needed. Claude Sonnet is broadly applicable, fast, and handles text fluently.
GPT models remain strongest in scenarios deeply integrated with Microsoft Graph: email summarisation, calendar analysis, search over organisational data, and composing messages with context from Teams or SharePoint. Those who centre these integrations will notice little difference. Those who use Claude for analytical tasks outside the M365 work environment can leverage that advantage.
This is the critical point for European organisations. Anthropic does not process data on Microsoft's Azure infrastructure but on its own servers in AWS and GCP datacentres, primarily in the United States. That means every prompt processed via Claude leaves Microsoft's EU Data Boundary.
Microsoft formally designated Anthropic as a subprocessor as of January 2026. That provides legal structure: Anthropic is contractually bound by Microsoft's Data Processing Addendum, may not use customer data to train models, and falls under Microsoft's processor obligations. But subprocessor status does nothing to change the physical location of processing. Organisations with strict contractual obligations to keep data in the EU cannot use Claude in its current configuration.
For EU and UK tenants, Microsoft has responded by disabling Claude by default. Without an active decision by an administrator, Claude is not available to users in these regions. That is a deliberate deviation from the default settings for other global regions.
Since 3 April 2026, Microsoft has added a new setting to the Microsoft 365 admin centre that allows EU and UK administrators to enable Claude manually. The setting is called 'Copilot in Microsoft 365 apps with Anthropic models' and can be found under Settings, then Copilot, then the section for AI providers or additional language models.
Activating the setting indicates consent that data from users who select Claude will be processed outside the EU by Anthropic. The decision must be made deliberately, documented, and aligned with the data protection officer or privacy lead within the organisation.
Not activating the setting keeps Claude out of reach for users. GPT models via Azure remain the only option, and those fall within the EU Data Boundary. For organisations that place data localisation high on the agenda, or that operate in regulated sectors such as healthcare, finance, or government, this is the most prudent route.
The GDPR prohibits transfer of personal data to countries outside the EEA unless appropriate safeguards are in place. Microsoft relies on Standard Contractual Clauses arranged via the DPA, supplemented by Anthropic's subprocessor status. That construction is legally defensible but not uncontested, comparable to the ongoing debate around Microsoft's own cloud processing in the US.
Concretely: if Claude in Copilot is used for tasks involving personal data inputs, such as CV analysis, customer correspondence, or HR files, the organisation incurs a processing risk that must be included in a data protection impact assessment. For tasks involving non-personal data, internal reports, product texts, technical documentation, the risk is considerably smaller.
A pragmatic framework for the decision. Enabling Claude makes sense for teams working on deep analysis of public or non-personal information, technical or creative tasks where model choice makes a quality difference, and pilots within innovation or R&D departments that are deliberately experimenting with AI models.
Claude is better left disabled for HR processes, legal files containing personal data, financial processing of customer information, and environments where contracts or industry standards contain explicit EU data residency obligations. Draft an internal policy for both scenarios that specifies which models are permitted for which task types.
Three steps for the coming weeks. First, check the current setting in the Microsoft 365 admin centre. Is 'Copilot in Microsoft 365 apps with Anthropic models' active or not? If you have not deliberately enabled it and manage an EU tenant, it is off by default. Verify this anyway, as changes in Microsoft policy can adjust default settings.
Second, discuss the data protection trade-off internally. Connect the IT administrator with the data protection officer or legal team for a brief impact assessment. The question is straightforward: do we have task types for which Claude adds value and where no personal data is entered? If so, is the opt-in defensible?
Third, draft a model usage policy as part of your AI governance documentation. Which models are available, for which task types, and who is responsible for incident reporting if someone inadvertently enters sensitive data. This does not need to be an extensive document, but it must exist.
Microsoft's multi-model strategy is not yet complete. The expectation is that more models will be added to the selector in the second half of 2026, possibly including open-source options. The governance you establish now is therefore not one-off but structural. Want help drafting an AI usage policy, reviewing your Copilot settings, or training your IT team on model choice and data protection? Contact Zarioh.
Zarioh Digital Solutions
IT specialists from Utrecht, the Netherlands. We help businesses with Microsoft 365, AI agents, hosting and telephony — and share what we learn in practice. Follow us on LinkedIn
