Microsoft Copilot Studio and the EU AI Act: When Building an Agent Makes You the Provider
Copilot Studio lets staff build custom agents — and building one under your name can make your organisation the provider. Classify by purpose; govern shadow AI.
A business analyst spends an afternoon in Copilot Studio, wires a few connectors to an internal agent, and ships it to a team channel. No engineering ticket, no governance review. The catch most citizen developers miss: by building that agent and putting it into service under your organisation's name, you may have become its provider under the EU AI Act — with the obligations that role carries. Most internal agents are not high-risk, but this build-makes-you-provider mechanism applies regardless of tier, and it is the part the platform's ease of use hides.
What Copilot Studio is — and why the build step changes your legal role
Copilot Studio is a low-code builder for custom copilots and agents: business users assemble topics, connectors, knowledge sources, and actions on top of GPAI models supplied by Microsoft and OpenAI. That sets it apart from packaged Microsoft 365 Copilot — a finished tool you deploy — and from Azure OpenAI, a raw model API engineers build on. It sits in between: you are not writing model code, but you are assembling a distinct AI system.
That is the legal hinge. The underlying GPAI model obligations sit with Microsoft and OpenAI under Article 53 of Regulation (EU) 2024/1689. But the agent you build is a separate AI system: putting it into service under your own name or trademark can make your organisation its provider — the role defined in Article 3(3) and carrying the obligation set in Article 16, with no exception for low-code tooling. That mechanism is invisible to the non-engineer assembling the agent. On the model layer, though, you can relax: the GPAI provider obligations in Articles 51 to 55, in force since 2 August 2025, sit with the model maker, not with you.
Provider, deployer, or both? The role logic for a custom agent
Settle the role first. You are a deployer under Article 26 when you use a finished agent under your own authority. You become a provider under Article 16 when you develop an agent and put it into service under your own name or trademark — and assembling one from connectors and knowledge sources is still developing an AI system under the Article 3(3) definition.
The citizen-developer trap lives in Article 25. A deployer, distributor, or importer becomes a provider if it puts its name or trademark on a high-risk system, makes a substantial modification (defined in Article 3(23) as a change affecting compliance or a change of intended purpose), or modifies the intended purpose so that a system becomes high-risk. A business user who re-points an internal agent at a hiring or credit task triggers exactly this role-shift — usually without realising a legal line has moved.
One more duty applies to groups headquartered outside the EU: a provider of a high-risk system established outside the Union must appoint an EU authorised representative under Article 22. For most internal agents, though, none of this escalates — they stay deployer-side at minimal or limited risk, where the realistic duties are Article 4 AI literacy, Article 50 transparency where output reaches third parties, and ordinary data governance.
Classify the agent by purpose: a risk-tier table
Classify by what the agent does, not the platform. The table maps five example agents to tier, governing provision, actor, and headline duty.
| Example agent | Likely tier | Governing Article / Annex | Actor | Headline duty |
|---|---|---|---|---|
| Internal HR-policy Q&A bot | Minimal | None mandatory | Deployer | Data governance + Article 4 literacy |
| Customer-facing support chatbot | Limited | Article 50 | Deployer / provider | Disclose it is an AI system |
| CV-screening / candidate-ranking agent | High | Annex III point 4(a) | Provider (via Article 25) | Articles 9–15 stack |
| Consumer credit pre-scoring agent | High | Annex III point 5(b) | Provider (via Article 25) | Articles 9–15 stack |
| IT-ticket routing assistant | Minimal | None mandatory | Deployer | Data governance + Article 4 literacy |
Minimal-risk internal agents
Internal productivity and knowledge agents with non-consequential output carry no mandatory obligations beyond data governance and Article 4 AI literacy (in force since 2 February 2025).
Limited-risk: Article 50 transparency for agents that talk to people
An agent that interacts directly with natural persons must tell them they are dealing with an AI system, and any AI-generated synthetic content must be marked (Article 50). General application is 2 August 2026; the additional content-marking and watermarking detail lands on 2 December 2026.
High-risk: when an agent serves an Annex III purpose
An agent built for an Annex III purpose is presumptively high-risk under Article 6(2): screening or ranking candidates falls under Annex III point 4(a) (recruitment) or point 4(b) (in-employment), and scoring creditworthiness under Annex III point 5(b). The Article 6(3) filter can exclude an agent performing a narrow procedural or purely preparatory task that does not materially influence the outcome — but any system that profiles natural persons remains high-risk, full stop. Safety-component agents in critical infrastructure (Annex III point 2) are a real but narrow case; most business agents never touch it.
The high-risk deadline — plan against 2 December 2027
Stand-alone high-risk Annex III systems under Article 6(2) now apply from 2 December 2027, deferred from the original 2 August 2026 by the Digital Omnibus — adopted by the European Parliament (16 June 2026) and the Council (29 June 2026), entering into force on Official Journal publication expected before 2 August 2026.
The deferral is a set of fixed calendar dates; the "stop-the-clock" variant was rejected. And not everything is delayed: Article 5 prohibitions and Article 4 AI literacy (both since 2 February 2025), the GPAI obligations in Articles 51 to 55 (since 2 August 2025), and Article 50 transparency (2 August 2026) are all unaffected.
One niche note: if an agent is instead embedded as a safety component of an Annex I product, the route differs — Section A products (machinery, medical devices) take conformity assessment through the sectoral acts under Article 43(3), while for Section B products such as motor vehicles, Article 2(2) means only Article 6(1), Articles 102 to 109, and Article 112 apply directly, with substantive requirements reaching manufacturers through the amended sectoral framework rather than the stand-alone stack.
If your agent is high-risk: the provider obligations you inherit
A high-risk Copilot Studio agent pulls the full stand-alone provider stack: a risk management system (Article 9); data governance (Article 10); technical documentation following the Annex IV content set (Article 11); record-keeping and logging (Article 12); transparency and instructions to deployers (Article 13); human oversight (Article 14); and accuracy, robustness, and cybersecurity (Article 15).
Then come the pre-market steps: conformity assessment under Article 43 (most Annex III categories use internal control under Annex VI), an EU Declaration of Conformity under Article 47, and registration in the EU database under Article 49 before placing the agent on the market; after launch, post-market monitoring under Article 72 and serious-incident reporting under Article 73 apply. Do not mistake Microsoft's platform attestations for your conformity assessment — their documentation covers Microsoft's obligations, not the agent you assembled. The agent's compliance is yours as provider.
The penalties anchor why this matters. Breach of high-risk obligations carries up to €15 million or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)); prohibited practices under Article 5, up to €35 million or 7% (Article 99(3)); supplying incorrect or misleading information to authorities, up to €7.5 million or 1% (Article 99(5)). SMEs and start-ups are capped at the lower of the fixed amount and the percentage (Article 99(6)); larger organisations are not.
Data governance and shadow AI: the operational risk citizen development creates
Low-code means agents proliferate without central sign-off — the classic shadow-AI problem. Connectors and knowledge sources can surface data the agent's audience was never meant to see: a GDPR and data-governance exposure for any agent, and a direct Article 10 failure for a high-risk one. Article 26 deployer diligence and Article 4 AI literacy also require that staff building and operating agents understand their capabilities, limits, and appropriate use — and that you document the training.
The practical control is a register: one entry per agent, capturing purpose, audience, connectors and knowledge sources, risk-tier determination, and date. Re-classify whenever a business user changes an agent's purpose, because the Article 25 re-purposing trigger lives exactly there — and that turns an invisible role-shift into a caught one.
Worked example: a 600-person insurer's claims-assistant agent
Meridian Mutual, a 600-employee EU insurer, lets its operations team build a Copilot Studio agent in an afternoon to answer policyholder claims questions. As built it is clearly limited risk: the only duty is Article 50 disclosure that the policyholder is talking to an AI system.
Three months later a business analyst, no engineering involved, adds a connector so the agent suggests claim-approval likelihood and flags applicants. That re-purposing pushes the agent into life and health insurance risk-assessment territory (Annex III point 5(c)), and the in-effect role-shift under Article 25 makes Meridian the provider of a high-risk system.
The consequence is the full provider stack from the previous section, plus the Article 99(4) exposure of up to €15 million or 3% of total worldwide annual turnover. At 600 staff Meridian would not qualify as an SME, so the Article 99(6) cap does not apply. The danger was never the platform but ungoverned purpose-change by a non-engineer.
How Confir helps
Register each Copilot Studio agent in Confir and answer the intake scenarios. The deterministic, rule-based engine — no model inference, no hallucination — derives the tier (minimal, limited, or high), the role (deployer or provider, including the Article 25 re-purposing path), and the obligation set that follows, producing a dated, reproducible classification record. Re-running the intake when an agent's purpose changes surfaces the role-shift before a regulator does. The GPAI provider workflow (Articles 51 to 55) is partial and on the roadmap.
Frequently asked questions
Does building an agent in Copilot Studio make my organisation the provider under the EU AI Act?
Often, yes. Copilot Studio lets you assemble a distinct AI system — your agent — on top of Microsoft and OpenAI models. Putting it into service under your own name meets the provider definition in Article 3(3) and carries provider obligations under Article 16; there is no "we only used low-code" exception. The GPAI model obligations stay with Microsoft and OpenAI under Article 53; the agent itself is yours.
Is a Copilot Studio agent automatically high-risk?
No. Most internal agents — knowledge search, FAQ bots, IT-ticket triage — are minimal risk, with no mandatory obligations beyond data governance and Article 4 AI literacy. An agent that talks to people triggers Article 50 transparency. High-risk applies only when the agent serves an Annex III purpose, such as screening candidates (point 4) or scoring creditworthiness (point 5(b)). Classify by purpose, not platform.
How does changing an agent's purpose change my obligations?
This is the citizen-developer trap. Under Article 25, a deployer becomes a provider if it makes a substantial modification (defined in Article 3(23)) or modifies the intended purpose so a system becomes high-risk. A business user re-pointing an internal agent at a hiring or credit task can convert your organisation into the provider of a high-risk system overnight. The defence is governance: re-classify every agent whenever its purpose changes.
When do Article 50 transparency rules apply to my agent?
Article 50 applies from 2 August 2026. Any agent that interacts directly with natural persons must clearly tell them they are dealing with an AI system, and AI-generated synthetic content must be marked; additional content-marking and watermarking detail lands on 2 December 2026. Build the disclosure into the agent's interface, not a generic platform disclaimer.
What is the compliance deadline for a high-risk Copilot Studio agent?
Stand-alone high-risk Annex III systems under Article 6(2) now apply from 2 December 2027, deferred from the original 2 August 2026 by the Digital Omnibus, adopted by the European Parliament and the Council in June 2026 and entering into force on Official Journal publication expected before 2 August 2026.
What are the fines if a high-risk agent is non-compliant?
Breach of high-risk and most other obligations carries up to €15 million or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)). Prohibited practices under Article 5 carry up to €35 million or 7% (Article 99(3)), and supplying incorrect or misleading information to authorities up to €7.5 million or 1% (Article 99(5)). SMEs and start-ups are capped at the lower of the two (Article 99(6)); larger organisations are not.
Do I take on the GPAI obligations by using Copilot Studio?
No. The GPAI provider obligations in Articles 51 to 55 — technical documentation, downstream information, copyright policy, and training-data summary under Article 53, plus systemic-risk duties — sit with Microsoft and OpenAI as the model providers, in force since 2 August 2025. You build on their model; your obligations attach to the agent you assemble and its purpose.
Related guides
- AI inventory and tool classification hub
- Microsoft 365 Copilot deployer duties
- Azure OpenAI provider obligations
- detecting shadow AI across the organisation
- limited-risk and Article 50 transparency
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →