Power BI Copilot Under the EU AI Act: Why Business Analytics Is Not Annex III High-Risk

Probably minimal risk. In ordinary business intelligence use, Power BI Copilot generates report pages, writes and explains DAX measures, and produces natural-language narrative summaries over a semantic model your organisation already owns — none of which is an Annex III high-risk use case. The one realistic trap is a workflow question, not a tool question: if a generated narrative is relied on as an automated decision in a listed domain such as creditworthiness, the surrounding system can become high-risk.

This guide classifies Power BI Copilot in normal analytics use, names the single boundary worth watching, and sets out the deployer duties that apply even at minimal risk.

---

What Power BI Copilot actually does — and why that decides the risk tier

The EU AI Act (Regulation (EU) 2024/1689) classifies by use, not by vendor or product name. Article 6, read with Annex III, asks whether a specific deployment fits a listed high-risk use case — not whether the tool is "AI".

Power BI Copilot does three concrete things: it drafts report pages and visuals, it generates and explains DAX measures, and it produces narrative summaries over a governed dataset. That is business intelligence and reporting. Annex III covers eight areas — biometrics, critical infrastructure, education, employment, essential private and public services, law enforcement, migration, and justice and democracy — and "analytics over your own internal data" is not among them.

So the verdict is set up front. In normal use Power BI Copilot is a minimal-risk tool, with a narrow limited-risk overlay under Article 50 only where a generated narrative is presented externally as if it were human-authored.

---

Which EU AI Act risk tier does Power BI Copilot sit in?

Minimal risk: the default for dashboards, DAX and internal reporting

Drafting visuals, summarising sales trends, generating DAX, and producing internal management reports attract no mandatory obligation stack. This is the minimal-risk base tier the Act deliberately leaves unburdened. The Regulation neither bans nor documents these uses; it simply lets them run.

Limited risk (Article 50): when a generated narrative goes external

Article 50 transparency can apply where a Copilot-generated narrative is distributed externally and could be mistaken for human-authored analysis. The content-marking duties for generative-AI outputs arrive on 2 December 2026 under the Digital Omnibus, adopted by the European Parliament (16 June 2026) and the Council (29 June 2026). Until then, the duty is to disclose: tell the reader that the narrative is machine-generated.

Why this is not Annex III high-risk in ordinary BI use

Article 6(2) and Annex III only bite if the analytics output is used to make or materially influence a decision in a listed high-risk domain. Producing a report about your own business is not, by itself, any Annex III use case.

It is worth distinguishing Power BI Copilot from its neighbours. Microsoft 365 Copilot is productivity drafting across Office; Azure AI is a dozen distinct services, some of which (biometrics) are squarely Annex III. Power BI Copilot's specific shape is narrative-and-DAX generation over a governed dataset — and that shape is what keeps it minimal-risk by default. Several vendor risk frameworks default every "AI feature" to high-risk and work backwards; the Act runs the other way, starting from the use case and only attaching the high-risk stack where Annex III is actually engaged.

---

The one trap worth naming: when a generated narrative becomes an automated decision

The realistic risk is not the tool but the workflow. If a Copilot-generated narrative is fed directly into a high-risk decision — for example a creditworthiness assessment under Annex III point 5(b) — without proper classification, the surrounding system, not the BI tool, may become high-risk.

The Article 6(3) filter can keep a narrow, preparatory analytics step outside the high-risk tier where it does not replace or materially influence the human assessment and does not profile natural persons. But the deployer must document that reasoning, not assume it. A generated narrative summary should support, not substitute for, the human decision-maker. Treating a generated summary as determinative in credit, insurance pricing (Annex III point 5(c)), employment, or essential-services contexts is what changes the classification.

The care point is reuse: this is about your decision pipeline. Re-classify the end-to-end system against Article 6 — not the Power BI Copilot component in isolation.

---

Data governance over the semantic model: the real day-one work

Power BI Copilot answers over the underlying semantic model and datasets, so the practical control surface is dataset access, Row-Level Security (RLS), and workspace permissions — not document-library permissions as with a tenant-wide productivity assistant.

Poorly scoped dataset or RLS configuration means Copilot can surface figures to users who should never see them — and a natural-language query lowers the effort needed to ask for them. That is primarily a GDPR and access-control exposure rather than an AI Act breach in itself. Where personal data sits in the model, the GDPR processor relationship under GDPR Article 28 and your data-processing terms with Microsoft govern the processing; verify your data-residency settings rather than assume them.

Before broad rollout, the deployer's day-one work is concrete: scope dataset access and RLS, restrict workspace roles to the analysts who need them, document the data governance, and keep a dated record of the classification decision. None of this is the high-risk obligation stack — it is ordinary access hygiene that a generative interface makes more consequential.

---

Deployer duties that apply even at minimal risk

Article 4 AI literacy for analysts and report consumers

Article 4 AI literacy has applied since 2 February 2025 and applies regardless of risk tier. Analysts using Copilot must understand its limits — that generated DAX and narratives can be wrong and require verification before reliance. Document that the training happened.

Inventory and a dated classification record

Record Power BI Copilot in your AI register with its use, the risk-tier determination (minimal or limited), and the date. The absence of this record is the most common, most easily avoided gap.

Article 50 disclosure policy for external narratives

Build a short policy on which Copilot-generated narratives go external and how they are disclosed, ahead of the 2 December 2026 content-marking duties under the Digital Omnibus (adopted). Keep an Article 6(3) note on file for any analytics workflow that touches a high-risk decision, even where you conclude it stays out of scope.

---

Worked example: a 600-person consumer lender's BI and risk-reporting team

Northwind Credit (roughly 600 staff, EU-wide consumer lending) rolls out Power BI Copilot to its finance and risk-reporting analysts to summarise portfolio performance, generate DAX, and draft board narratives.

Most of this is minimal risk. Portfolio dashboards, arrears-trend narratives, and management reporting are ordinary business analytics, not an Annex III use case. Article 4 literacy and dataset governance are the live duties.

The boundary case: a credit-risk analyst asks Copilot to summarise an individual applicant's profile and that narrative feeds a lending decision. Now the surrounding workflow is potential Annex III point 5(b) creditworthiness — and, as a large company, Northwind cannot rely on the SME lower-of cap under Article 99(6).

Resolution: Northwind keeps Copilot for aggregate reporting (minimal risk, documented), ring-fences it from individual credit decisions, runs an Article 6(3) assessment on any borderline workflow, and classifies the credit-scoring system separately under Article 6 — with the relevant deployer obligations under Article 26 and the Article 27 Fundamental Rights Impact Assessment where it applies to credit deployers. The lesson generalises: the BI tool stays minimal-risk; the decision pipeline is where the analysis has to be done.

---

Power BI Copilot duty map at a glance

For context, Article 99 sets the penalty tiers, each the higher of a fixed sum or a percentage of total worldwide annual turnover: up to €35 million or 7% of total worldwide annual turnover, whichever is higher for Article 5 prohibitions (Article 99(3)); up to €15 million or 3% for most obligation breaches (Article 99(4)); and up to €7.5 million or 1% for incorrect or misleading information to authorities (Article 99(5)). Only for SMEs and start-ups does Article 99(6) flip each fine to the lower of the two figures; a larger company cannot rely on it.

The moved high-risk and content-marking dates flow from the Digital Omnibus, adopted by the European Parliament (16 June 2026) and the Council (29 June 2026).

---

How Confir helps

Add Power BI Copilot to the Confir register and answer the intake scenarios. The deterministic, rule-based engine derives the tier — minimal, limited (Article 50), or high-risk where a narrative feeds an Annex III decision — and shows the rule that fired in plain language. It is rule-based, not model inference: the same inputs produce the same finding every time, with no hallucination.

For ordinary BI use, the output is a short, dated, auditable record evidencing the minimal or limited-risk determination and Article 4 literacy coverage. Where an analytics workflow touches creditworthiness or another high-risk domain, Confir scopes the Article 26 deployer obligation set and, where it applies, the Article 27 FRIA — classifying the end-to-end system, not the BI component alone.

---

Related guides

• AI system inventory and register
• limited-risk and Article 50 transparency
• Article 4 AI literacy requirements
• Microsoft 365 Copilot under the EU AI Act
• Microsoft Azure AI services classification