A core part of compliance management in Microsoft Purview is the use of regulatory templates. The purpose of these templates is to help organizations establish and document compliance with relevant laws, regulations and standards. A regulatory template consists of a set of improvement actions derived from a specific law or standard. By implementing these improvement actions, the organization can demonstrate compliance.
Compliance Manager now offers ready-to-use templates for over 360 regulations, and the list grows as new laws and standards are adopted. Only the Microsoft Data Protection Baseline is included at every subscription level. Everything else is designated premium and requires a license.
How the Regulations page is organized
The templates are grouped under four headings, and knowing which is which saves some confusion:
- Included templates — the Microsoft Data Protection Baseline, available to everyone and consuming no license
- Premium AI templates — four templates covering AI regulation, which I come back to below
- Premium templates — all other global, regional and industry regulations
- Sub-service compliance readiness — for assessing your compliance posture before deployment, currently in preview, and it does not consume a license
Each template also comes in a universal version, which provides general control mapping that can be applied broadly to services. Universal templates require manual implementation and testing. Note that GCC Moderate, GCC High and Department of Defense customers cannot use them.
E5 subscribers get up to three premium templates
Depending on your licensing agreement, your organization may be able to use up to three premium regulatory templates at no additional cost. Only the admins who actually work with compliance management need such licenses.
You can verify this under Compliance Manager, Regulations. The counter near the top shows templates used out of templates you are eligible for. A counter reading 2/5 means two activated out of five available. A counter reading 5/2 means the opposite problem: you are over your limit and need to purchase three more.
Three details about licensing that are easy to be caught out by:
- A license is activated the moment you use a premium regulation in an assessment, and it runs for one year. It renews automatically unless you cancel.
- Templates belonging to the same regulation family count as one. Using CMMC Level 1 and CMMC Level 2 increases your counter by one, not two.
- After a purchase, templates can take up to 48 hours to appear in the tenant.
If you want to look around before committing, there is a trial that covers up to 25 templates for 90 days. For an organization deciding which three regulations to settle on, that is a far better basis than guessing.
Popular regulations in Europe include:
- ISO 27001:2022
- EU GDPR
- EU NIS2
- EU Artificial Intelligence Act
- NIST CSF 2.0
Let’s take a closer look at the top three on this list. Before the numbers, one tip: each regulation’s details page carries its own Last updated date. Check it. It tells you how current Microsoft’s control mapping actually is, and the answer is sometimes older than you would expect.
ISO 27001:2022
This regulatory template is relevant for organizations that have implemented an ISO 27001-based Information Security Management System (ISMS). In this context, it is useful to gain a structured overview of what should be configured and implemented in the Microsoft 365 tenant to support compliance with the standard.
It is a big one. The regulation consists of 265 improvement actions in total: 110 that you implement yourself and 155 that Microsoft has already implemented, with 4220 achievable points between them. That covers the requirements in clauses 4 to 10 and the security controls in Annex A.
The template was last updated on 18 October 2023. The standard it maps to was published in 2022, so the mapping is not out of date, but three years without revision is a reminder that the template is Microsoft’s interpretation at a point in time, not a live reading of the standard.
EU GDPR
GDPR imposes obligations on data controllers and data processors, and grants rights to data subjects. The regulation consists of 49 improvement actions: 24 that you implement and 25 handled by Microsoft, with 877 achievable points.
Set that against ISO 27001 for a moment. GDPR carries less than a fifth of the improvement actions and roughly a fifth of the points. That is not a statement about which obligation is heavier — it reflects how much of each framework Microsoft can express as a configuration in Microsoft 365. A good deal of what GDPR actually requires of you happens outside the tenant entirely.
If you want depth on privacy: ISO 27701
The GDPR template being short leads to an obvious follow-up question, and there is an answer most people miss. Among the premium templates sits ISO 27701:2019, and it is enormous: 752 improvement actions, 274 of them yours and 478 handled by Microsoft. That is nearly three times the size of the ISO 27001 template, and roughly fifteen times the GDPR one.
If you are serious about documenting privacy management rather than ticking GDPR boxes, that is where the substance is.
There is a catch, though, and it is a growing one. That template maps the 2019 edition of the standard, which was written as an extension to ISO 27001 and required an existing ISMS as its foundation. In October 2025, the second edition changed that fundamentally. ISO/IEC 27701:2025 is a standalone Privacy Information Management System. It no longer requires ISO 27001 certification as a prerequisite, it has its own requirements in clauses 4 to 10, Annex A has been redesigned into 78 privacy controls, and only 29 information security controls are now drawn from ISO 27001 — the ones with a direct bearing on privacy. It also gained mapping annexes to GDPR and ISO 29100.
A year on, Compliance Manager still has no template for the 2025 edition. For a standard that just became independently certifiable, and that now maps itself to GDPR, that is a strange gap.
It is also not academic. Certificates based on the 2019 edition stop being valid after October 2028, so organizations are transitioning now. If you activate the ISO 27701:2019 template today, you are spending one of your three licenses on a mapping of a superseded edition, and you should expect to redo that work. Worth knowing before you pick your three.
EU NIS2
Unlike GDPR, which is a regulation that applies directly, NIS2 is a directive. Directives set minimum requirements that Member States must transpose into national legislation, while allowing each country to introduce stricter or more detailed national provisions.
As a consequence, regulatory templates in Microsoft Purview cannot fully capture the national adaptations that emerge when NIS2 is implemented at the national level.
The template consists of 96 improvement actions with 1639 achievable points, and the split is the striking part: 85 of those actions are Microsoft’s and only 11 are yours. Compare that with ISO 27001, where 110 of 265 are yours. For the directive currently driving the most compliance work in Europe, Purview hands you eleven things to do.
In practice, those eleven improvement actions are somewhat difficult to interpret, and they do not fully reflect the substantive security requirements of the directive. The security measures set out in Article 21, the core obligations for organizations covered by NIS2, are not explicitly covered by the improvement actions at all.
There is a reason, and it is visible on the template’s own details page. This template was last updated on 18 October 2023 — the same date as the ISO 27001 template, which suggests a batch revision rather than ongoing maintenance. More to the point, that is almost exactly a year before the NIS2 transposition deadline of 17 October 2024. The template predates every national law that implements the directive, and national law is what actually obliges you.
So treat the NIS2 template as a starting structure, not as a compliance answer. This is the clearest case for customization of the three, and I cover that in a separate article.
The four AI templates
Compliance Manager now provides four premium templates aimed specifically at AI regulation:
- EU Artificial Intelligence Act
- ISO/IEC 42001:2023
- ISO/IEC 23894:2023
- NIST AI Risk Management Framework 1.0
These apply to every generative AI app that Microsoft Purview supports for AI interactions, which includes Microsoft 365 Copilot, Security Copilot, ChatGPT Enterprise, Microsoft Foundry, Gemini and DeepSeek. They sit under their own heading on the Regulations page, but they count against your purchased premium licenses like any other.
These are also the templates Microsoft is actually maintaining. Where the ISO 27001 and NIS2 templates were last touched in 2023, the AI Baseline was updated in November 2025. If you want a sense of where Microsoft is putting its effort, the Last updated column answers it — and the missing ISO 27701:2025 template says the same thing from the other direction.
Customizing and extending
Regulatory templates help organizations work systematically toward compliance with laws and standards. Each template consists of a set of improvement actions the organization can implement and track over time.
They are also customizable. Organizations can mark improvement actions as not applicable where they are clearly irrelevant, rename customer-managed actions for clarity, and add their own improvement actions to reflect organization-specific or national requirements. You can also build a template from scratch, or have Compliance Manager extract one from a regulation you upload as a PDF. I have covered customizing regulatory templates in a separate article.
