When your organization activates one or more Microsoft 365 Copilot licenses, a new regulation called AI Baseline appears in Compliance Manager. This regulation introduces a set of improvement actions related to AI governance and responsible AI usage. As a result, Compliance Manager begins measuring controls related to AI usage alongside existing regulations such as the Data Protection Baseline.
AI Baseline controls
In Compliance Manager, a control represents a requirement or objective that needs to be addressed. Controls are typically derived from standards, frameworks or regulations, and describe what must be achieved from a governance or risk-management perspective.
Microsoft defines the baseline as a unified control framework developed by merging four globally recognized standards: ISO/IEC 42001, ISO/IEC 23894, the NIST AI Risk Management Framework, and the EU AI Act. Each contributes distinct properties, and the consolidated baseline provides structured controls across domains such as governance, data management, design, deployment and oversight.
These controls therefore reflect AI governance principles rather than specific Microsoft 365 configurations. That is the opposite of most of what Compliance Manager contains, and it changes who in the organization has to answer for them.
AI Baseline improvement actions
Improvement actions are the operational layer of Compliance Manager, the meat of the regulation. They describe how controls can be implemented using Microsoft 365 capabilities.
The AI Baseline consists of 179 improvement actions: 80 that you implement yourself and 99 handled by Microsoft, with 2674 achievable points between them. Of the 80 customer-managed actions, 29 are unique to AI Baseline, while the rest also belong to other regulations.
Because Microsoft-managed controls are already implemented in the service, they contribute achieved points immediately when the regulation appears. This means your Compliance Score may actually increase when Copilot licenses are activated. How about that!
It is worth pausing on that, though. A score that rises because Microsoft implemented something on your behalf tells you nothing about whether your organization has done any AI governance work. The 29 unique customer-managed actions are where the actual work sits.
One detail that speaks well of this template: it was last updated on 13 November 2025. The ISO 27001 and NIS2 templates were both last touched in October 2023. AI Baseline is one of the few parts of Compliance Manager that is being actively maintained, which matters in an area where the underlying regulation is still settling.
The four premium AI templates
AI Baseline is not the only AI-related content in Compliance Manager. There are also four premium regulatory templates aimed at AI regulation specifically, listed under their own heading on the Regulations page:
- EU Artificial Intelligence Act
- ISO/IEC 42001:2023
- ISO/IEC 23894:2023
- NIST AI Risk Management Framework 1.0
These are the four standards AI Baseline is derived from, available individually. They apply to every generative AI app that Purview supports for AI interactions, which includes Microsoft 365 Copilot, Security Copilot, ChatGPT Enterprise, Microsoft Foundry, Gemini and DeepSeek. Using one counts against your purchased premium licenses.
The practical difference is scope. AI Baseline gives you a consolidated view across all four. An individual template gives you the structure an auditor will actually ask for if you are certifying against ISO/IEC 42001 or documenting conformity under the EU AI Act.
Assessments that test themselves
A newer capability is worth knowing about, because it addresses the main complaint about Compliance Manager: that almost everything has to be marked implemented and tested by hand.
Compliance Manager integrates with Azure AI Foundry to automate compliance evaluations for AI models and agents. The AI Foundry service contributes 75 actions, of which 15 are automated evaluation actions covering metrics such as reliability, coherence and fluency. Compliance Manager syncs those 15 from AI Foundry on a schedule and displays pass or fail status with the underlying metrics. You can convert automated actions back to manual ones if you prefer, and organizations without AI Foundry access can update them by hand.
Built-in assessments for the key AI regulations, including the EU AI Act, NIST AI RMF and the ISO/IEC standards, are provided free for six months with Copilot or Agent licenses. If you are going to evaluate whether this is useful, that window is the time to do it.
Using it requires the admin account to hold either the Azure AI Project Manager or Azure AI User role on the relevant AI Foundry accounts, which in most organizations means involving whoever owns the Azure side.
Working with AI Baseline assessments
Like other regulations in Compliance Manager, AI Baseline can be used to create assessments that help organizations track their AI governance progress over time.
An assessment allows organizations to:
- review AI-related controls in a structured way
- document implementation status
- assign responsibilities
- collect evidence
- track improvement actions
- measure progress through Compliance Score
This makes AI governance part of the organization’s existing compliance workflow, rather than a separate initiative. For anyone building an AI management system under ISO/IEC 42001, that matters more than the score does: the assessment is where the evidence lives.
