The use of AI assistants such as Microsoft 365 Copilot introduces new types of information security and privacy risks. Organizations that already operate an Information Security Management System will typically address these risks through established security controls. But are the controls defined in ISO 27001 sufficient to govern the use of AI assistants like Copilot? The short answer is no. To address this properly, we must look to a different ISO standard.
ISO/IEC 42001:2023 specifies requirements for an Artificial Intelligence Management System (AIMS). The standard defines requirements for the management system itself and includes a set of recommended controls related to the use of AI. Organizations using Microsoft 365 have strong capabilities for governing and managing Copilot, and as expected, this is largely achieved through Microsoft Purview. Let’s explore how Purview supports an AIMS.
ISO 42001 requirements
The requirements in ISO 42001 follow the same high-level structure as other management system standards. They include, among other things, establishing an AI policy, defining roles and responsibilities, performing AI risk assessments, and conducting impact assessments of AI systems.
One of the requirements is clause 9.1, Monitoring, measurement, analysis and evaluation. Under this requirement, the organization must determine what should be monitored and measured in order to analyze and evaluate the performance and effectiveness of the AI management system.
| ISO 42001:2023 requirement | Relevant Purview solution |
|---|---|
| 9.1 Monitoring, measurement, analysis and evaluation | DSPM for AI — reports covering activity, data and user insights, with a dedicated tab for AI activities and a Risk Pattern filter in Activity explorer. Copilot dashboard — the value of Copilot-assisted hours |
Security controls in ISO 42001 Annex A
ISO 42001 Annex A specifies 39 recommended controls. As part of an AIMS, organizations must assess whether each control is relevant and, if so, implement it. This assessment is documented in the Statement of Applicability, which is a core part of the AIMS. In practice, this is very similar to how Annex A controls are handled in an ISMS.
Below are examples of how Microsoft Purview can be used to support selected controls from ISO 42001 Annex A.
| ISO 42001:2023 control | Relevant Purview solution |
|---|---|
| A.6.2.4 AI system verification and validation | Compliance Manager — the Azure AI Foundry integration syncs 15 automated evaluation actions covering metrics such as reliability, coherence and fluency, giving pass or fail status rather than a manual attestation |
| A.6.2.6 Operation and monitoring of the AI system | DSPM for AI — review reports, the AI activities tab and the Risk Pattern filter. Insider Risk Management — the Risky Agents policy template, which monitors agents hosted in Copilot Studio and Microsoft Foundry against their own baseline |
| A.6.2.8 Recording of AI system event logs | Audit — enable auditing and search activity logs, specifying Copilot as the workload. Data Lifecycle Management — retention policies so AI-related logs are not deleted before you need them |
| A.7.3 Data acquisition | Data Loss Prevention — policies preventing Copilot from processing private or confidential content, based on sensitivity labels and sensitive information types |
| A.7.4 Data quality | Information Protection — sensitive information types matching the organization’s business-critical or confidential data, such as health or financial information, and Content explorer for insight into the data being processed. eDiscovery — find and delete stale data, since outdated or incorrect data degrades the quality of responses |
| A.9.2 Processes for responsible use of AI systems | Insider Risk Management — the Risky AI usage policy template, which detects risky prompts, sensitive responses and browsing to generative AI sites. Notice templates to tell people which tools are approved, which is usually the right outcome rather than an investigation |
| A.9.4 Intended use of the AI system | DSPM for AI — Activity explorer to analyze Copilot interactions against the defined intended purpose, and data risk assessments to identify oversharing. Insider Risk Management — policies to detect potential data leakage, and Adaptive Protection to tighten controls around risky users automatically |
| A.10.3 Suppliers / A.10.4 Customers | DSPM for AI — the inventory of which AI apps are actually in use and which policies cover them, including the agent inventory in AI observability. Useful for the supplier side of the standard, where the question is what third-party AI is operating in your estate |
Two of these deserve a comment.
A.6.2.4 is the one that has changed most since this article was first written. Verification and validation of an AI system used to be something you documented by hand. With the AI Foundry integration, 15 evaluation actions report their own status into Compliance Manager, which is as close as this framework gets to evidence that generates itself.
The Risky Agents policy is worth reading twice. It detects agents being exposed to risky prompts, agents generating sensitive responses, agents accessing sensitive SharePoint files, agents browsing risky websites, agents sharing files externally, and agent activity above its own baseline. That is an insider risk policy where the insider is not a person. For an AIMS, being able to point at behavioural monitoring of individual agents, with alerting and baselines, is a stronger control than a policy document saying agents must be used responsibly. Note that it is applied by default for all organizations, which means you may already have alerts you have not looked at, with thresholds you did not set.
The ISO 42001 template in Compliance Manager
ISO/IEC 42001:2023 is available as a regulatory template in Compliance Manager. Microsoft has analyzed the standard and broken its requirements and Annex A controls down into concrete improvement actions.
It is one of four premium AI templates, alongside ISO/IEC 23894:2023, the NIST AI Risk Management Framework and the EU AI Act. They sit under their own heading on the Regulations page, and using one counts against your purchased premium licences. There is also a route in that does not: built-in assessments for these regulations are provided free for six months with Copilot or Agent licences.
Worth knowing as well: activating Copilot licences brings in a regulation called AI Baseline, which merges ISO/IEC 42001, ISO/IEC 23894, the NIST AI RMF and the EU AI Act into one consolidated framework of 179 improvement actions. It gives you a single view across all four, and it was last updated in November 2025, which makes it one of the better-maintained templates in Compliance Manager. For certifying against ISO/IEC 42001 specifically, though, use the individual template — that is the structure an auditor will ask for. I cover AI Baseline in a separate article.
Enabling the template gives you a structured set of improvement actions mapped directly to ISO 42001 requirements and controls, and a practical overview of what can be configured and governed in Microsoft 365 to support compliance with the standard.
One boundary to keep clear, the same one that applies to ISO 27001. The template tells you what Microsoft 365 can do for a control. The Statement of Applicability records your decision about whether that control applies to your organization and how you have addressed it, including everything outside the tenant — the AI policy itself, the risk assessments, the impact assessments, who is accountable. Purview supports an AIMS. It does not constitute one.
