Skip to content
This is NOT an official site of the Government of Canada. Click here for the official AI registry.

Helpful Places

Government of Canada – DTPR AI Register

AI Assistant for Document Drafting and Data Analysis

Employment & Work

What it collects that can identify you

Sensitive personal information
Identifiable data
  • Emails, chats, and documents within the Microsoft 365 tenant that may contain names, contact details, and other personal information about employees and the individuals they correspond with.
About behaviour
Identifiable data
  • User prompts, interaction patterns, and prior chat sessions that Copilot uses via Microsoft Graph to provide contextually relevant assistance.

Also collects operational data, which is anonymized data.

Run by
Canada School of Public Service (CSPS)
Where
No fixed location
Kept
Retained Governed by Government of Canada retention schedules and Microsoft 365 tenant configuration; specific duration not stated in the register entry
Shared with
Accountable organization, Vendor

What it is for

Employment & Work

Microsoft Copilot is a generative AI assistant integrated into Office 365 applications (Word, Excel, PowerPoint) and accessible via a contextual chat interface powered by Microsoft Graph. It assists Government of Canada employees at the Canada School of Public Service with drafting documents, analyzing data, and building presentations by drawing on emails, documents, and chats within the government tenant. The system uses personal information and users are informed that AI is in use.

What it collects and what happens to it

Data taken in

Sensitive personal information
Identifiable data
  • Emails, chats, and documents within the Microsoft 365 tenant that may contain names, contact details, and other personal information about employees and the individuals they correspond with.
About behaviour
Identifiable data
  • User prompts, interaction patterns, and prior chat sessions that Copilot uses via Microsoft Graph to provide contextually relevant assistance.
Operational data
Anonymized data
  • Office documents (Word files, Excel spreadsheets, PowerPoint presentations) within the tenant that serve as the working context for drafting and analysis tasks.

Processing

Language Models
  • Microsoft Copilot is built on large language models (LLMs) integrated into Office 365, using Microsoft Graph to retrieve relevant tenant context for grounded generation.

What it does

Creating (Generative AI)
Human decides
  • Generates text, data summaries, and presentation content within Word, Excel, and PowerPoint in response to user prompts. The employee reviews and accepts, edits, or discards the output.
Understanding (Semantic AI)
Human decides
  • Uses Microsoft Graph to retrieve and understand context from emails, documents, and chats within the tenant to ground its responses in the user's work environment.
Deciding (Analytical AI)
Human decides
  • Analyzes structured data in Excel, summarizes information, and identifies patterns to support employee decision-making. Results are advisory — the employee decides what to do with the analysis.

Outputs

Generated content
Anonymized data
  • Drafted document text, data analysis summaries, presentation slides, and chat responses generated by the AI in response to employee prompts within Office 365 applications.
A recommendation or prediction
Anonymized data
  • Suggested edits, data insights, and contextual recommendations surfaced through the Copilot chat interface based on tenant content retrieved via Microsoft Graph.

Run by

Canada School of Public Service (CSPS)
  • The Canada School of Public Service is the federal department that has deployed Microsoft Copilot for use by Government of Canada employees.

Government of Canada AI Register — Microsoft Copilot

Built by

Microsoft
  • Microsoft is the vendor that builds and supplies the Copilot AI system integrated into Office 365 and Microsoft Graph.

Government of Canada AI Register — Microsoft Copilot

Kept for

Retained Governed by Government of Canada retention schedules and Microsoft 365 tenant configuration; specific duration not stated in the register entry
  • Interaction data, prompts, and generated outputs may be retained within the Microsoft 365 tenant in accordance with applicable GC information management policies. The register entry does not specify an explicit retention period.
  • Duration: Governed by Government of Canada retention schedules and Microsoft 365 tenant configuration; specific duration not stated in the register entry

Shared with

Available to the accountable organization
  • Outputs and interaction data are accessible within the Microsoft 365 tenant administered by the Government of Canada. Tenant administrators at the Canada School of Public Service and relevant GC departments may have access to usage telemetry and logs.
Available to vendor
  • Microsoft, as the technology provider, may have access to telemetry and service-operation data in accordance with its enterprise data processing agreements with the Government of Canada.

Stored

Stored on 3rd Party Cloud
  • Data is processed and stored in Microsoft's cloud infrastructure (Azure/Microsoft 365) under the terms of the Government of Canada's enterprise agreement with Microsoft.
  • Duration: Governed by Government of Canada retention schedules and Microsoft 365 tenant configuration
How to read the colours

Can it identify you?

Anonymized data
Data about people with the link to who is broken. Stripped of identifiers, blurred, aggregated, or noised so this system can’t reasonably tie a record back to an individual.
Pseudonymous data
Each person’s data is tied to a token (hash, ID, template) that lets this system recognise the same person across events, but the token itself doesn’t reveal a name. Reidentification is possible with extra information.
Identifiable data
The data either contains a direct identifier (name, address, account name, recognisable face or voice, plate number) or carries a token this system uses to look up legal identity during processing.

Who completes the loop?

Human decides
This mode suggests; a person decides what to do next. The AI is always advisory — a human is in the loop on every decision. Example: a triage tool ranks cases for a clinician who chooses which to see first.
Human executes
This mode decides; a person carries out the result. Example: an optimizer plans the day’s trash-collection routes, and drivers run them.
Autonomous
This mode decides and acts on its own. No person reviews each decision or carries out the resulting action.

Definitions from the DTPR standard. Amber is about your data, violet about who decides. The fuller the shape and the deeper the colour, the more identifying the data or the less a person is involved.

What you can do

Ask about this system

Questions go to the Helpful Places, not the vendor.

Your rights

  • Right to Be Informed of AI UseUsers are informed that AI is in use. The register confirms that AI use is disclosed to users at the point of interaction within Office 365 and the Copilot chat interface.
  • Right to Algorithmic TransparencyGovernment of Canada employees can learn about how Copilot works through the Canada School of Public Service and Microsoft's published documentation. The AI register entry provides public transparency about the system's capabilities and data sources.

Risks and safeguards

  • Psychological harmRisk of over-reliance on AI-generated content, potential for hallucinated or inaccurate outputs to be acted upon without critical review, and risk of deskilling in writing and analysis.Safeguard: AI use is disclosed to users, outputs are advisory with employees retaining decision authority, and the Canada School of Public Service provides training on responsible AI use.
  • Civil liberties harmRisk that personal information in emails, documents, and chats is processed beyond its original purpose, potentially infringing on employee privacy within the tenant.Safeguard: system is scoped within the Microsoft 365 tenant boundary, governed by Microsoft's data processing agreements with the Government of Canada, and subject to the Privacy Act and Treasury Board privacy policies.