FAQs

Q: How can I ensure that Microsoft Copilot is used in the company in compliance with data protection regulations and in a controlled manner?

Transparent control of authorizations and data access is a central component of AI Act preparation. Microsoft Copilot accesses company data in M365 (SharePoint, Teams, OneDrive, Outlook, etc.) - often including content that users did not want to share. Companies should therefore check this at an early stage: Which data sources can Copilot read or search? Is sensitive data (e.g. HR, finances, contracts) technically protected or excluded? Are there roles and groups that have too far-reaching access? You can find a practical checklist and concrete to-do list for setting up, checking and securing Copilot access in our blog article: Microsoft Copilot - To-do list for authorizations and accesses

Q: What are the most important immediate measures for companies?

Many obligations can already be implemented today - regardless of whether national implementation has already taken place. The biggest quick wins: Activate multi-factor authentication (MFA) wherever possible Establish patch management and regularly close vulnerabilities Document backups and recovery tests Check access and authorizations Define and practice the incident response process, more on this in our blog article "NIS2 is coming - Do companies need a SIEM system?" These measures immediately improve the level of security and prepare the company for audits or supply chain checks.

Q: What specifically must companies have implemented by August 2026?

By the main deadline of August 2026, companies must have inventoried, evaluated and documented their AI applications. This includes in particular an AI inventory with risk classification (low, transparent, high, inadmissible), defined roles and responsibilities (e.g. according to the RACI model), an approval process for new AI use cases, Policies for data access, logging, documentation and incident management, Proof of AI literacy (basic skills in dealing with AI). The first partial obligations will already apply from 2025 - such as transparency for general-purpose AI (e.g. GPT models).

Q: What exactly are passkeys and how do they differ from passwords or classic MFA?

Passkeys are based on the FIDO2 standard ("Fast IDentity Online") and completely replace the traditional password. In contrast to conventional multi-factor authentication (MFA) , passkeys are phishing-resistant because no password or code is transmitted. Instead, a public and a private cryptographic key are used - the private key remains securely on the user's device (e.g. smartphone or laptop). Microsoft integrates Passkeys directly into Entra ID (formerly Azure AD) and thus enables login via Face ID, fingerprint or device PIN - securely, quickly and without a password. Info from FIDO Allicance about this: Passkeys

Q: What responsibility does the management have for NIS2 implementation?

NIS2 clearly shifts responsibility to management level: Managing directors and board members must ensure that information security is organizationally anchored and adequately funded. Delegation to the IT department alone is no longer sufficient - management remains liable if measures are not taken. In concrete terms, this means Information security is becoming a top priority. Documented policies and responsibilities are needed. Verifiable training for management and employees is mandatory. This responsibility is also made clear in the BSI's training material for managing directors .

Q: What are the risks of not implementing NIS2?

The directive provides for significantly higher fines than before - up to €10 million or 2% of global annual turnover (whichever is higher). In addition, the personal liability of the management may apply if gross negligence is committed or supervisory duties are breached. Furthermore, there is a risk of reputational damage and exclusion from supply chains if customers or clients demand NIS2 evidence.

How can I ensure that Microsoft Copilot is used in the company in compliance with data protection regulations and in a controlled manner?

Manuel Mayer2025-11-07T11:43:53+01:0007.11.2025|

How can I ensure that Microsoft Copilot is used in the company in compliance with data protection regulations and in a controlled manner?

What are the most important immediate measures for companies?

What specifically must companies have implemented by August 2026?

What exactly are passkeys and how do they differ from passwords or classic MFA?

What responsibility does the management have for NIS2 implementation?

What are the risks of not implementing NIS2?

SOCIAL MEDIA

LEGAL

CONTACT