Your firm bought the licences. The question nobody answered is which pass of the work Copilot owns, and what a qualified human still has to do afterwards.
Seven copy-ready prompts for real legal workflows, each with the task, the exact wording and how to adapt it. The discipline that makes them work is deciding in advance which pass Copilot owns and what gets checked afterwards, because the tasks that suit it worst are the ones where you cannot quickly tell whether the answer is right. On the compliance side: Microsoft states that prompts and responses are not used to train its foundation models and are covered by the same commitments as your Exchange and SharePoint content, that Copilot only surfaces content the signed-in user can already access, and that prompts and responses are stored in the user’s mailbox and are discoverable through eDiscovery. None of that is a statement about privilege, which is a legal test rather than a product setting.
An in-house counsel I worked with had 41 supplier agreements land on her in one week because procurement had finally finished a framework refresh. Most were the same base agreement. A few weren’t. Her actual problem wasn’t reviewing 41 contracts, which she could do. It was that she had no fast way of finding out which of the 41 were the ones worth her Tuesday.
That’s the shape of legal work Copilot suits. Not judgment. Triage, extraction, comparison, and first drafts of things you were going to rewrite anyway.
The distinction that matters isn’t hard versus easy. It’s whether you can check the answer faster than you could produce it. Ask Copilot which of 41 agreements contain an uncapped indemnity and you can verify every hit in seconds by opening the clause. Ask it whether an indemnity is enforceable and you’ve handed it a question where a wrong answer looks exactly like a right one.
If checking the output costs more than doing the work yourself, you picked the wrong task.
Microsoft is not shy about this, which I appreciate more than the marketing around it. Its own documentation says the responses generative AI produces “aren’t guaranteed to be 100% factual” and that the design intent is to give you “a chance to review the generated AI rather than fully automating these tasks.”[1] That’s the vendor telling you the output is a draft. Take them at their word.
So here’s the split I’d write down before anyone on a legal team touches this, because vague guidance about “using AI responsibly” gives nobody anything to do on Monday.
| Task | What Copilot does | What a qualified human still owns | How it gets checked |
|---|---|---|---|
| Triage a batch of agreements | Flags which contain a named clause type or deviate from your standard | Deciding which deviations actually matter to this deal | Open every flagged clause. Spot-check five it didn’t flag |
| First-pass contract review | Produces a checklist result with the clause text quoted | The position. Whether to accept, push back, or walk | Every quoted clause read in the original document, not in the summary |
| Redline summary | Describes what changed between two versions | Whether the change shifts risk, and to whom | Compare against the tracked changes, not against the description |
| Client-facing summary | A plain-English draft of what a document says | Every characterisation of obligation, deadline and consequence | Read as the client will. Then check each claim against the source clause |
| Memo outlining | Structure, issues list, and the questions it cannot answer | The law. All of it | Nothing in the memo cites anything Copilot produced |
| Obligation extraction | Pulls dates, notice periods and renewal triggers into a table | Whether the extraction is complete | Read the document once for anything the table missed |
A worked split for six recurring legal tasks. The right-hand column is the part teams skip, and it is the only column that makes the rest defensible. Framework, not measured data.
Notice that none of these are “let Copilot review the contract.” Every one names a pass.
Seven prompts. They’re written out in full because a prompt described in the abstract is a prompt nobody uses, and the specific wording is doing real work in most of these.
One structural note before the list. Every prompt below ends by telling Copilot what to do when it can’t answer, and that instruction is the most important line in each one. Left to itself, a model fills gaps. Told explicitly to flag them instead, it mostly will, and the flagged gap is often more useful than the answer.
| The task | You have a supplier agreement and a house checklist. You want to know where it lands before you read it properly. |
|---|---|
| The prompt | “Review the attached agreement against this checklist: limitation of liability capped at fees paid; no uncapped indemnity; 30 days’ notice for termination for convenience; governing law England and Wales; data processing terms present. For each item, tell me PRESENT, ABSENT or DIFFERENT, quote the exact clause text you relied on and give the clause number. Where the document does not clearly address an item, say NOT ADDRESSED rather than inferring. Do not tell me whether the terms are acceptable.” |
| How to adapt | Replace the five checklist items with your own, keep them binary, and keep the final sentence. The last line is what stops it drifting from extraction into advice. |
| What to check | Every quoted clause, in the document. Quotation is the point of this prompt: it makes verification take seconds. |
Prompt 1 of 7. Written for Copilot with a document attached or referenced from SharePoint or OneDrive.
| The task | Two versions, or two different agreements, and one clause you care about. |
|---|---|
| The prompt | “Find the limitation of liability clause in each of these two documents. Set them out side by side, verbatim, with clause numbers. Then list the differences as factual statements only: what is capped, at what level, what is excluded from the cap, and which carve-outs appear in one and not the other. Do not characterise either version as better, stronger or more favourable.” |
| How to adapt | Swap the clause type. The verbatim-plus-clause-number instruction matters more than the rest, because a paraphrased clause comparison is close to useless. |
| What to check | That both clauses were actually found. A missing clause reported as a difference is the failure mode here. |
Prompt 2 of 7. Banning comparative adjectives keeps the output as evidence rather than an opinion you would have to unpick.
| The task | A negotiation call or an internal matter meeting, and the commitments buried in it. |
|---|---|
| The prompt | “From this transcript, produce a table with four columns: the commitment, who made it, the deadline, and the exact words they used. Include only commitments actually stated. If a deadline was implied rather than stated, write IMPLIED and quote the words it was implied from. Add a second short list of anything raised and left unresolved.” |
| How to adapt | The “exact words they used” column is the one to keep in every version. It turns a summary you have to trust into a summary you can audit in one pass. |
| What to check | The unresolved list, first. That is usually where the risk is, and it is the column a human reader skips. |
Prompt 3 of 7. Needs a recorded or transcribed meeting. Note that where transcripts are turned off, Microsoft states auditing, eDiscovery and retention of that content are not supported.[2]
Those three cover extraction. The next four are where more care is needed, so they sit in their own sections below, with the reasoning attached rather than just the wording.
Redlines are where I’d start if a team wanted one habit rather than seven. The job is genuinely tedious, it recurs constantly, and the check is fast because the tracked changes are sitting right there.
| The task | Counsel returns a marked-up draft. You want the shape of it before you read it line by line. |
|---|---|
| The prompt | “Compare version A and version B of this agreement. Produce a table of every substantive change with three columns: the clause number, what the original said, what it now says. Exclude formatting, numbering and typographical changes entirely. Then add one short section listing only the changes that alter who bears a cost, a risk or an obligation, and for each one state which party the change moves it towards. Where you are not certain a change is substantive, include it and mark it UNCERTAIN.” |
| How to adapt | The “exclude formatting” instruction saves you a page of noise. The UNCERTAIN category is what stops it quietly dropping something it half-recognised. |
| What to check | Open the tracked changes and count them. If Copilot found fewer substantive changes than the document contains, you have your answer about how much to trust the second section. |
Prompt 4 of 7. The second half of this prompt, moving from what changed to who it moves risk towards, is the part a person would otherwise do in their head and forget to write down.
The batch version is the one that solves the 41-contracts problem.
| The task | Many agreements, one standard, and limited time. |
|---|---|
| The prompt | “Using our standard supplier agreement as the reference document, review each of the attached agreements and produce one row per agreement: supplier name, the number of clauses that differ materially from the standard, and the three most significant differences stated factually. Sort the table so that the agreements with the most material differences appear first. Do not summarise agreements that match the standard beyond saying MATCHES STANDARD.” |
| How to adapt | Sorting is the whole trick. What you want out of a triage prompt is an order to work in, not a set of summaries. |
| What to check | Pull two agreements it marked MATCHES STANDARD and read them. False negatives are the risk in triage, and they are invisible unless you go looking. |
Prompt 5 of 7. Copilot only reaches documents the signed-in user already has permission to open, so a batch prompt cannot pull in anything outside your existing access.[3]
Microsoft used to publish word and page figures for document handling. Its current page doesn’t, and the numbers still circulating in search results are from a version that no longer exists, so I’m not going to repeat them. What the page does say is more useful anyway.
For a targeted question about a specific topic, document length typically doesn’t affect the answer. For a summary, the task needs the whole document, and Microsoft notes that large language models “tend to prioritize content that is at the beginning and end of a file,” so results “may give less attention to content that was in the middle of a long file.” Its own suggested workaround for a long document is to split it into smaller documents and provide them separately.[4]
Read that as a legal practitioner and it says something specific. A schedule buried on page 94 of a master agreement is precisely the content most at risk of being underweighted, and schedules are where the commercially painful terms tend to live. Split by schedule, ask about each one, and don’t ask a 200-page document for a summary and treat the result as coverage.
This is the section where I’d rather you left with a firm rule than a set of tips.
Copilot can produce a first pass. It never produces a position.
The reason to be blunt about it is that the failure has already been documented in public, expensively. In Mata v. Avianca, in the Southern District of New York, Judge P. Kevin Castel imposed a $5,000 penalty jointly and severally on the lawyers and their firm in June 2023, along with an order to write to their own client and to each judge falsely named as the author of a fabricated opinion.[5] Six fictitious cases, named in the order itself. The problem wasn’t that a tool produced them. It was that nobody opened them.
The professional obligations are set out too. The American Bar Association’s Formal Opinion 512, issued 29 July 2024, was its first formal opinion on generative AI, and states that lawyers and firms using it must “fully consider their applicable ethical obligations,” which the ABA’s own summary lists as competent representation, protecting client information, communicating with clients, and charging reasonable fees consistent with the time actually spent.[6] I’d flag the fees point because it catches people out: the ABA’s example is that you may bill for the time you spend inputting information and reviewing the draft, but in most circumstances you can’t bill a client for learning how to work the tool.
None of that makes drafting support off limits. It makes the boundary specific.
| The task | A client needs to understand what they’re signing without a call. |
|---|---|
| The prompt | “Write a plain-English summary of this agreement for a non-lawyer business owner. Cover only: what they are agreeing to do, what the other side is agreeing to do, what it costs, how long it lasts, how it ends, and what happens if either side gets it wrong. Use short sentences and no legal terminology unless you define it in the same sentence. After each point, put the clause number it comes from in brackets. Do not include any advice on whether they should sign, and do not soften anything that is unfavourable to them.” |
| How to adapt | Keep the clause numbers in brackets. They let you check the whole thing in one pass and they let the client find the source themselves, which builds more trust than the summary does. |
| What to check | Everything, before it leaves your outbox. Read specifically for anything described more comfortably than the clause actually reads. |
Prompt 6 of 7. The instruction not to soften unfavourable terms exists because plain-English rewriting tends to smooth edges, and the edges are the point.
| The task | Structuring a memo before you do the substantive work, using your own matter files. |
|---|---|
| The prompt | “Using only the attached matter documents, draft an outline for a memo on this question: [state it]. Give me the issues in the order they need to be resolved, and under each one list the specific facts in these documents that bear on it, with the document name and page. Then give me a separate list headed OPEN QUESTIONS containing everything the memo will need that is not answered anywhere in these documents. Do not state any legal proposition and do not cite any authority.” |
| How to adapt | The last sentence is not optional. Every version of this prompt should forbid it from citing anything, so that nothing it produces can end up in a filing by accident. |
| What to check | The OPEN QUESTIONS list is the deliverable. If it is short, the prompt did not work, because the honest answer for most memos is that the file does not contain what you need. |
Prompt 7 of 7. Structure and fact-gathering only. Every proposition of law and every authority in the finished memo comes from a person and a proper source.
On whether this replaces the paid legal databases: it doesn’t, and it isn’t trying to. Copilot with work grounding reasons over your own documents and your own mail. It has no curated case law corpus, no citator, and nothing that tells you a case has been overturned. Those are different products doing a different job.
I used to assume the gap between legal teams that got value out of Copilot and teams that didn’t came down to prompting skill. The longer I looked at it, the less that held up.
What separates them is whether the prompt has a slot. A good prompt used once is an anecdote. The same prompt attached to a recurring moment, with a named owner, is a change in how the work gets done. Access to the tool builds nothing on its own, which is a point we’ve made at length in our piece on moving an organisation from AI awareness to fluency, and it holds particularly hard in legal teams because the work arrives unpredictably and nobody has a spare Wednesday to design a process.
The fix is smaller than it sounds. Attach each prompt to a trigger that already exists.
| Trigger that already happens | Prompt | Owner | The check, and how long it takes |
|---|---|---|---|
| A marked-up draft arrives from the other side | 4, redline summary | Whoever opens it first | Count the tracked changes against the table. Two minutes |
| A batch of agreements lands from procurement | 5, triage against standard | The contracts paralegal | Read two of the MATCHES STANDARD rows in full. Ten minutes |
| A negotiation call ends | 3, obligations and owners | The person who ran the call | Check the unresolved list before you close the tab. Three minutes |
| A client asks “so what does this actually mean” | 6, plain-English summary | The matter lead | Every bracketed clause number. Five minutes, and never skipped |
| A new memo is commissioned | 7, outline with open questions | The lawyer writing it | Read the OPEN QUESTIONS list first. One minute |
A worked register. The columns that get left blank are owner and check, and those are the two that decide whether any of this survives a busy month. Framework, not measured data.
Two rows is a fine place to start. Pick the trigger that annoys the team most and the one where the check is fastest, and leave the rest until those two are boring.
A short list, and I’d rather be specific than say “use your judgment,” because everyone thinks they are.
There’s a seventh that isn’t about risk at all, and it catches whole teams. Copilot doesn’t work in shared mailboxes. Microsoft’s requirements page is unambiguous: “Microsoft Copilot is only supported on primary mailboxes that are hosted on Exchange Online. It isn’t available on a user’s archive mailbox, group mailboxes, or shared and delegate mailboxes that they have access to.”[7]
If your matter correspondence lives in a departmental legal@ inbox, which is extremely common, none of the mail-based workflows here reach it, and no licence purchase changes that. Worth finding out before, rather than after, the rollout. We’ve written more generally about how to decide when not to use AI on a task at all, and the mailbox question belongs in that category: it’s not a judgment call, it’s a fact about the product.
One more thing that is a judgment call. Sensitivity labels interact with Copilot in a way worth understanding before someone concludes the tool is broken. Where a label applies encryption, a user needs EXTRACT rights as well as VIEW for Copilot to return the content. With VIEW but not EXTRACT, Microsoft states Copilot won’t summarise the content but can reference it with a link so the person can open it separately.[2] That behaviour is correct, and it will look like a bug to everyone who encounters it.
Start with the distinction that most internal discussions skip past.
Data protection is a contract. Privilege is a legal test. A vendor can give you the first and cannot give you the second.
What Microsoft does commit to is real and worth knowing precisely. Prompts, responses and data accessed through Microsoft Graph “aren’t used to train foundation LLMs, including those used by Microsoft Copilot.”[1] Copilot Chat prompts and responses are “processed within the Microsoft 365 service boundary.”[8] And Microsoft describes the protection as the same terms already covering “their emails in Exchange and their files in SharePoint.”[9]
Three things complicate the tidy version of that, and all three come from Microsoft’s own pages rather than from critics. Copilot’s calls to the language model are routed to the nearest data centres in the region but “can call into other regions where capacity is available during high utilization periods.” Models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary. And web search queries sent to Bing are not covered by the EU Data Boundary, with Microsoft acting as an independent data controller for that separate service.
So “it never leaves your tenant” is not something you should say in a client conversation. “Prompts and responses carry the same contractual protections as our Exchange and SharePoint data, and web-grounded queries are handled differently” is accurate and nearly as short.
Prompts and responses for AI apps are stored in the user’s mailbox, and that means they can be searched in an eDiscovery case with the user’s mailbox as the source. Retention policies apply to them. Communication compliance covers them. And there’s a precision point that matters if anyone is relying on the audit log: Microsoft states that “auditing captures the Microsoft 365 Copilot activity of search, but not the actual user prompt or response. For this information, use eDiscovery.”
Read as a lawyer rather than an IT administrator, that reframes the whole thing. Every exploratory prompt about a live matter is a retained document. Not privileged by virtue of being typed into Copilot, not private because it felt like thinking out loud, and reachable by the same processes that reach email.
Which is a reason to be deliberate rather than a reason to avoid the tool. You already know how to write an email about a live matter.
| Ask | If the answer is no |
|---|---|
| Am I signed in with my work account, not a personal one? | Stop. The consumer product has different data handling entirely and nothing above applies to it. |
| Would I be comfortable with this prompt appearing in a document production? | Rewrite it until you would. It is stored in your mailbox and reachable by eDiscovery. |
| Does this document already sit somewhere I have permission to open it? | Then Copilot changes nothing about who can see it. If you had to move it to make this work, move it back. |
| Am I asking it to extract, or to conclude? | Rewrite as extraction. Add the instruction not to advise. |
| Do I know how I will check this, and how long that will take? | Don’t run it yet. That answer is the whole decision. |
A pre-paste checklist built from Microsoft’s documented behaviour on account types, permissions, storage and eDiscovery. Not legal advice, and no substitute for your own firm’s policy or your regulator’s guidance.
A closing note on what isn’t there. Microsoft publishes legal-sector use-case material through its adoption site, and it publishes horizontal compliance documentation covering GDPR, ISO 27001 and the EU AI Act. What I could not find is anything from Microsoft addressing privilege, conflicts, client confidentiality under professional conduct rules, or disclosure obligations to a court. That gap is not an oversight on their part. Those are questions for your regulator, your professional body and your own risk function, and the fact that a vendor hasn’t answered them is exactly why somebody in your organisation needs to.
So: pick one prompt. Prompt 4, the redline summary, if you want the fastest visible win. Attach it to the trigger that already happens, name the person who owns it, and do the two-minute check every single time for a month. Then decide whether it has earned a second.
It can do a first pass, and that is a genuinely useful thing. Give it a checklist and it will tell you which items are present, absent or different, quote the clause it relied on and give you the clause number, which makes verification fast. What it should not do is form a position. Whether a limitation of liability is acceptable, whether an indemnity is enforceable, and whether to sign are all judgments a qualified person makes, and a wrong answer to any of them looks exactly like a right one. Microsoft’s own documentation says the responses generative AI produces are not guaranteed to be fully factual and that the design intent is for you to review the output rather than automate the task.
The strongest pattern for legal work is extraction with quotation and an explicit instruction about what to do when it cannot answer. For example: review the attached agreement against a named checklist, mark each item present, absent or different, quote the exact clause text and clause number you relied on, say NOT ADDRESSED rather than inferring where the document does not clearly cover an item, and do not tell me whether the terms are acceptable. The quotation requirement is what makes the output checkable in seconds. The final instruction is what keeps it on extraction rather than drifting into advice.
The accurate answer separates two questions. On data handling, Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train its foundation models, that Copilot Chat prompts and responses are processed within the Microsoft 365 service boundary, and that the protection matches the contractual terms already covering Exchange and SharePoint content. Three caveats sit alongside that in Microsoft’s own documentation: model calls can route to other regions during high utilisation, Anthropic models are currently excluded from the EU Data Boundary, and Bing web search queries fall outside it with Microsoft acting as an independent controller. On privilege, no vendor commitment answers that question. Privilege is a legal test decided under your jurisdiction’s rules, not a product setting.
Anything that states the law, cites an authority, reaches a conclusion on enforceability or liability, or goes to a court or regulator. The Mata v. Avianca sanctions order in the Southern District of New York in June 2023 is the standing example, where fabricated case citations led to a $5,000 penalty imposed jointly and severally under Rule 11 alongside corrective letters. There are also hard product limits rather than judgment calls: Copilot cannot access content protected by Double Key Encryption, will not return S/MIME protected email, and is not supported on shared, group or archive mailboxes at all.
No, and it is not built to. Copilot with work grounding reasons over your organisation’s own documents, email and meetings through Microsoft Graph, restricted to content you already have permission to access. It has no curated case law corpus, no citator, and no mechanism to tell you that an authority has been overturned or distinguished. Those are the core functions of a legal research platform. The practical division is that Copilot helps with your own matter files, and a dedicated platform handles the law itself.
Every Microsoft data-handling, permissions and compliance claim in this article was checked against Microsoft’s own current Learn and Support documentation on 25 August 2026, with the page update dates given in the sources list. Several widely repeated figures were deliberately left out because they could not be confirmed on a live Microsoft page: the 80,000-word and 300-page document limits and any specific file-size cap for Copilot in Word all appear in search snippets but not on Microsoft’s current documentation, which now gives qualitative guidance instead. The ABA Formal Opinion 512 summary here reflects only the four Model Rules named on the ABA’s own announcement page, competence, confidentiality, communications and fees; other rules are frequently attributed to the opinion in secondary coverage and are not stated here. The Mata v. Avianca details come from the docket text of the sanctions order itself rather than from news summaries, which is why the penalty is described as $5,000 jointly and severally rather than per lawyer. This article is not legal advice and does not substitute for your firm’s own policy, your professional body’s guidance, or advice from your risk function.
Weekly tips. Real examples. Practical help for busy professionals.
We care about your data, check out our privacy policy.