Copilot Oversharing: Review Access and Notice Duties

A sales employee receives a Microsoft 365 Copilot answer quoting negotiated pricing from a confidential customer contract. IT finds that a broad SharePoint group grants access now and is still establishing whether the employee had that access when the answer appeared, and whether anyone shared the response. The customer agreement requires notice within 24 hours after discovery of unauthorized access. Counsel must assess that clock while IT preserves evidence and contains further exposure.

Microsoft's security guidance explains that Copilot operates within existing Microsoft 365 permissions. That makes this an authorization question as well as an IT incident: did the employee satisfy the agreement's access conditions, and has the notice obligation been triggered? IT still has to establish the access path and recipients.

GC AI is turnkey legal AI software built for in-house counsel. It is trusted by 2,100 companies, including 300 public companies, with organizations such as Lockheed Martin and TIME using the platform. GC AI helps counsel compare the agreement and company access rules with IT's verified findings, then prepare a cited decision record and owner instructions while the notice deadline is under review.

How Did Copilot Surface the Confidential Contract?

Your IT team preserves the Copilot interaction and reconstructs who could access its source when the answer appeared. Containment and Legal's notice review proceed in parallel.

Four facts anchor the incident decision:

Discovery: When the company learned of the answer and who escalated it.

Source and answer: The contract version and location, available prompt and response, citations, timestamp, and account.

Audience and access: The recipient, any sharing or forwarding, and event-time permissions, grants, and group membership.

Containment: What changed and when, preserved records, and any remaining access or copies.

Microsoft's Copilot interaction schema and SharePoint data access governance reports identify useful evidence, but their availability varies by tenant. Today's permissions cannot establish historical access or every recipient.

Your IT team compares historical records with current access, corrects confirmed overbroad grants, and leaves other possible sharing paths open if the evidence is incomplete.

Did the Contract Permit That Employee's Access?

Contract authorization is a separate test. The employee must need the information to perform the agreement and be bound by confidentiality obligations. Those facts come from the account owner and employment records, separate from SharePoint permissions.

Illustrative Contract Provision: The customer agreement defines Authorized Personnel as follows.

Employees who need the Confidential Information to perform this Agreement and are bound by confidentiality obligations.

The same hypothetical agreement requires notice within 24 hours after discovery of unauthorized access to the customer's Confidential Information.

The company's position restricts negotiated customer contracts to the account team and Legal. The employee's account role, confidentiality obligations, event-time group membership, and forwarding recipients remain unconfirmed. Counsel records those gaps and evaluates the 24-hour discovery trigger against the agreement and amendments while IT continues the investigation.

Contractual customer notice and statutory notice are separate decisions. Privacy counsel should assess the information involved, affected people, jurisdictions, and applicable legal duties. Commercial pricing alone does not establish a personal-data breach. If the material includes legal advice, counsel must separately assess privilege; a confidentiality label does not decide it.

Which Controls Help Contain Copilot Oversharing?

Start by correcting verified overbroad SharePoint permissions. Microsoft's Restricted Content Discovery can limit discovery in the meantime, though anyone with access can still open the file directly.

Legal's incident record should identify the permission fix, its effective time, and what remains unresolved about earlier responses or recipients.

Prepare the Contract and Incident Decision Record With GC AI

While IT reconstructs access, GC AI helps counsel prepare a cited decision record from the approved agreement and amendments, company access position, and IT's findings. A GC AI Project keeps the matter's materials together; Legal checks workspace access and handles privilege separately.

The draft separates the contract's authorization test and notice deadline from confirmed evidence and unresolved facts, so counsel can approve the next step.

Example Prompt

From the supplied agreement and amendments, approved access position, and IT's findings, draft a cited decision record. Test both Authorized Personnel conditions, identify the notice trigger, recipient, method, and deadline, and list missing evidence and next owners. Draft internal instructions; do not send any customer notice.

Illustrative Decision-Record Finding

Current broad-group access is confirmed, but event-time membership, contractual need to know, applicable confidentiality obligations, and forwarding recipients remain unresolved. Assess the 24-hour discovery trigger immediately while IT and the account owner obtain missing evidence.

Counsel checks that proposed finding against the cited agreement and IT's evidence before adopting it.

GC AI's Exact Quote opens the highlighted source passage behind a citation, so counsel can test the authorization definition and notice clause in context.

For related statutory notice or preservation questions, GC AI's Research provides analysis linked to original authorities for counsel to review.

Who Owns the Response and Notice Decision?

Give each owner a clear assignment while Legal assesses the notice clock.

The record stays open until counsel documents the notice decision and IT verifies containment.

To evaluate this workflow, use a past incident your team has permission to review. Compare GC AI's cited draft with counsel's decision, unresolved evidence, notice deadline, and owner handoff before relying on it in a live matter.