On November 5, 2026, Microsoft announced that Claude models in Microsoft Copilot are "coming into the EU Data Boundary." By the end of 2026, organizations in the European Union (EU) and the European Free Trade Association (EFTA) should be able to use Claude across Copilot experiences, including Copilot Cowork, with processing done inside the boundary where their data is already stored.
The word to watch is coming. This is a promise with a deadline. Nothing has switched over yet, and admins need to understand the difference before anyone updates a DPIA.
What Microsoft announced
The announcement came from Charles Lamanna, Microsoft's Executive Vice President for Copilot, Agents, and Platform. The main points:
- Scope: EU and EFTA organizations will be able to use Claude models "across Copilot experiences," and Copilot Cowork is named specifically.
- Timing: By the end of 2026. Microsoft gave no exact date, no phased schedule and no per-product timeline.
- Existing Claude users: Nothing to do. When the change is ready, processing moves into the EU Data Boundary automatically.
- Tenants that haven't enabled Claude: They can turn it on at any time. Processing will move into the boundary once the change is available.
- Defaults stay the same: Claude remains disabled by default in the EU and EFTA. Admins can enable it for all users or for selected users and groups in the Microsoft 365 admin center.
Microsoft says Claude will join other models, including Microsoft-operated ones, that already process data within the boundary. It also restated its existing promises: Claude in Copilot is covered by enterprise data protection, customer data isn't used to train generative AI foundation models, and admins decide who gets access. Microsoft says it will share more details closer to availability.
In short: this is a commitment about where Claude inference is processed. It is not a new model launch, and it does not describe how things work today.
Why this matters: the current documentation says the opposite
To see why the announcement matters, look at what Microsoft's own documentation says now.
Microsoft's Learn page on Claude models in Microsoft Online Services was last updated November 4, 2026, one day before the blog post. It still says Claude models in Microsoft Copilot, Researcher, Copilot Studio, Power Platform and Copilot in Microsoft 365 apps are "currently excluded" from the EU Data Boundary and, where applicable, from in-country processing commitments. It also says customers inside the EU Data Boundary and in the UK have Claude disabled by default.
Microsoft's EU Data Boundary transparency documentation is more specific. When customers allow Claude with Microsoft Generative AI Services, Anthropic processes Customer Data in the United States, while that data stays stored inside the EU Data Boundary. Storage and processing are two different things, and Claude currently gets only one of them.
This exclusion has been the main obstacle for European adopters all year. Jersey Finance noted that because Anthropic model processing is currently outside the EU Data Boundary... Anthropic models are disabled by default for customers in the EU, EFTA, and UK. One German consultant, Ragnar Heil, went further, arguing that the gap poses a significant data protection risk and should be administratively blocked until Microsoft or Anthropic provides a compliant processing solution within the European Union.
Copilot Cowork made things harder. Writing on the Copilot at Work Substack, one commentator pointed out that Anthropic models were covered by the DPA and EDP but they are not part of the EU Data Boundary yet. That left EU organizations out of one of Microsoft's most heavily promoted agent features. Microsoft naming Cowork in this announcement is a direct answer to that.
What hasn't changed, and the caveats
The UK is not included
The announcement covers the EU and EFTA only. It promises nothing for the United Kingdom, which Microsoft's documentation handles separately. As The AI Consultancy's guide for UK tenants puts it, the UK is not inside the boundary and its protection is a separate commitment. UK admins shouldn't read this as their change too.
"Anthropic models with Data Retention" are a separate category
Microsoft's Learn documentation describes two kinds of Claude access:
| Category | Contract basis | Retention | Opt-in |
|---|---|---|---|
| Standard Claude models (Anthropic as Microsoft subprocessor) | Microsoft Product Terms, DPA, Enterprise Data Protection | Governed by Microsoft terms | Off by default in EU/EFTA/UK. Enabled through the AI providers setting |
| Anthropic models with Data Retention | Anthropic's Commercial Terms of Service and Anthropic's DPA (Anthropic acts as an independent processor) | Anthropic stores most inputs and outputs for up to 30 days. Content flagged by trust-and-safety classifiers can be kept up to two years, and classification scores up to seven years | Always off by default, in every region. Needs a separate, explicit tenant opt-in |
The November 5 announcement doesn't mention the Data Retention category. Don't assume the boundary change covers those models, or that it changes their terms. Microsoft's documentation also says some newer models may arrive under separate controls and terms, so check each model's label as it appears.
The boundary has documented exceptions
Microsoft's EU Data Boundary transparency documentation lists several cases where data can still leave the boundary:
- Remote access by Microsoft personnel for operations and support
- Transfers that customers initiate themselves
- Global security operations
- Fulfilling GDPR data subject requests
The accurate summary of the announcement is "Claude processing moves inside the boundary for eligible EU/EFTA organizations." It does not mean no data ever leaves Europe.
There's also a separate issue around how Copilot routes model calls when demand is high. Innfactory reported that when European data centers are under high load, Copilot requests are automatically forwarded to data centers in other regions under a feature called Flex Routing. The blog post doesn't say how Claude processing will interact with that kind of capacity routing once it moves into the boundary. Ask about it when Microsoft publishes the updated documentation.
In short: the announcement solves one specific, well-known problem. The UK, Data Retention models and the boundary's existing exceptions are outside its scope.
How to enable Claude now (if you decide to)
Microsoft says organizations can enable Claude before the change, with processing moving into the boundary later. Until then, any Claude use in an EU/EFTA tenant still runs under today's arrangement, with processing in the United States. Your compliance review should be based on that, not on the promised end state.
According to Microsoft Learn, you need the AI Administrator or Global Administrator role. The steps:
- In the Microsoft 365 admin center, go to Copilot > Settings > View all.
- Select AI providers operating as Microsoft subprocessors.
- Under Available subprocessors for your organization, select Anthropic, then Save.
- Under Choose who can access Anthropic models for Copilot and generative AI experiences, pick your users or groups, then Save.
Some details worth knowing:
- Access is set at the provider level. You can limit it to specific users or Microsoft Entra ID security groups. Microsoft says those assignments apply across Microsoft Copilot and Copilot Studio.
- Copilot Studio and Power Platform need one more step. Once Anthropic is enabled in the Microsoft 365 admin center, extra controls appear in the Power Platform admin center that you must set before Anthropic can be used there.
- Old opt-ins may not carry over. EU, EFTA or UK tenants that previously opted in under Anthropic's separate commercial terms must opt in again. The toggle defaults to Off.
- Turning Claude off has side effects. Some features only work when Claude is enabled, so disabling Anthropic as a subprocessor can remove them.
- There's a separate Office apps setting. On April 3, 2026, Microsoft added a setting called "Copilot in Microsoft 365 apps with Anthropic models in EU/EFTA and UK." It makes Anthropic the default model for Copilot in Microsoft 365 apps. As Jersey Finance put it: Do not assume the settings are consistent across all surfaces.
What IT and compliance teams should do now
My view, based on general practice rather than anything Microsoft has stated:
- Leave your DPIA alone until the change is live. Today's processing is still outside the boundary. Record the announcement as a planned change, not a done one.
- Watch the Learn pages. The clearest sign the change has shipped will be Microsoft removing the "currently excluded" wording and the US-processing note from its documentation.
- Check which Claude models your tenant allows. Make sure nobody has enabled a Data Retention model without the separate legal review it needs.
- Look at your group assignments. If Claude is enabled, check who has access. Scoping by Entra group is your main way to limit exposure until the change arrives.
- Ask Microsoft specific questions. When will your tenant switch over? Is every Copilot surface covered, including Researcher, Copilot Studio and Power Platform? How will capacity routing work?
The bigger picture
This follows a familiar pattern for Microsoft. A new feature ships first, and the sovereignty commitments catch up later. The EU Data Boundary itself took years to roll out across Microsoft's services, and Claude is just the latest thing to be brought inside it.
What's different here is that a third-party model is being brought in. Microsoft is betting on offering several models in one Copilot, and that only works in Europe if a customer's compliance coverage is the same whichever model they pick. If a regulated bank in Frankfurt can't use half the models in the menu, the menu isn't much use to them.
If Microsoft meets its end-of-2026 date, European admins should finally be able to treat the model choice as a question of which model does the job best, rather than which one keeps data where legal needs it. For now, check the documentation before you rely on this, and treat the date as a target until Microsoft confirms the switch.