NTNU's Copilot Pilot in Norway's Data Protection Sandbox — A Public University Concludes It Is Not Ready to Roll Out Microsoft 365 Copilot

In spring 2024 the Norwegian University of Science and Technology (NTNU) tested Copilot for Microsoft 365 as part of the Norwegian Data Protection Authority's (Datatilsynet) regulatory sandbox, examining the tool through a data-protection lens and presenting eight main findings.
The exit report found that a data protection impact assessment is generally required for generative AI tools like Copilot and that DPIAs must be carried out continuously because the tool changes frequently. It noted that Copilot sees the same information as the user, so weak access management and poor control of personal data are made visible and amplified. It also identified structural challenges for data minimisation and purpose limitation and left US surveillance-law exposure as an unresolved legal risk.
NTNU concluded it was not ready to deploy Microsoft 365 Copilot across the whole organisation, partly because its own information governance was not orderly enough. The report was published openly, and the university's project documentation and a toolbox are public; the report also drew criticism in the Norwegian press.
This is a cautionary, candid case: value is in transparent risk findings, not in measured productivity gains, which the pilot did not establish.

Read the full analysis: https://www.ntnu.no/adm/it/copilot