If legal called today, could you produce the Copilot record?

“Copilot data” is not one thing

The question “Can we discover Copilot?” is too broad to settle a preservation requirement. What was typed, what came back, what information was referenced and what was saved can be different records. An audit event adds another kind of evidence.

Microsoft documents mailbox-backed retention for AI prompts and responses. That is not a reason to skip the separate assessment of source documents, saved files or other artifacts created by the task.

Documented capability is not evidence that it is configured, licensed, deployed or operating as expected in a specific tenant.

Start with the legal question

Before testing collection, clarify what the matter requires. Different legal questions may require different records. Examples include:

• What did the user ask?
• What response was provided?
• What information was referenced?
• What document was created?
• What changes were made afterward?
• Who had access?
• What information was available at the time?

The first step is not collection. The first step is determining which records are needed to answer the question being investigated.

A successful collection can still fail if it returns records that do not establish the facts the matter requires.

Searchable, retained and held are different questions

Finding an item does not show that a policy will retain it for the required period. Having a policy does not show that a particular artifact is in scope. Applying a hold to one location does not, by itself, establish preservation across the rest of a workflow.

Use an evidence map to connect each required artifact to its location and controls. Identify any Pages, Notebooks, meeting materials or external source systems used in the task. Have the responsible team verify the supported behavior, licensing and actual configuration for each one.

Do not turn a product name or a broad Microsoft 365 policy into a claim that everything is covered. The test needs to show what you can collect and preserve, not just what the settings page says.

Run a controlled discovery exercise

1. Agree the purpose and success criteria with Legal, Compliance and IT. Use test material approved for the exercise.
2. Create a distinctive prompt and response in one enabled experience, then save a downstream output. Record the time, user and storage location.
3. Have an authorized reviewer search for the interaction and the saved artifact through the appropriate process.
4. Review the returned content, not just the result count. Check whether the records answer the question the exercise was designed to test.
5. Where preservation behavior must be tested, obtain approval for the method and scope. Keep real matters and real confidential information out of the test.
6. Record coverage, delays, gaps and follow-up actions. Repeat for materially different experiences rather than assuming one successful test covers all of them.

Illustrative example. A user asks for a project summary from approved notes, then saves the result as a document. The exercise should find the relevant interaction, the saved document and the source notes needed to understand the result. A record showing that Copilot was used is not the same as those content records.

Test before there is a real matter

The worst time to discover a gap is after receiving a preservation request or litigation hold notice.

Organizations routinely test backups, security controls and disaster recovery procedures. Discovery and preservation capabilities deserve the same treatment. A periodic exercise can help answer questions such as:

• Can the required records be found?
• Are the responsible teams identified?
• Do search results contain the expected information?
• Are preservation procedures documented?
• Do legal, compliance and IT teams agree on responsibilities?
• Can the collection process be repeated consistently?

If the first test occurs during active litigation, the organization may be managing both the matter and the discovery process at the same time.

Do not equate deleting the chat with deleting the information

Microsoft warns that deleting a conversation does not remove its associated Copilot memory. Treat any personalization relevant to the matter as a separate question for the authorized review team.

A changed or disappeared user view is not proof that preservation or permanent deletion has occurred.

Deletion and purge are separate, approved workflows. Do not remove a hold or change a retention policy because a general article suggests a cleanup. Those decisions belong with the people responsible for the matter and the records.

Keep the guide current, not just the policy document

Your review should leave:

• A usable artifact inventory
• A record of tested behavior
• Named owners for collection activities
• Documentation of known limitations
• An action plan for unresolved gaps

Recheck when:

• New Copilot experiences are enabled
• Storage behavior changes
• Retention configurations change
• New repositories are connected
• The people responsible for collection change

Our original discussion guide and compliance matrix are useful starting points for that conversation. They are not a substitute for current documentation, a tenant-specific test or instructions from your legal team.

Final thought

An organization should be able to answer a simple question at any time:

If Legal called this afternoon, which records would we collect, who would collect them, and how would we know the collection was complete?

The answer should not depend on assumptions, tribal knowledge or a product name. It should be supported by documented procedures, tested behavior and identified owners.

If that answer depends on assumptions, the review is not finished.