Microsoft Copilot for legal became generally available on 15 October, putting more than 20 purpose-built legal skills inside Copilot alongside partner-built plugins from the legal technology vendors most firms already run. Microsoft describes them as available to Copilot customers worldwide, which includes every UK firm holding a Copilot licence today.
What the skills do is the easy part. They redline an agreement against a playbook in Word as native tracked changes, draft from approved precedents held in SharePoint, extract obligations and deadlines across a contract portfolio, and build case chronologies. If you have used Copilot in Word, none of that will surprise you.
The harder questions are the three any UK firm has to answer before it deploys it, and two of them have a date attached. What does it actually cost, now that part of it is metered rather than licensed. Where does the work get processed, given that the United Kingdom sits outside Microsoft’s EU Data Boundary. And what does the SRA expect of you, following its warning notice of 17 August 2026.
The licence buys you the capability. It does not buy you the compliance position, and from 1 December it no longer buys you a predictable bill.
What Microsoft Released on 15 October
Microsoft Copilot for legal is two plugins, not one product. There is a Word plugin for deep document work, and a Cowork plugin for multi-step work across many files, emails and meetings. That split matters commercially, and we come back to it below.
Microsoft also published its own usage figures. Since the Frontier release in April, it reports more than 1,800 users generating nearly 100,000 edits and keeping roughly seven in ten suggestions. Its internal evaluations report more than 90 per cent fluency, more than 95 per cent conciseness and more than 85 per cent relevance.
Read those three numbers carefully. Fluency, conciseness and relevance are measures of how the writing reads. None of them is a measure of whether the law is right. Microsoft has not published a legal accuracy figure, and the seven-in-ten retention rate is a record of what lawyers chose to keep, not of what was correct. That is not a criticism of the product. It is the reason the verification duty set out further down cannot be delegated to the tool.
The Research Layer Is the Thin Part for a UK Firm
Microsoft named its launch partner plugins, and the list repays a close reading if you practise in England and Wales.
For document, matter and transaction management, the names are the ones you would expect: iManage Work, NetDocuments, Box, Litera, HighQ from Thomson Reuters, LegalZoom and Solve Intelligence. For agreements and signature: Docusign, Juro, Adobe Acrobat Sign, LawVu, SignatureAPI, Dropbox Sign and PandaDoc. For specialist legal AI: Harvey, Legora and DeepJudge. For e-discovery: Everlaw and Relativity.
Now the legal research category: Bloomberg Law, Trellis, Descrybe Legal Engine, Legal Data Hunter, Courtroom5 and Lawstronaut.
Westlaw UK is not there. Practical Law is not there. LexisNexis is not there. Thomson Reuters appears on the list, but through HighQ, which is a collaboration and matter platform rather than a research service. The research plugins that did ship are substantially oriented to US material.
So on the thing a UK firm most needs grounding in, reported authority in this jurisdiction, Copilot for legal currently has no first-party route to the sources your fee earners actually cite. It drafts and reviews against your own precedents and playbooks, which is genuinely useful and is where the time saving sits. It does not research English law against an authoritative database. Any firm planning to use it for that is planning to breach the duty set out further down this article.
Before You Promise the Partnership a Rollout
Most firms cannot say what their own tenant would let Copilot reach, because nobody owns the permissions picture. Talk to our team about the licensing and governance work behind a defensible Copilot rollout.
Talk to our teamWhat Microsoft Copilot for Legal Costs in the UK
Here are the list prices from Microsoft’s own UK pages, checked on 28 October 2026, all excluding VAT. The enterprise tier is on the Copilot for enterprise page and the rest on the Copilot for business page.
| What you buy | UK list price | What it requires | Metered element |
|---|---|---|---|
| Microsoft 365 Copilot (for Department), add-on | £23.10 per user per month paid yearly, or £24.26 paid monthly on annual commitment | A separate licence for a qualifying Microsoft 365 plan | Cowork and the Work IQ APIs |
| Microsoft 365 Copilot Business, add-on | Originally from £16.10 per user per month paid yearly, currently shown at £13.80 | A qualifying Microsoft 365 plan, until 1 December | Usage-based billing on by default for new CSP purchases from 1 December |
| Microsoft 365 Business Premium with Copilot | £24.60 per user per month paid yearly | Nothing further | Select advanced AI features |
| Microsoft 365 Business Standard with Copilot | £18.10 per user per month paid yearly | Nothing further | Select advanced AI features |
Microsoft does not state on its UK page how long the £13.80 rate runs, so budget on £16.10 and treat the difference as a windfall.
Three Changes Land Before 1 December
Three changes land within five weeks, and all three are in Microsoft’s October Partner Center announcements.
From 1 December, Copilot can be bought without a base Microsoft 365 subscription. The new Microsoft 365 Copilot and Copilot Business offers get their own product and SKU IDs at the same price, and the current add-on offers reach end of sale in CSP on that date. End of sale is not end of life: existing customers can keep renewing and adjusting seat quantities, and no migration or licence reassignment is required. Microsoft’s own caveat is the one to hold on to. The change “affects how customers purchase Copilot, not the underlying Copilot capabilities”, and Copilot experiences still depend on the Microsoft 365 apps and services you are licensed for. Being able to buy it standalone is not the same as it working standalone.
From 1 December, usage-based billing is on by default for new Copilot Business licences bought through CSP. The default spending limit is 4,000 Copilot Credits per user per month, adjustable by an administrator. Microsoft’s worked example is a customer with 100 Copilot Business users who could consume up to 400,000 credits a month under that default. The date has already moved once, from 2 November, so treat it as the current plan rather than a certainty. The change is initially unavailable in Australia, Belgium, Brazil, France, Germany, India, Italy, Korea, the Netherlands, Poland and Spain. The United Kingdom is not on that list, so UK firms are in scope from day one.
And this is where the two-plugin split becomes a budget question. Microsoft’s documentation lists Cowork as a service managed by usage-based billing. The legal skills that run in Cowork are the ones doing the heavy lifting on a matter: tracking obligations across a portfolio, comparing terms across agreements, building a chronology. The Word plugin sits inside the licence. The Cowork side consumes credits. A firm that licences Copilot for legal and then measures success by how much multi-file work it shifts into Cowork is, by design, growing a consumption bill that did not previously exist.
Microsoft does not publish a per-credit price in that documentation, pointing instead to its Copilot Credits licensing guide and a credit estimator. That is precisely why the default limit should be set deliberately, by someone who has modelled it, before 1 December rather than after the first invoice. Cost management sits in the Microsoft 365 admin centre under Copilot, where you can set organisation-level and user-level limits, scope policies to groups, and turn off the setting that automatically applies existing spending policies to future services. That last one is on by default.
One further licensing point catches firms out. Users of Cowork plugins must have Microsoft 365 Copilot licences assigned. You cannot deploy a legal plugin to the unlicensed half of the practice.
If you are still weighing the base plan underneath all this, our comparison of Microsoft 365 E3, E5 and E7 sets out what each tier includes, and our piece on what to do after a Copilot trial ends covers the licence-or-walk-away decision.
Where Your Data Actually Goes
Microsoft’s position on Copilot and data is accurate and frequently misread. The company states that Copilot processes prompts and responses within the Microsoft 365 service boundary with enterprise data protection, works only with content each user can access, honours sensitivity labels, and does not use prompts, responses or documents to train the underlying foundation models. All of that is true and all of it is worth having.
None of it is a statement about geography. The Microsoft 365 service boundary is a contractual and tenancy boundary, not a border.
Here is what Microsoft’s data, privacy and security documentation for Copilot says about location. Calls to the large language model “are routed to the closest data centers in the region, but also can call into other regions where capacity is available during high utilization periods.” On the boundary itself: “For EU customers, Microsoft Copilot is an EU Data Boundary service. Customers outside the EU may have their queries processed in the US, EU, or other regions.”
The EU Data Boundary consists of the countries of the European Union and the European Free Trade Association. For Microsoft 365, customers with a sign-up location in an EU or EFTA country are in scope. The United Kingdom is in neither group.
A UK law firm is therefore, in Microsoft’s own words, a customer outside the EU whose queries may be processed in the US, the EU or other regions. That is a sentence worth putting in front of your COLP before it appears in a client’s outsourcing questionnaire. Microsoft also notes that models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary.
The remedy is Advanced Data Residency, and it is a partial one that needs reading precisely. ADR is available to tenants whose default geography is one of a named list of local regions, and the United Kingdom is on that list. Microsoft 365 Copilot and Copilot Chat are both covered services. What ADR commits to is Customer Data stored at rest within your specific country or region. That is storage, not inference. It does not undo the routing behaviour quoted above.
ADR also has a licensing consequence that surprises people. Customers must cover every paid licence in the tenant with ADR add-on licences. A sixty-person firm licensing Copilot for its twelve corporate lawyers still buys ADR for all sixty seats.
Two smaller things to settle at the same time. Partner plugins reach outside Microsoft 365 by definition, and Microsoft is explicit that you cannot sign in on behalf of your users. Each person must complete the connector’s own sign-in or consent flow themselves, which means each person is making a data-sharing decision individually unless you have blocked the plugin. And Copilot prompts and responses are retained as Copilot activity history, discoverable through Content search and Microsoft Purview, with retention policies available for it. If you have not thought about what your retention schedule says about a partner’s prompts, now is the time. Our introduction to what Microsoft Purview is and whether you need it covers the groundwork.
The Information Barriers Problem
This one has had almost no coverage, and for a law firm it is the most consequential line in the documentation.
Microsoft Purview Information Barriers are how a regulated firm implements an ethical wall in Microsoft 365. They are the mechanism that stops the team on one side of a conflict communicating with, or discovering the content of, the team on the other. Plenty of UK firms depend on them.
Microsoft’s guidance on managing Cowork plugins carries this warning: “Microsoft Purview Information Barriers (IB) aren’t currently supported for plugin or skill management and sharing. In tenants where IB is enabled, embedded knowledge file uploads are blocked at the tenant level. This prevents affected plugins and skills from being uploaded or published.”
If your firm runs information barriers, parts of the plugin and skill model do not work in your tenant today. That is not a reason to abandon the rollout, because the Word plugin is a different thing from plugin authoring and sharing. It is a reason to establish what is and is not supported before you promise the partnership a firm-wide deployment. It also means your Copilot plan and your conflicts plan need to be written by people who are talking to each other. Information Barriers is one of the Purview services ADR covers, which at least keeps the two conversations inside the same procurement.
What the SRA Actually Requires
The SRA published its warning notice on the misuse of AI on 17 August 2026. It is addressed to all regulated firms and individuals, and it is short. Read it rather than a summary of it.
Its two concerns are inaccurate material, including invented authorities, and the exposure of confidential client information. On the first, the notice draws on R (on the application of Ayinde) v The London Borough of Haringey [2025] EWHC 1383 (Admin), a Divisional Court judgment of 6 June 2025 that dealt with two matters, Ayinde and the claim brought by Hamad Al-Haroun against Qatar National Bank QPSC. In the Al-Haroun schedule the court recorded “forty five citations that had been put before the court”, and its finding was blunt: “In eighteen instances, the case cited does not exist.” The court referred the matter to the regulator in terms: “We refer the matter to the Solicitors Regulation Authority.”
The judgment sets the standard any Copilot deployment has to be built around. Lawyers “have a professional duty therefore to check the accuracy of such research by reference to authoritative sources, before using it”, and “the critical safeguard is to check any output by reference to an authoritative source”. The court also held that “a lawyer is not entitled to rely on their lay client for the accuracy of citations of authority or quotations”, and noted that promulgating guidance on its own “is insufficient to address the misuse of artificial intelligence”.
The SRA’s own position is that reliance on an AI output “would not be a suitable defence in this scenario”.
The notice is specific about which rules are engaged, and these are the paragraphs to put in your AI policy rather than a general reference to professional standards. Under the Code of Conduct for Solicitors, RELs, RFLs and RSLs it lists paragraphs 1.4, 2.1, 2.2, 2.4, 2.5, 2.6, 2.7, 3.2, 3.5, 3.6, 6.3 and 7.2. Under the Code of Conduct for Firms it lists 1.4, 2.3, 4.2, 4.3, 4.4, 6.3 and 8.1, and the body of the notice also cites Firms paragraphs 2.1 and 9.1. Between them they cover not misleading the court or others, only putting forward assertions that are properly arguable, drawing the court’s attention to relevant authority, competent service, supervision and remaining accountable for work carried out through others, client confidentiality, effective governance, and being able to justify your decisions and actions.
On confidentiality, two points in the notice are worth quoting to anyone who thinks a paid subscription settles the question. First: “Both free to use and paid for AI systems may pose risks to client confidentiality.” Second, on privilege, legal professional privilege “may be permanently waived and unable to be recovered”.
This is where Copilot’s architecture genuinely helps, and where the distinction drawn earlier earns its keep. Copilot working inside your tenant, on content the user can already access, with no model training on your data, is a materially different confidentiality position from a fee earner pasting a letter into a consumer chatbot. That is a real argument and you should make it. What it is not is an answer to the processing-location question, or to what a partner plugin does with a prompt once it leaves Microsoft 365.
The notice does not put a number on how often this is happening. It says the SRA has received reports of potential breaches of its Code of Conduct from senior members of the judiciary, and refers to several instances of solicitors self-reporting. The regulator is not theorising.
How We Approach Microsoft Copilot for Legal in a Law Firm
Transputec treats a Copilot for legal rollout as four pieces of work, in this order.
Permissions before capability. Copilot surfaces what a user can already reach. In most firms, the honest answer to what a trainee can see in the document management system is “more than anyone intends”. That is a SharePoint and matter-security exercise, and it comes first. Our Copilot readiness checklist sets out the work.
The residency and boundary position, written down. Which plans you hold, whether ADR applies, what Microsoft commits to on storage versus processing, and what you will tell a client who asks. This is a document the COLP signs, not a slide.
Plugin governance, decided centrally. Which partner plugins are allowed, which are blocked, and who may consent to a connector. The controls sit in the Microsoft 365 admin centre under Agents, and the default position should be block then approve. Two details matter here. Publishing a plugin to the whole organisation needs an administrator to approve it, so that route is already gated. But there is no single tenant setting that turns off plugin sharing altogether, so a user can still share an uploaded plugin with specific colleagues, and blocking only takes effect for new conversations. Agents now hold their own credentials, which changes the risk picture again, and we covered that in Copilot agent governance.
Spending limits set before 1 December. Credit limits scoped by group, alerts configured, and the auto-apply setting reviewed rather than inherited.
Underneath all of it is the same security foundation the rest of the practice depends on, which we set out in cybersecurity for UK law firms. Firms running AWS alongside Microsoft 365 may also want our piece on AWS for UK law firms.
We are not a law firm and this is not legal advice. For a formal view on your own obligations, speak to your legal adviser or your COLP. Our work is the licensing, security and governance side that makes a deployment defensible once somebody has answered that question.
Where to Start
Microsoft Copilot for legal is a real capability, and the Word redlining experience is the most immediately useful thing Microsoft has shipped for lawyers. It is also a product whose research layer does not yet reach English authority, whose heaviest features are metered rather than licensed, whose processing location is not what most people assume, and which interacts awkwardly with the information barriers a regulated firm relies on.
None of those is a reason not to deploy it. All of them are reasons to deploy it deliberately, with the licensing, residency and supervision decisions made in writing before the first fee earner opens Word, and with 1 December in the diary.
If you want a view of what your tenant would currently let Copilot reach, and what your consumption bill would look like under the default limit, talk to our team about the licensing and governance work behind Copilot.
Frequently Asked Questions
Does Microsoft Copilot for legal need a separate licence?
No. Microsoft Copilot for legal has no separate SKU. The legal skills are generally available to Microsoft Copilot customers, so a firm holding Microsoft 365 Copilot or Copilot Business licences already has access. What does carry a cost is Cowork usage, which is billed by consumption in Copilot Credits rather than included, and anyone using a Cowork plugin must have a Microsoft 365 Copilot licence assigned.
Is our client data processed in the UK?
Not necessarily. Microsoft states that for EU customers Copilot is an EU Data Boundary service, and that customers outside the EU “may have their queries processed in the US, EU, or other regions”. The EU Data Boundary covers European Union and European Free Trade Association countries, and the United Kingdom is in neither. Advanced Data Residency commits to Customer Data being stored at rest in the UK and does cover Copilot, but it addresses storage rather than where inference happens.
Can we use Copilot for legal research on English law?
Not as a source of authority. Microsoft Copilot for legal shipped with research plugins from Bloomberg Law, Trellis, Descrybe Legal Engine, Legal Data Hunter, Courtroom5 and Lawstronaut. Westlaw UK, Practical Law and LexisNexis are not among them. In Ayinde the court held that lawyers have a professional duty to check research “by reference to authoritative sources, before using it”. Use Copilot against your own precedents and playbooks, and research in a research tool.
What does the SRA require us to have in place?
The warning notice sets out two concerns: inaccurate material including invented authorities, and the exposure of confidential client information. It states that reliance on an AI output “would not be a suitable defence”. Read with Ayinde, the practical consequence is that AI-generated legal content must be checked against an authoritative source before it is used, and that supervision cannot be delegated to the tool. The notice lists paragraphs 1.4, 2.1, 2.2, 2.4, 2.5, 2.6, 2.7, 3.2, 3.5, 3.6, 6.3 and 7.2 of the Code of Conduct for Solicitors, RELs, RFLs and RSLs, and 1.4, 2.3, 4.2, 4.3, 4.4, 6.3 and 8.1 of the Code of Conduct for Firms, with Firms 2.1 and 9.1 cited in the body.
Will Copilot break our information barriers?
Information barriers continue to govern access to content. What Microsoft states is that Purview Information Barriers “aren’t currently supported for plugin or skill management and sharing”, and that where information barriers are enabled, embedded knowledge file uploads are blocked at the tenant level, which prevents affected plugins and skills from being uploaded or published. Establish what that means for your tenant before committing to a firm-wide plugin strategy.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
