Claude is now inside Microsoft Copilot — time to pump the brakes.

— The short version

Claude is now embedded in Microsoft 365 Copilot and Excel’s Agent Mode — and you don’t need to do anything for your employees to start using it. But the more important question: how are you going to manage data going to Claude, which is housed outside the Microsoft environment on AWS?

There are also broader concerns from regulators about the power of Claude itself. And finally: has Microsoft bypassed your internal governance and due diligence and simply introduced another AI tool into your environment?

The ink is barely dry on the Financial Stability Board’s urgent briefings over Anthropic’s Mythos model — a cybersecurity AI capable of finding software vulnerabilities faster than banks can patch them. The Fed, Treasury, OCC, and Bank of England have all been actively engaged, and only a select group of institutions — JPMorgan Chase, Bank of America, Goldman Sachs, Citigroup, and Morgan Stanley — have been granted access. Now Claude is arriving inside Microsoft Copilot.

In the span of about six months, Claude went from “an Anthropic product you’d buy separately” to “a model option sitting inside Word, Excel, Outlook, and the Researcher agent.” That is a major capability upgrade — and a major change in how non-public information moves through your environment. Most institutions have not updated a single policy, risk assessment, or third-party review to reflect it.

To be clear: I remain a big fan of Claude. Used inside a properly governed Claude Team environment, it is a genuinely strong tool. But context matters — and the context just changed.

Six reasons to pump the brakes

— 01

The contractual stack is more complicated than it looks.

Your Microsoft enterprise agreement governs Copilot. Anthropic’s model runs on AWS infrastructure. Microsoft is the intermediary. When something goes wrong — a data exposure, a hallucinated output that caused harm, a regulator question about where prompts are processed — which contract controls? Which party is liable? Most banks have not yet seen, let alone reviewed, the underlying terms. Until your vendor management team has those answers in writing, you do not have a complete third-party risk picture.

What to do instead

Waiting does not mean ignoring. The institutions that handle this best use the next two to three quarters to put governance in place before broad rollout.

— Do these first

• Update your acceptable use policy to address generative AI inside Microsoft 365 specifically — including what categories of data may and may not be entered.
• Inventory every AI tool currently in use, including shadow AI — personal ChatGPT, personal Claude, Copilot, browser-based assistants.
• Get the underlying Microsoft + Anthropic terms in writing and have your vendor management team review them against your third-party risk policy.
• Extend your model risk management policy to address general-purpose LLMs — define which use cases require validation and which are productivity assistance.
• Map the data flow: where prompts go, where outputs are stored, what is logged, and how long retention runs.
• Draft an incident response addendum for AI-specific events: hallucinated outputs, data exposure through prompts, model unavailability during critical windows.
• Pilot in a tightly scoped, low-risk function (internal knowledge search, meeting summarization) with named users — not tenant-wide.
• Prepare an examiner-ready packet: policy, contract, DPA, user list, training records, monitoring approach.

— The bottom line

Institutions need to actively govern their adoption and use of AI — not let employees, clever marketing, or automatic platform integration run the institution’s AI program.

— Ready When You Are

Slow down now, move with confidence later.