By Daniel Rohregger, Microsoft MVP Published
This assessment is my personal opinion (Daniel Rohregger), not a complete legal analysis.
Updated June 2026: Flex Routing, mandatory TIA, new admin toggles, and what that really means
Ever since Anthropic became an official subprocessor for Microsoft 365 Copilot, the debate has been simmering in German IT departments. Rightly so, but not for the reasons most people think. Here’s what actually applies, what’s still open, and why most companies can move ahead now.
What does “subprocessor” actually mean, and why does it matter?
Under Art. 28 GDPR, a data processor has to be bound by contract, may only process data for a defined purpose, and stays under the controller’s oversight. That’s exactly what Microsoft did when it onboarded Anthropic as a subprocessor, officially as of January 7, 2026. Microsoft is the contracting party. Anthropic works under Microsoft’s oversight, contractual safeguards, and technical and organizational measures (TOMs).
That’s not a footnote. It means the GDPR requirements for data processing are met. The Microsoft Data Protection Addendum (DPA), the Product Terms, and Enterprise Data Protection apply in full. If you doubt that, then by the same logic you’d have to doubt every other Microsoft service too, Exchange Online, SharePoint, and Teams included.
For completeness: the old “Anthropic Independent Processor” toggle, which let you use Anthropic under Anthropic’s own terms, was permanently turned off on May 1, 2026. Since then, it’s either the subprocessor route under the Microsoft contract or no Claude models at all. That makes things simpler, not weaker.
What subprocessor status includes:
-
No use of customer data for model training, documented and binding
-
Processing only for the inference task
-
Encryption in transit and at rest
-
The Microsoft Customer Copyright Commitment (CCC) also applies to Anthropic models in products such as Microsoft 365 Copilot and Copilot Studio
What isn’t covered yet (and Microsoft says so openly)
The concerns about EU data processing aren’t entirely unfounded. Anthropic models are currently officially excluded from the EU Data Boundary, which means inference requests are processed on Anthropic’s own infrastructure outside the EU. Microsoft says so explicitly in its documentation.
That transparency is the opposite of a problem: Microsoft puts admins in control. For tenants in the EU/EFTA and the UK, Anthropic is off by default, a deliberately cautious choice on privacy. Turning it on is a conscious opt-in.
Since April 2026, there have been two separate admin toggles, and you need to check both:
-
Global subprocessor toggle (Microsoft 365 admin center → Copilot → Settings → AI providers operating as Microsoft subprocessors): controls whether Anthropic is active as a subprocessor in the first place.
-
Feature-specific toggle “Copilot in M365 apps with Anthropic models” (from April 3, 2026): controls the use of Claude in Word, Excel, and PowerPoint for EU/EFTA/UK tenants.
For tenants created after March 25, 2026, the second toggle is on by default. That’s not a privacy loophole, but it is a good reason to check your own admin settings instead of trusting the defaults.
Flex Routing: what many people overlook (and it’s not just about Anthropic)
This is where it gets interesting, because the current Anthropic debate almost completely ignores it.
Since early 2026, EU/EFTA tenants have had something called Flex Routing. When capacity runs short, Microsoft can temporarily process LLM inference outside the EU, in the US, Canada, or Australia. And that applies not just to Claude models, but to the standard OpenAI/GPT path as well.
According to Microsoft’s documentation, data stays encrypted, and data at rest stays within the EUDB, except for pseudonymized operational data used for security purposes. Flex Routing is on by default for tenants created after March 25, 2026, and you can turn it off in the Microsoft 365 admin center.
What this means: if you reject Anthropic on EU data protection grounds but haven’t checked Flex Routing, you may have the very same issue on the OpenAI path without knowing it. The pragmatic answer isn’t to block both. It’s to manage and document both, on purpose.
The 10 strongest arguments for pragmatism
-
EU Standard Contractual Clauses (SCCs) are the recognized transfer mechanism. Transferring personal data to the US is generally permissible under GDPR if appropriate safeguards are in place. Microsoft relies on the EU Standard Contractual Clauses (SCCs, Art. 46 GDPR, Decision 2021/914/EC), explicitly not on the EU-US Data Privacy Framework. The SCCs are recognized by the CJEU and were upheld in the case law following Schrems II. So transfers to third countries are regulated, not prohibited. That includes a legal requirement for the controller to carry out a Transfer Impact Assessment (TIA), but with infrastructure as thoroughly documented as Microsoft’s, that’s very doable in practice.
-
Enterprise Data Protection offers more protection than many on-premises setups.
No training on customer data, encryption in transit and at rest, tenant isolation, Purview integration, a complete audit trail. That’s a lot more protection than many in-house IT environments provide.
-
The Copyright Commitment applies here too. The Microsoft Customer Copyright Commitment covers companies using Copilot features with Anthropic models. That’s a real enterprise-grade promise many alternatives don’t make.
-
Admins have full control, but they have to use it.
EU/EFTA admins can turn Anthropic models off, turn them on for specific user groups only, or block them completely. The company stays in control. Two separate toggles in the admin center plus fine-grained control through Entra ID security groups: that’s state-of-the-art enterprise governance.
-
The Yammer precedent: we’ve been here before.
For years, Yammer was hosted only in US data centers, even when the Microsoft 365 tenant was in the EU. Many companies accepted that, because what mattered was the contractual protections, not just where the servers physically sat. Anthropic is following the same pattern: contractual safeguards first, geographic expansion second, just like Azure, Exchange, and Teams before it.
-
Bing web grounding already leaves the EU boundary today, and hardly anyone notices.
Web search queries that Copilot sends to Bing are explicitly not covered by the DPA or the EU Data Boundary. There, Microsoft acts as an independent controller, and it always has. If you reject Anthropic but have web grounding turned on, you’re practicing selective data protection.
-
Selective outrage isn’t a legal strategy.
Amazon S3, Salesforce, Google Workspace, GitHub Copilot, ServiceNow: practically every enterprise SaaS tool processes data on US infrastructure. If Anthropic is the only thing that makes you raise an eyebrow, take a look at your entire software stack.
-
The competitive cost is real and measurable.
Researcher, Agent Mode in Excel, the Word and PowerPoint agents, Copilot Cowork: these features use Anthropic models. With Anthropic turned off, agents automatically fall back to OpenAI GPT-4o, with reduced capabilities. Companies that block across the board miss out on productivity gains that competitors in other markets are already getting.
-
For most companies, the legal risk is hypothetical. The obligations are not.
Unless there’s an industry-specific rule, there’s no legal obligation to process data only in the EU. The fear is cultural, not legal. But here’s what isn’t hypothetical: a TIA and a DPIA are mandatory for high-risk processing that involves transfers to third countries. Those obligations aren’t a roadblock. They’re documentation tasks, and with Microsoft’s infrastructure and existing compliance documentation, they’re very manageable.
-
Transparency beats silence.
Microsoft documents every part of the data flow, every exception, and every boundary, publicly and verifiably. In November 2025, after intensive negotiations with Microsoft, the HBDI (Hessian Commissioner for Data Protection and Freedom of Information) concluded that Microsoft 365 can, in principle, be run in compliance with data protection law. That assessment covers Microsoft’s internal path (OpenAI/Azure), but it shows that GDPR-compliant use of Microsoft 365 in Germany is possible and officially recognized. There’s no comparable statement for the Anthropic path yet, which makes documenting your own risk assessment all the more important.
What a “documented risk assessment” actually means
The first step isn’t a checkbox. It’s two concrete obligations, and both are manageable:
Transfer Impact Assessment (TIA, Art. 46 GDPR): a required part of any third-country transfer based on SCCs. It assesses whether US law (FISA 702, CLOUD Act) undermines the protection the SCCs provide. Microsoft offers extensive documentation for this. In most cases, the conclusion is that the transfer is justifiable with supplementary measures (encryption, data minimization).
Data Protection Impact Assessment (DPIA, Art. 35 GDPR): often mandatory for AI systems that access emails, documents, and communications and involve a third-country transfer. Think of it not as a brake, but as proof that you made a deliberate decision.
If you document both, you’re in a much stronger position with data protection authorities than companies that do nothing, whichever way you decide in the end.
Who really needs EU-only, and who doesn’t
The key question isn’t “Is data allowed to leave the EU?” It’s “Is there a legal or regulatory rule that prohibits it for my company specifically?”
Need to act:
-
Hospitals and medical practices (§ 203 of the German Criminal Code, KHZG, social data protection under SGB V/X)
-
BaFin-regulated financial institutions with explicit requirements
-
Public administration handling VS-NfD classified data (BSI approval required)
-
Tier-1 critical infrastructure operators (NIS2 implementation, KRITIS umbrella act)
-
Defense contractors with relevant classification levels
-
Companies with works council agreements that require EU-only processing
Can take a pragmatic approach:
-
Mid-sized companies without sector-specific regulation
-
Marketing, sales, HR, operations
-
Service providers without special confidentiality requirements
-
Companies already making heavy use of US SaaS
-
Anyone who already has Bing web grounding turned on in Copilot
The way forward: a conscious opt-in or opt-out, a documented TIA, and a DPIA where needed. No blind activation, but no knee-jerk blocking either.
What’s coming
Microsoft has clearly signaled that bringing Anthropic models into the EU Data Boundary is on the long-term roadmap. For Microsoft Foundry (API access for developers), EU-native inference is listed as “Coming 2026.” For Microsoft 365 Copilot, there’s no concrete timeline yet.
Once that happens, most of the open questions go away: EU data residency for Claude would be a given, and the third-country debate would be history. Until then, admins are in control, with a complete audit trail in Microsoft Purview.
If you make an informed, documented decision now, you’ll have a clear compliance advantage over companies that simply do nothing.
Bottom line
Anthropic as a Microsoft subprocessor is legally sound, fully covered by contract, and technically controllable. There are open points, above all the missing EU Data Boundary integration and a retention commitment for the Claude path that isn’t explicitly documented yet. Both are communicated openly, and you can control them through admin settings.
If you really need EU-only, your industry regulations have already told you so. Everyone else has a documentation task, not a legal problem. And that doesn’t call for slamming on the compliance brakes. It calls for a deliberate decision, a TIA, and clean governance documentation.
And if you think you can sidestep the issue by doing nothing: Flex Routing does exactly the same thing on the OpenAI path, and it’s been active for a long time.
Sources: Microsoft Learn (connect-to-ai-subprocessor, copilot-anthropic-apps, copilot-flex-routing, microsoft-365-copilot-privacy), Microsoft EU Data Boundary documentation, HBDI report November 2025, GDPR Art. 28 / 35 / 44 et seq., German Works Constitution Act (BetrVG) § 87 (1) No. 6
What this means for your workday
Everything you need is in this article. If you want to apply it to your own setup, coaching for IT teams and admins is the place to start.
