Summary in 5 points
- Microsoft Copilot processes prompts via Azure OpenAI; Amaii processes prompts inside the customer environment (on-premise or private cloud in the EU).
- Amaii is model-agnostic (Llama, Mistral, Mixtral, EU-commercial) — Copilot uses only OpenAI models managed by Microsoft.
- Both integrate with SharePoint, Teams and OneDrive via the Microsoft Graph API; Amaii additionally works with any other source.
- Amaii delivers full audit logging and document-level RBAC — essential for NEN 7510, DORA and BIO.
- Copilot costs around €30 per user per month on top of existing licences; Amaii charges per user group plus infrastructure and is often more cost-effective above 200 users.
Comparison table
| Criterion | Amaii | Microsoft Copilot |
|---|---|---|
| Data processing location | Customer infrastructure (on-premise or private cloud in EU) | Microsoft Azure (EU Data Boundary) |
| Processing party | No third parties — all inside customer environment | Microsoft + OpenAI models on Azure |
| Choice of language model | Open-source (Llama, Mistral, Mixtral) or EU-commercial | Fixed — OpenAI models managed by Microsoft |
| GDPR-compliant | Yes, by design (no external processing) | Yes, contractually via EU Data Boundary |
| NEN 7510 / DORA / BIO ready | Yes, fit for strictly regulated sectors | Limited — requires additional setup and risk assessment |
| Microsoft 365 integration | Yes (Graph API: SharePoint, Teams, OneDrive) | Yes, native |
| Works outside Microsoft 365 | Yes (Confluence, file shares, Google Workspace, internal APIs) | No — requires Microsoft 365 |
| Per-action audit logging | Full — user, document, prompt, answer | Via Purview, limited at prompt level |
| Document-level RBAC | Yes, native | Inherits SharePoint permissions |
| Vendor lock-in | None — model and infrastructure are replaceable | Yes — requires Microsoft stack |
| Cost (indicative) | Per user group + infra; more favourable at scale | ~€30 per user per month on top of M365 |
| Time-to-PoC | 4-6 weeks | Days to activate; weeks to months for governance |
How Microsoft Copilot processes your data
Microsoft Copilot for 365 works by retrieving prompts and relevant context (emails, documents, chats) from your tenant and sending them to Azure OpenAI Services. The response is generated there and returned. Microsoft guarantees that this processing happens within the EU Data Boundary and that prompts are not used to train public models.
For most general productivity scenarios that is sufficient. For organisations working with patient records (NEN 7510), financial customer data (DORA), legal case files (professional secrecy) or government information (BIO), a fundamental problem arises: the data still passes through an external processor and a third-party-managed model. In many risk and compliance frameworks that is not acceptable.
How Amaii processes your data
Amaii installs a private AI stack inside your own environment: a RAG pipeline (Retrieval-Augmented Generation), a vector database and an LLM of your choice. When a user asks a question, every step — retrieval, embedding, generation — stays inside the customer infrastructure. There is no external API call to OpenAI, Microsoft or Google.
Documents themselves can be synchronised from SharePoint, Teams and OneDrive via the Microsoft Graph API, but once they are in Amaii they are processed by a locally running language model. That makes Amaii suitable for sectors where every external data flow must first be approved by a Data Protection Officer or regulator.
Compliance: GDPR, NEN 7510, DORA and the EU AI Act
Microsoft Copilot complies with GDPR through Microsoft's contractual safeguards and the EU Data Boundary. For NEN 7510 (healthcare) and DORA (finance) that is usually not enough: both frameworks require the organisation itself to retain control over processors, models and logging. Amaii operates without an external processor and gives full control over every layer.
- GDPR: with Amaii no external processor; with Copilot there is one (Microsoft + OpenAI within EU Data Boundary).
- NEN 7510: Amaii supports fully isolated processing of medical data inside the healthcare institution.
- DORA: Amaii provides audit trails and risk controls that align directly with ICT third-party management.
- EU AI Act: Amaii supports transparency requirements, logging obligations and risk classification of AI systems.
- BIO (public sector): Amaii operates within national borders without dependency on US hyperscalers.
Functionality: what can you do with it?
Microsoft Copilot excels at daily productivity: summarising emails in Outlook, generating slides in PowerPoint, formulas in Excel. It is an AI layer on top of the tools you already use. Amaii is not an Office assistant — it is a private company brain that answers questions about your own contracts, case files, policies and historical projects.
Many organisations deploy both side by side: Copilot for general productivity, Amaii for the confidential knowledge layer where compliance and accuracy matter more than speed.
Cost and scalability
Copilot charges roughly €30 per user per month on top of existing Microsoft 365 licences. At 500 users that is €180,000 per year — recurring, scaling with the organisation. Amaii uses a licence model per user group plus infrastructure cost (own GPUs or EU cloud).
For small teams (under 50 users) Copilot is often cheaper. From around 200 users, and certainly at high usage intensity, Amaii typically becomes more cost-effective. It also avoids vendor lock-in: model and infrastructure are replaceable.
Governance, audit logging and RBAC
Amaii logs every AI interaction at the level of user, document, prompt and answer. For sectors with inspection or audit obligations (healthcare, finance, legal), that is a hard requirement. Microsoft Purview offers audit capabilities for Copilot, but granularity at prompt and answer level is more limited and requires additional configuration.
Amaii's role-based access control (RBAC) works at document level and is independent of SharePoint permissions — useful when documents come from multiple sources or when separate AI rights are needed.
When do you choose Microsoft Copilot?
Copilot makes sense when your organisation is fully on Microsoft 365, most use cases concern general productivity (email, documents, summarising), and compliance requirements fit within what Microsoft contractually offers. For mid-market companies without strict sector regulation, Copilot is often the fastest route to AI value.
When do you choose Amaii?
Amaii is the right choice if at least one of these applies: your organisation falls under NEN 7510, DORA or BIO; you work with client privilege or professional secrecy; intellectual property or strategic information must not leave the organisation; you want to be independent of US Big Tech; or you want full control over model choice and audit logging.
- Healthcare institutions handling patient data under NEN 7510.
- Financial services and pension funds under DORA supervision.
- Law firms, notaries and legal departments with client privilege.
- Accounting and tax firms with professional secrecy.
- Public sector and executive agencies that must stay within BIO and data sovereignty.
- Consultancy and R&D with sensitive intellectual property.
Common misconceptions
"Copilot is safe enough because it runs in our tenant." Data retrieval happens in your tenant, but the generative processing happens on Microsoft-managed models on Azure. That is still an external processing step, however well it is contractually arranged.
"A private LLM is always more expensive." For small teams that is true. But above a few hundred users, or at high intensity, the maths often flips thanks to scale and the disappearance of per-seat fees.
"We have to choose between Copilot or a private solution." No. Most of our customers use Copilot for general productivity and Amaii for the confidential knowledge layer. They are complementary tools.
