Azure OpenAI is Microsoft’s cloud service that provides access to language models, including GPT-4, within the Azure infrastructure. If you deploy it in your company, remember: you, not Microsoft, are responsible for data, compliance with the GDPR and AI Act, and content generated by the model. This guide sets out the risks, duties, and steps to consider before deployment.
What is Azure OpenAI and how does it work?
Azure OpenAI is a Platform as a Service (PaaS): Microsoft provides the platform, while you are responsible for its configuration and use. You do not need to build your own AI infrastructure from scratch.
What the service offers:
- Access to OpenAI language models (GPT-4 and others) through APIs and SDKs
- Integration with existing systems and applications
- Different deployment types, standard and provisioned, tailored to business needs
- Content filtering and control over data location
- Microsoft support for security, configuration, and documentation
The service is intended for both large organizations and smaller companies that want to deploy AI quickly at scale, reliably and with regulations in mind.
Legal basis: which documents govern the use of Azure OpenAI?
The terms for using Azure OpenAI arise from Microsoft documents. Before deployment, review:
- Product Terms: license terms and rules for using the service
- Data Protection Addendum (DPA): data-processing and privacy-protection terms
- Microsoft Generative AI Code of Conduct: rules for permitted use of the models
For customers in the European Union, provisions on compliance with the GDPR and AI Act are particularly important.
What you need to establish before deployment
- Who is the data controller?: under the Azure OpenAI model, you, the customer, are the controller, and Microsoft acts as the processor.
- What duties arise from entrusting data processing?: you need a data processing agreement and appropriate GDPR documentation.
- What are the limits on liability?: Microsoft’s financial liability is limited to USD 5,000; Microsoft is not liable for indirect losses.
- Is data transferred outside the EEA?: if so, you must provide additional legal grounds for the transfer.
- Is the service operating in a preview version?: preview versions may not meet all personal data protection requirements.
Restriction on building competing tools
Microsoft stipulates that you may not use the service to build AI systems with functionality similar to Azure OpenAI without prior consent. If you plan to build your own commercial tools based on models, check this condition in the license documentation.
Responsibility rules: who is responsible for what?
Microsoft’s responsibilities
- Security of the cloud infrastructure (encryption and content filtering)
- Platform availability under the SLA terms
- Acting as a data processor and processing data only on the customer’s behalf
Your company’s responsibilities
- Lawful use: you decide what data to enter into the model and for what purpose you process it.
- Compliance with the Microsoft Generative AI Code of Conduct and license terms
- Security of applications and data processed through the service
- Informing users that they are using AI
- Honoring data subjects’ rights: access, erasure, and rectification
What you must not do
- Create disinformation or misleading content
- Generate malware
- Process sensitive data without meeting additional legal requirements
- Infringe third-party rights through generated content
Risk of service suspension: breaching these rules may result in restricted or blocked access to Azure OpenAI, or even termination of the contract.
Personal data processing: the GDPR and Azure OpenAI
How Microsoft processes your data
- Microsoft acts as a data processor and processes data on your behalf.
- Data (prompts, responses, and attachments) may be stored for 30 days to detect abuse.
- Microsoft does not use customer data to train models.
- Data is not shared with OpenAI or other entities.
What you must do as data controller
- Prepare a data processing agreement based on Microsoft’s DPA.
- Update your terms and privacy policy: tell users that AI processes their data.
- Choose an EU data-processing region to limit the need for transfers outside the EEA.
- Set a data-retention policy: determine how long data will be stored and how it will be deleted.
- Ensure people can exercise their rights: access, erasure, and rectification.
- Consider the Data Zone model: it allows precise control over data location within a selected geographic area.
Sensitive data: additional precautions
If you process sensitive or specially protected data, consider using modified abuse monitoring. Under this model, Microsoft does not store prompts and outputs, significantly reducing the risk of unauthorized access.
Abuse monitoring and content filtering
Microsoft has implemented a content-filtering system that analyzes in real time:
- content sent to the model (prompts)
- content generated by the model (responses)
The system detects hateful, violent, or harmful content.
Standard monitoring vs. modified monitoring
| Feature | Standard | Modified |
|---|---|---|
| Storage of prompts and outputs | Yes, temporarily | No |
| Human review | Possible | Disabled |
| Review by AI models | Yes | Yes |
| Additional formalities | No | Yes: application and security procedures |
When to request modified monitoring: if you process confidential, sensitive, or information covered by professional secrecy. Implementing this option requires prior consultation with legal and technical teams.
Checklist: what to do before deploying Azure OpenAI
- Review Microsoft’s documentation: Product Terms, DPA, and Code of Conduct
- Establish the data-processing roles: your company as controller and Microsoft as processor
- Prepare a data processing agreement
- Update the privacy policy and terms to include information about AI
- Choose an EU processing region
- Set a data-retention policy
- Assess whether modified abuse monitoring is needed
- Check compliance with the AI Act: duties apply to providers and users of AI systems
- Implement internal procedures to oversee AI use in the organization
- Consult an IT lawyer about deployment risks and documentation
Summary
Deploying Azure OpenAI is a technological, legal, and organizational decision at the same time. Microsoft is responsible for the platform, but you are responsible for the data, model-generated content, and compliance with regulations.
The main risks of being unprepared are:
- Risk of a GDPR breach: no data processing agreement and no notice to users
- Risk of service suspension: breach of Microsoft’s Code of Conduct
- Risk of AI Act non-compliance: missing documentation and procedures
- Risk of liability for AI-generated content: generated content that is unlabeled or false
Plan deployment with legal risk analysis, selection of an appropriate service-use model, and preparation of documentation. Cooperation between technical and legal teams is a condition of safe deployment.
Q&A: frequently asked questions about Azure OpenAI
Does Azure OpenAI process customers’ personal data?
Yes, if personal data is entered in prompts. Your company is the controller of that data and must ensure GDPR compliance.
Does Microsoft have access to data entered into the model?
Data is not shared with OpenAI or other customers. Microsoft stores it temporarily only for abuse monitoring, unless you submit a request for it not to be stored.
Can Azure OpenAI be used to build commercial applications?
Yes. The service is intended for commercial use. You must, however, follow Microsoft’s rules and ensure your application complies with the law.
What is modified abuse monitoring?
It is an option under which Microsoft does not store prompts and outputs. To enable it, submit a request and meet the technical and organizational requirements.
Is Azure OpenAI compliant with the AI Act?
Microsoft implements rules aligned with the AI Act. Remember, however, that you are responsible for your application’s compliance with these rules.
What are the main legal risks of using Azure OpenAI?
Missing terms, missing GDPR documentation, failing to label content as AI-generated, and unknowingly processing personal data in prompts.
