Do you use Azure OpenAI? Microsoft is responsible for the cloud infrastructure. You are responsible for data, applications, and compliance with the GDPR and AI Act. This guide sets out the division of responsibilities, Microsoft’s limitations, and the specific duties that apply to you as a user.
As discussed in the previous article, using this technology involves legal responsibility that cannot be ignored.
What are the Azure OpenAI responsibility rules?
Responsibility for Azure OpenAI follows a shared-responsibility model between Microsoft and the user. Microsoft secures the cloud infrastructure. You are responsible for how the technology is used and for the data processed.
Your company must ensure compliance with the GDPR and AI Act. You are responsible for how you use AI models, protect privacy, and monitor generated content.
The shared-responsibility model: who is responsible for what?
Shared responsibility has three layers:
- AI platform layer: Microsoft’s responsibility. This covers cloud infrastructure, encryption in transit and at rest, and platform-level safeguards.
- AI application layer: the user’s responsibility. This covers how AI is used in your applications, management of data processed by OpenAI models, and application-level safeguards.
- AI use layer: the organization’s responsibility. This covers actual use of the technology, monitoring GDPR and AI Act compliance, and internal procedures.
Both sides cooperate on data protection, preventing misuse, and appropriate use of AI systems.
Responsibility for data and security
Microsoft provides encryption for data in transit and at rest. But you are responsible for additional safeguards in your applications, particularly when you process personal data or sensitive information.
What you need to do under the GDPR
- Obtain appropriate consent for processing personal data.
- Honor data subjects’ rights: access, erasure, and rectification.
- Regularly audit and update data-security procedures.
- Choose an appropriate data-processing location (for example, a region in the EU). This matters for transfers outside the EEA.
What you need to secure on your side
- Protect applications and systems that integrate AI models against cyberattacks and malware.
- Have procedures for responding quickly to security incidents.
- Use mechanisms to prevent data breaches within your organization.
Abuse monitoring and content filtering
Microsoft has built mechanisms into the platform to detect and limit illegal or unethical use of the service. The system analyzes user behavior and AI-generated content in real time, detecting disinformation, hate speech, violence, and other material that does not comply with regulations.
How content review works
- The system automatically detects potential misuse and reviews data samples (prompts and responses).
- The samples are analyzed by an automated AI system.
- If necessary, people conduct an additional review.
Modified abuse monitoring option
If you process confidential or sensitive data (for example, medical or financial information), you can use the modified abuse-monitoring option. It allows you to disable human review of content generated by AI models. The article says this means your data will not be analyzed by third parties.
Remember: regardless of Microsoft’s mechanisms, you are responsible for how you use the service and what content you generate. Put internal review procedures in place before deploying it in production.
Limits on Microsoft’s liability
Before deploying Azure OpenAI, check which risks Microsoft does not assume:
- Indirect losses: Microsoft is not liable for lost profits, data, reputation, or other indirect losses arising from use of the service.
- Financial cap: Microsoft’s liability is limited to USD 5,000 and covers only direct losses related to the service’s operation.
- Violation of the Microsoft Generative AI Code of Conduct: if you do not follow the rules for ethical AI use, Microsoft may suspend or terminate your access to the service.
- Changes to terms: Microsoft reserves the right to suspend access or modify the service terms if AI-related laws change.
The business risk associated with errors, outages, and deployment consequences therefore remains with you.
Regulatory compliance: the AI Act and GDPR
AI Act: what applies now
The AI Act (the Artificial Intelligence Act), an EU regulation governing the use of AI, is already applicable law:
- Since February 2025: rules on prohibited AI practices apply.
- Since August 2025: rules on general-purpose AI models (GPAI) apply.
If you deploy Azure OpenAI, check whether your use meets AI Act requirements:
- Tell users when AI is used in your products and services.
- Introduce safeguards against harmful effects (disinformation and discrimination).
- Conduct a risk assessment for the use of AI.
- Ensure that AI systems allow for human oversight.
GDPR: allocation of roles and duties
Under the Azure OpenAI model, the roles are allocated as follows:
- Microsoft: data processor (it processes data on your instructions).
- You: data controller (you are responsible for lawful processing, consent, and honoring individuals’ rights).
Your duties as controller include:
- Establish a legal basis for processing personal data.
- Honor individuals’ rights to access, rectification, and erasure.
- Conduct a data protection impact assessment (DPIA) if you use AI to process personal data.
- Choose an EU data-storage location. Azure OpenAI offers this option, and the GDPR restricts transfers outside the EEA.
Summary: what to do now
Azure OpenAI offers significant capabilities but also entails specific legal duties. The GDPR and AI Act are in force; the article presents legal and procedural preparation as a legal requirement, not merely good practice.
If you use Azure OpenAI or plan to deploy it, take these steps first:
- Identify what data you process through AI models and the legal basis for doing so.
- Conduct a risk assessment under the AI Act.
- Check where data is stored and set the region to the EU.
- Put procedures in place to monitor AI-generated content.
- Update your documentation: contracts, terms, and data-processing policies.
- Conduct a DPIA if you process personal data using AI.
Sawaryn i Partnerzy helps prepare documentation (license agreements and terms), analyze data-processing risks, and prepare for AI Act and GDPR compliance. The firm also supports organizations deploying AI solutions with data-responsibility management.
Q&A: Azure OpenAI responsibility rules
- What does the shared-responsibility model in Azure OpenAI mean? Microsoft is responsible for cloud infrastructure security, while the user is responsible for the applications and data processed in that cloud.
- What data safeguards does Microsoft provide? Microsoft provides encryption and content-filtering systems, but the user is responsible for additional data safeguards in their own applications.
- What tools does Microsoft offer to monitor misuse? Microsoft offers mechanisms to detect and limit misuse, as well as modified monitoring that enables users to control data storage fully.
- Which legal rules apply to Azure OpenAI? Azure OpenAI use must comply with regulations such as the GDPR and AI Act, which are currently in force and make users responsible for data processing and responsible use.
