{"id":3924,"date":"2025-04-11T13:56:54","date_gmt":"2025-04-11T13:56:54","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3924"},"modified":"2026-10-23T09:49:31","modified_gmt":"2026-10-23T09:49:31","slug":"azure-openai-ai-software-development","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/azure-openai-ai-software-development\/","title":{"rendered":"How to Use Azure OpenAI to Build AI Software"},"content":{"rendered":"<p>Azure OpenAI is Microsoft\u2019s cloud service that provides access to language models, including GPT-4, within the Azure infrastructure. If you deploy it in your company, remember: you, not Microsoft, are responsible for data, compliance with the <strong><a href=\"https:\/\/sawaryn.com\/publikacje\/co-to-jest-rodo\/\">GDPR<\/a><\/strong> and AI Act, and content generated by the model. This guide sets out the risks, duties, and steps to consider before deployment.<\/p>\n<hr \/>\n<h2>What is Azure OpenAI and how does it work?<\/h2>\n<p>Azure OpenAI is a <strong>Platform as a Service (PaaS)<\/strong>: Microsoft provides the platform, while you are responsible for its configuration and use. You do not need to build your own AI infrastructure from scratch.<\/p>\n<p><strong>What the service offers:<\/strong><\/p>\n<ul>\n<li>Access to OpenAI language models (GPT-4 and others) through APIs and SDKs<\/li>\n<li>Integration with existing systems and applications<\/li>\n<li>Different deployment types, standard and provisioned, tailored to business needs<\/li>\n<li>Content filtering and control over data location<\/li>\n<li>Microsoft support for security, configuration, and documentation<\/li>\n<\/ul>\n<p>The service is intended for both large organizations and smaller companies that want to deploy AI quickly at scale, reliably and with regulations in mind.<\/p>\n<hr \/>\n<h2>Legal basis: which documents govern the use of Azure OpenAI?<\/h2>\n<p>The terms for using Azure OpenAI arise from Microsoft documents. Before deployment, review:<\/p>\n<ul>\n<li><strong>Product Terms<\/strong>: license terms and rules for using the service<\/li>\n<li><strong>Data Protection Addendum (DPA)<\/strong>: data-processing and privacy-protection terms<\/li>\n<li><strong>Microsoft Generative AI Code of Conduct<\/strong>: rules for permitted use of the models<\/li>\n<\/ul>\n<p>For customers in the European Union, provisions on compliance with the <strong>GDPR<\/strong> and <strong>AI Act<\/strong> are particularly important.<\/p>\n<h3>What you need to establish before deployment<\/h3>\n<ol>\n<li><strong>Who is the data controller?<\/strong>: under the Azure OpenAI model, you, the customer, are the controller, and Microsoft acts as the processor.<\/li>\n<li><strong>What duties arise from entrusting data processing?<\/strong>: you need a data processing agreement and appropriate GDPR documentation.<\/li>\n<li><strong>What are the <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/azure-openai-responsibility\/\">limits on liability<\/a>?<\/strong>: Microsoft\u2019s financial liability is limited to USD 5,000; Microsoft is not liable for indirect losses.<\/li>\n<li><strong>Is data transferred outside the EEA?<\/strong>: if so, you must provide additional legal grounds for the transfer.<\/li>\n<li><strong>Is the service operating in a preview version?<\/strong>: preview versions may not meet all personal data protection requirements.<\/li>\n<\/ol>\n<h3>Restriction on building competing tools<\/h3>\n<p>Microsoft stipulates that you may not use the service to build AI systems with functionality similar to Azure OpenAI without prior consent. If you plan to build <strong><a href=\"https:\/\/sawaryn.com\/en\/publikacje\/azure-openai-ai-software-development\/\">your own commercial tools based on models<\/a><\/strong>, check this condition in the license documentation.<\/p>\n<hr \/>\n<h2>Responsibility rules: who is responsible for what?<\/h2>\n<h3>Microsoft\u2019s responsibilities<\/h3>\n<ul>\n<li>Security of the cloud infrastructure (encryption and content filtering)<\/li>\n<li>Platform availability under the SLA terms<\/li>\n<li>Acting as a data processor and processing data only on the customer\u2019s behalf<\/li>\n<\/ul>\n<h3>Your company\u2019s responsibilities<\/h3>\n<ul>\n<li><strong>Lawful use<\/strong>: you decide what data to enter into the model and for what purpose you process it.<\/li>\n<li><strong>Compliance with the Microsoft Generative AI Code of Conduct<\/strong> and license terms<\/li>\n<li><strong>Security of applications<\/strong> and data processed through the service<\/li>\n<li><strong>Informing users<\/strong> that they are using AI<\/li>\n<li><strong>Honoring data subjects\u2019 rights<\/strong>: access, erasure, and rectification<\/li>\n<\/ul>\n<h3>What you must not do<\/h3>\n<ul>\n<li>Create disinformation or misleading content<\/li>\n<li>Generate malware<\/li>\n<li>Process sensitive data without meeting additional legal requirements<\/li>\n<li>Infringe third-party rights through generated content<\/li>\n<\/ul>\n<p><strong>Risk of service suspension:<\/strong> breaching these rules may result in restricted or blocked access to Azure OpenAI, or even termination of the contract.<\/p>\n<hr \/>\n<h2>Personal data processing: the GDPR and Azure OpenAI<\/h2>\n<h3>How Microsoft processes your data<\/h3>\n<ul>\n<li>Microsoft acts as a <strong>data processor<\/strong> and processes data on your behalf.<\/li>\n<li>Data (prompts, responses, and attachments) may be stored for <strong>30 days<\/strong> to detect abuse.<\/li>\n<li>Microsoft <strong>does not use customer data to train models<\/strong>.<\/li>\n<li>Data <strong>is not shared with OpenAI or other entities<\/strong>.<\/li>\n<\/ul>\n<h3>What you must do as data controller<\/h3>\n<ol>\n<li><strong>Prepare a <a href=\"https:\/\/sawaryn.com\/publikacje\/wdrozenie-rodo-w-firmie-audyt-danych-osobowych-rodo-gdpr-i-outsourcing-iod\/\">data processing agreement<\/a><\/strong> based on Microsoft\u2019s DPA.<\/li>\n<li><strong>Update your terms and <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/gdpr-privacy-cookie-policy-requirements\/\">privacy policy<\/a><\/strong>: tell users that AI processes their data.<\/li>\n<li><strong>Choose an EU data-processing region<\/strong> to limit the need for transfers outside the EEA.<\/li>\n<li><strong>Set a data-retention policy<\/strong>: determine how long data will be stored and how it will be deleted.<\/li>\n<li><strong>Ensure people can exercise their rights<\/strong>: access, erasure, and rectification.<\/li>\n<li><strong>Consider the Data Zone model<\/strong>: it allows precise control over data location within a selected geographic area.<\/li>\n<\/ol>\n<h3>Sensitive data: additional precautions<\/h3>\n<p>If you process sensitive or specially protected data, consider using <strong>modified abuse monitoring<\/strong>. Under this model, Microsoft does not store prompts and outputs, significantly reducing the risk of unauthorized access.<\/p>\n<hr \/>\n<h2>Abuse monitoring and content filtering<\/h2>\n<p>Microsoft has implemented a content-filtering system that analyzes in real time:<\/p>\n<ul>\n<li>content sent to the model (prompts)<\/li>\n<li>content generated by the model (responses)<\/li>\n<\/ul>\n<p>The system detects hateful, violent, or harmful content.<\/p>\n<h3>Standard monitoring vs. modified monitoring<\/h3>\n<table>\n<thead>\n<tr>\n<th>Feature<\/th>\n<th>Standard<\/th>\n<th>Modified<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Storage of prompts and outputs<\/td>\n<td>Yes, temporarily<\/td>\n<td>No<\/td>\n<\/tr>\n<tr>\n<td>Human review<\/td>\n<td>Possible<\/td>\n<td>Disabled<\/td>\n<\/tr>\n<tr>\n<td>Review by AI models<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Additional formalities<\/td>\n<td>No<\/td>\n<td>Yes: application and security procedures<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>When to request modified monitoring:<\/strong> if you process confidential, sensitive, or information covered by professional secrecy. Implementing this option requires prior consultation with legal and technical teams.<\/p>\n<hr \/>\n<h2>Checklist: what to do before deploying Azure OpenAI<\/h2>\n<ol>\n<li><strong>Review Microsoft\u2019s documentation<\/strong>: Product Terms, DPA, and Code of Conduct<\/li>\n<li><strong>Establish the data-processing roles<\/strong>: your company as controller and Microsoft as processor<\/li>\n<li><strong>Prepare a data processing agreement<\/strong><\/li>\n<li><strong>Update the privacy policy and terms<\/strong> to include information about AI<\/li>\n<li><strong>Choose an EU processing region<\/strong><\/li>\n<li><strong>Set a data-retention policy<\/strong><\/li>\n<li><strong>Assess whether modified abuse monitoring is needed<\/strong><\/li>\n<li><strong>Check compliance with the <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/what-is-an-ai-system-under-the-ai-act\/\">AI Act<\/a><\/strong>: duties apply to providers and users of AI systems<\/li>\n<li><strong>Implement internal procedures<\/strong> to oversee AI use in the organization<\/li>\n<li><strong>Consult an IT lawyer<\/strong> about deployment risks and documentation<\/li>\n<\/ol>\n<hr \/>\n<h2>Summary<\/h2>\n<p>Deploying Azure OpenAI is a technological, legal, and organizational decision at the same time. Microsoft is responsible for the platform, but you are responsible for the data, model-generated content, and compliance with regulations.<\/p>\n<p>The main risks of being unprepared are:<\/p>\n<ul>\n<li><strong><a href=\"https:\/\/sawaryn.com\/publikacje\/zgloszenie-naruszenia-rodo-wyciek-danych-osobowych\/\">Risk of a GDPR breach<\/a><\/strong>: no data processing agreement and no notice to users<\/li>\n<li><strong>Risk of service suspension<\/strong>: breach of Microsoft\u2019s Code of Conduct<\/li>\n<li><strong>Risk of AI Act non-compliance<\/strong>: missing documentation and procedures<\/li>\n<li><strong>Risk of liability for AI-generated content<\/strong>: generated content that is unlabeled or false<\/li>\n<\/ul>\n<p>Plan deployment with legal risk analysis, selection of an appropriate service-use model, and preparation of documentation. Cooperation between technical and legal teams is a condition of safe deployment.<\/p>\n<hr \/>\n<h2>Q&amp;A: frequently asked questions about Azure OpenAI<\/h2>\n<p><strong>Does Azure OpenAI process customers\u2019 personal data?<\/strong><\/p>\n<p>Yes, if personal data is entered in prompts. Your company is the controller of that data and must ensure GDPR compliance.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Does Microsoft have access to data entered into the model?<\/strong><\/p>\n<p>Data is not shared with OpenAI or other customers. Microsoft stores it temporarily only for abuse monitoring, unless you submit a request for it not to be stored.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Can Azure OpenAI be used to build commercial applications?<\/strong><\/p>\n<p>Yes. The service is intended for commercial use. You must, however, follow Microsoft\u2019s rules and ensure your application complies with the law.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>What is modified abuse monitoring?<\/strong><\/p>\n<p>It is an option under which Microsoft does not store prompts and outputs. To enable it, submit a request and meet the technical and organizational requirements.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Is Azure OpenAI compliant with the AI Act?<\/strong><\/p>\n<p>Microsoft implements rules aligned with the AI Act. Remember, however, that you are responsible for your application\u2019s compliance with these rules.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>What are the main legal risks of using Azure OpenAI?<\/strong><\/p>\n<p>Missing terms, missing GDPR documentation, failing to label content as AI-generated, and unknowingly processing personal data in prompts.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A practical overview of Azure OpenAI deployment, responsibilities, data protection, abuse monitoring, key risks, and a pre-deployment checklist.<\/p>\n","protected":false},"author":10,"featured_media":1899,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"","sip_pair_state":""},"categories":[1577],"tags":[1545,1446,1543],"specialization":[1211],"practice_area":[],"class_list":["post-3924","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it-ai-ip-law","tag-ai-act-en","tag-gdpr","tag-it-ai-and-ip-law","specialization-it-ai-ip-law"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=3924"}],"version-history":[{"count":1,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3924\/revisions"}],"predecessor-version":[{"id":4143,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3924\/revisions\/4143"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media\/1899"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=3924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=3924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=3924"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=3924"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=3924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}