When your organization activates one or more Microsoft 365 Copilot licenses, a new regulation called AI Baseline appears in Compliance Manager. This regulation introduces a new set of improvement actions related to AI governance and responsible AI usage. As a result, Compliance Manager begins measuring controls related to AI usage alongside existing regulations (such as the Data Protection Baseline).
AI Baseline controls
In Compliance Manager, a control represents a requirement or objective that needs to be addressed. Controls are typically derived from standards, frameworks, or regulations, and describe what must be achieved from a governance or risk-management perspective.
Microsoft defines the baseline as follows:
The AI Baseline Template is a unified control framework developed by merging four globally recognized standards—ISO/IEC 42001, ISO/IEC 23894, NIST AI Risk Management Framework, and the EU AI Act—each contributing distinct properties to ensure comprehensive coverage of AI governance, risk management, and compliance. This consolidated baseline provides structured controls across domains such as governance, data management, design, deployment, and oversight, enabling organizations to implement responsible AI practices aligned with international regulations and ethical principles.
As we can see, these controls span areas such as governance, data management, monitoring, accountability, and lifecycle management of AI systems. Controls in AI Baseline therefore reflect AI governance principles rather than specific Microsoft 365 configurations.
AI Baseline improvement actions
Improvement actions are the operational layer of Compliance Manager – the meat of the regulation. They describe how controls can be implemented using Microsoft 365 capabilities.
The AI Baseline consists of 80 customer-managed improvement actions and 99 Microsoft-managed actions. The points distribution is:
- 972 customer-managed points achievable
- 1702 Microsoft-managed points achievable
Because Microsoft-managed controls are already implemented in the service, they contribute achieved points immediately when the regulation appears in Compliance Manager. This means that Compliance Score may actually increase when Copilot licenses are activated. How about that!
The 80 customer-managed improvement actions, 29 are unique to AI Baseline, while the remaining actions are also part of other regulations.
Working with AI Baseline assessments
Like other regulations in Compliance Manager, AI Baseline can be used to create assessments that help organizations track their AI governance progress over time.
An assessment allows organizations to:
- review AI-related controls in a structured way
- document implementation status
- assign responsibilities
- collect evidence
- track improvement actions
- measure progress through Compliance Score
This makes AI governance part of the organization’s existing compliance workflow, rather than a separate initiative.
