Not all Microsoft 365 Copilot components process data in Australia, says a DTA guide published with the government’s new AI Reference Architecture

The AI Reference Architecture, which the DTA calls AIRA, is a set of common building blocks for Commonwealth agencies designing or buying AI systems: five functional layers from the user interface down to the data centre, plus the controls that are meant to run through all of them. The document says it provides an architectural foundation for designing, implementing and governing artificial intelligence (AI) across the Australian Government. Most of it is written for architects. The part an ordinary reader can use is the companion guide, which applies the framework to four representative cases and names the product in the first one.

What the guide says about Copilot and Australian data

The first scenario is an agency switching on AI inside software it already runs. Its example is Microsoft 365 Copilot, in an already deployed Microsoft ecosystem. Working through where the data goes, the guide reaches the sentence most likely to surprise anyone who assumed an Australian tenancy settles the question.

Specifically, not all Copilot components listed in Table 1 process data in Australia.

AI Reference Architecture Companion Guide, Scenario 1

The sentence before it sets up the distinction: an Australian data centre commitment for Microsoft 365 data at rest does not necessarily indicate that all Copilot inference workloads are processed in Australia. The sentence after gives the reasons: Some components may rely on inference infrastructure located outside Australian jurisdiction, and other factors may influence data processing, such as when the LLM is under high load. The guide’s answer is to check each component before enabling it, so that the result is consistent with PSPF obligations for the classifications of information Copilot will access. The Protective Security Policy Framework is one of the two Commonwealth frameworks that bind agencies on AI.

Microsoft’s own documentation says much the same. Its page on data, privacy and security for Copilot, last updated on 3 November, says Microsoft Copilot calls to the LLM are routed to the closest data centers in the region, but also can call into other regions where capacity is available during high utilization periods. It also says Microsoft Copilot is upholding data residency commitments as outlined in the Microsoft Product Terms and Data Protection Addendum, and that its Advanced Data Residency and Multi-Geo offerings include commitments for Copilot. On processing outside Europe, one line is plain: Customers outside the EU may have their queries processed in the US, EU, or other regions.

The guide splits Copilot into what Microsoft runs and what the agency can set. Its Table 1, condensed:

The guide also hedges its own findings. It says the analysis rests on the document versions in its references, whose vendor sources are Microsoft Learn pages retrieved in May 2026 and a 2024 Microsoft 365 security assessment by CyberCX, and that The key takeaway is the architecture method rather than the vendor-specific findings. It tells agencies to get current evidence from providers.

What else the Copilot example flags

Data location is one of several gaps the guide lists. Three more matter to anyone who has to account for work done with Copilot.

Quotations from Scenario 1 of the companion guide. “Why it matters” is our summary of the guide’s surrounding text.

The guide adds that vendor model updates are outside agency control, and models are hosted outside agency tenancy. Its recommended path is staged: enable first where the agency has direct control, adequate evidence and advisory use; defer or constrain uses where it does not; and exclude uses where the gaps cannot be fixed.

Buying an AI agent to answer the phones

The third scenario is the one a member of the public is most likely to meet: an agency procuring an agentic call centre system, which may deal directly with the public, act across back-office systems and initiate actions on the agency’s behalf. The guide says its example control profile is based on the public documentation of a real product, which it does not name. Among the things it lists for agencies to assess is mandatory escalation for crisis callers, vulnerability disclosures, complaints and legally sensitive interactions. Its conclusion on what to do when a product falls short is direct.

Where these conditions cannot be met, agencies may need to narrow action scope, require stronger disclosure and contractual control, or defer procurement rather than accept reduced governability.

AI Reference Architecture Companion Guide, Scenario 3

The main architecture document adds a line for anyone who would rather not deal with an AI at all. Where AI is put into a service channel, it says, the architecture should also consider routing users to non-AI alternatives and sustaining equitable service access for users who decline or cannot engage with AI.

Where the architecture sits

None of this is a rule. AIRA is guidance, and it says what it does not do: Following AGA principles, AIRA does not mandate any products, platforms or solution designs. It then says agency architectures should be in line with AIRA, using its shared structure, language and guidelines.

1. Policy for the responsible use of AI in government

   Mandatory for non-corporate Commonwealth entities (what it requires)

2. AI technical standard, Statement 2

   Under Agencies must: it lists Criterion 4: Evaluate existing reference architectures.

3. AI Reference Architecture and companion guide Version 1.0, released 30 Oct 2026

   Mandates no products; agency architectures should be in line with AIRA

Each document’s status in its own words, read 5 November 2026. The technical standard is itself guidance the policy recommends agencies apply, as we set out in our story on the agentic AI addendum.

Statement 2 of the technical standard predates AIRA and points agencies to the Australian Government Architecture for reference architectures. The DTA’s release says AIRA gives agencies a common foundation for AI without prescribing the final design, in the words of Lucy Poole, a Deputy CEO of the DTA.

Our view

This is opinion, built on the documents above. A reference architecture is easy to ignore, and most of this one will be read by architects or not at all. The companion guide is different. In writing, and about a named product, the government’s own digital agency has said that an Australian data centre commitment is not the same as Australian processing, that a security assessment of the suite may not cover the AI inside it, and that Copilot does not automatically keep the prompts and outputs behind official work. None of that is a finding against Microsoft, whose own page says much the same about where queries go. It is a checklist, and it applies to any Australian business running Copilot as much as to an agency: ask which components process your data where, and under what load. The guide’s best line is the one about the call centre. Deferring a purchase rather than accepting less control is the right instinct, and it is now the DTA’s stated advice to agencies.

Sources

Method note. Written substantially by AI and run by people, working from the primary sources below. 22 quotes here were verified by script against copies of the sources we archived. How AI Geek works.

1. Digital Transformation Agency, AI Reference Architecture Companion Guide – Scenarios, Version 1.0 (PDF, read 5 November 2026): Scenario 1 (Microsoft 365 Copilot), including Table 1, the data processing, IRAP, records and reproducibility passages and the staged approach; Scenario 3 (agentic call centre); the references list.
2. Digital Transformation Agency, AI Reference Architecture, Version 1.0 (PDF, 28 pages, read 5 November 2026): the introduction, the experience layer and the non-AI alternatives sentence, and Appendix B on what AIRA does not mandate.
3. Digital Transformation Agency, AI Reference Architecture: A new blueprint to help government agencies design AI systems, media release, 30 October 2026 (read 5 November 2026): the publication date and Lucy Poole’s remarks.
4. Digital Transformation Agency, AI Reference Architecture landing page (read 5 November 2026): the web version and the PDF downloads, each marked last updated 23 October 2026.
5. Microsoft Learn, Data, Privacy, and Security for Microsoft Copilot, last updated 3 November 2026 (read 5 November 2026): routing of model calls under high utilisation, data residency commitments, and processing for customers outside the EU.
6. Digital Transformation Agency, Technical standard for government’s use of artificial intelligence, Statement 2: Define the reference architecture (read 5 November 2026): Criterion 4.

Methodology. We read both PDFs in full on 5 November 2026, six days after the DTA’s release, along with the web pages listed. The table of Copilot components condenses the guide’s Table 1 and keeps its split between vendor-managed and agency-configurable parts; the examples are a selection. We did not test where Copilot processes data, and we have not asked Microsoft or the DTA which components the guide means; it does not list them. The guide’s Copilot analysis rests on sources it read between May 2026 and its publication, and Microsoft’s page may have changed since. The paragraph under “Our view” is our analysis, honestly held, built on the sourced facts above and labelled as opinion.