Support services - M365 Copilot W05a

1.0 Summary of changes

1.1. This is a new Standard Operating Procedure (SOP) which has been written to provide clarity around use of Copilot. Following consultation it was published on 20 January 2026.

2.0 What this policy is about

2.1 Microsoft Copilot is powered by a Large Language Model (LLM), which is a type of artificial intelligence trained on vast amounts of text data. This allows Copilot to understand and generate human-like text based on the input it receives. When you interact with Copilot, you provide prompts, which are questions or instructions that guide its responses. Essentially, prompts are the way you communicate with Copilot to get the information or assistance you need. Guidance on creating good ‘prompts’ can be found on the M365 intranet pages.

2.2 The intention of this Procedure/SOP is to provide clear instruction to all users (definitions set in W 5000) with regard to the appropriate use of the M365 application Copilot, covering both M365 Copilot Chat (the version that comes with standard E3 licence – applicable to most users) and also the full M365 Copilot (Pro-licence). Where there is any specific instruction or guidance that applies to only one of the versions (chat or full), it will be made clear within the body of this procedure.

2.3 Compliance with this Procedure/SOP ensures the appropriate use of M365 Copilot and minimises the risk of inappropriate use of data. It is further intended to build confidence and understanding for users, in the use of this AI-based application in the execution of their role-based duties.

2.4 Please refer to linked policy and associated SOPs listed below.

2.5 This policy applies to Kent Police officers and staff in their use of Copilot. Those working in collaborative roles should follow the policy of the force that employs them.

Compliance with this Procedure/SOP and any governing policy is mandatory (W 5000), please also ensure that you work in compliance with W1000 Information Management and its subordinate procedures – including W1001 ICT Acceptable Use.

3.0 General principles

Definition of Copilot

3.1.1 M365 Copilot is an artificial intelligence (AI)-powered assistant integrated into Microsoft 365 products. It is designed to streamline information retrieval, enhance productivity, and support various tasks by leveraging AI. In its simplest form, Copilot can help users by reviewing documents, summarising them, creating presentations, drafting emails, and much more.

3.1.2 Copilot should be seen as an assistive tool. It is Copilot not autopilot and material reviewed or created must be checked for accuracy.

3.1.3 Users can access helpful instructional videos on M365 Copilot on the Kent Police and Essex Police M365 intranet pages. 

3.2 Prompts

3.2.1 The area you type into in Copilot is called the ‘prompt box’. Your prompts are only visible to you as a user, however, MS Purview (another M365 application, only accessible by authorised personnel) has the ability to view/audit prompts.

3.2.2 Viewing prompt history would only be completed where there was a business need to do so i.e. PSD investigation in relation to inappropriate use of police ICT, for example. As a user you are able to view your own prompt history. Retention for prompt history is set to the same retention period as for the users exchange settings i.e. the same as their OneDrive and email retention settings. A folder is automatically created in a user’s OneDrive called ‘Microsoft Copilot Chat Files’ and every time a user attaches a document for review by Copilot it will create a copy of that document in this folder. Retention on this folder is accordance with the retention schedule for OneDrive.

3.2.3 The information typed into a Copilot search (the ‘prompt box’) does not leave the Kent Police secure IT environment. The same information security principles that apply to SharePoint and OneDrive are applicable to Copilot. This means that no-one else can see what you type into the ‘prompt box’ in Copilot (except via MS Purview for auditing purposes), and no-one else can see your results unless you go on to save them in a location where other staff have access to. 

3.2.4 The correct use of prompts is now commonly referred to as ‘prompt engineering’ and more information on prompt engineering to get the best out of Copilot can be found on the M365 pages.

3.3 Copilot offers a range of functionalities, including

• information retrieval: quickly finding and summarising information from various sources (access to information differs depending on use of full licence or Copilot chat – explained below)
• document creation: assisting in drafting documents, emails, and presentations.
• task management: helping to organise and prioritise tasks.
• data analysis: analysing data to identify patterns and insights.
• meeting summaries: summarising meeting transcripts and highlighting key points.
• creation and use of ‘Agents’ to all or a limited audience. Agents help by controlling the parameters of a search which helps to standardise the search results.

3.4 The difference between Copilot Chat and a full Copilot licence:

All staff in Kent Police will have access to Copilot Chat with some staff having access to a full Copilot licence, also known as a pro-licence. The two levels of access offer different levels of functionality explained below, however it is of note that neither version of Copilot is as yet integrated into other Kent Police applications such as Athena, Storm, PNC, SAP etc.

3.4.1 Copilot chat

Scope: limited to publicly available information on the web and those documents which the user attaches for review. At the time of writing Copilot Chat capabilities are as follows:

• maximum file size: 512 MB per file
• maximum number of files per search transaction 20
• total session upload limit: Dependant on force usage (warning messages provided)
• supported file formats:
  • documents: .pdf, .docx, .txt, .msg
  • spreadsheets: .xlsx, .csv
  • presentations: .pptx
  • images: .png, .jpg, .bmp, .gif
  • and other common text-based formats

Usage: users can ask questions about documents they attach for review, instruct it to re-write and summarise material.

Limitations: Copilot Chat search will not include access to internal documents, emails, or other data stored within the organisation's M365 environment, other than material which is manually attached for review.

3.4.2 Full Copilot Licence (Pro-licence)

Scope: with the full licence, Copilot can utilise any data that the user already has permission to access within the organisations’ M365 environment. The full version builds on the web-based functionality in the Chat version and allows the user to interrogate data contained within the boundaries of their existing M365 permissions (eg their files, folders, messages etc.), again no identifiable information leaves the Kent Police 365 Environment. In no way can either system access other policing systems such as Athena, PNC, DAMS etc.

Usage: users can review and summarise internal documents stored within M365 environment (including SharePoint and OneDrive), manage tasks, and access detailed insights from internal data.

Capabilities: enhanced functionalities such as reviewing documents directly from OneDrive or SharePoint, creating step-by-step guides from video transcripts, assistance with drafting replies to email, meeting recaps and much more. Users with the full licence can also use Copilot to search for any material across all platforms Copilot has access to, namely email, Teams messages, SharePoint and OneDrive document libraries.

3.5 Copilot agents

Copilot has a feature called Agents, these work by allowing a business, in our case Kent Police Information Technology Department (ITD) in conjunction with Information Management and the M365 Team, to create standardised search parameters or rather ‘search prompts’ for some or all staff to use. An agent works by limiting results to only specific websites or reference documents and uses a predefined prompt question. This feature is currently not available for wider organisational use but is subject to ongoing review by ITD and automation work-streams.

3.6 Use/misuse

3.6.1 M365 Copilot created data may have to be disclosed as part of our legal obligations, including where it is used as evidence in criminal or civil legal proceedings.

3.6.2 M365 Copilot processes and created data, that contain personal identifiable information, will come under the controllership of the relevant police force, and the chief constable is the data controller. The user needs to be mindful that these records may have to be disclosed as part of our legal obligations (e.g. right of access requests etc.)

3.6.3 Misuse of M365 Copilot could result in disciplinary or even legal action being taken against individuals and the relevant force. All staff are reminded of the W 1001 Procedure/SOP – ICT Acceptable Use procedure.

3.6.4 The Artificial Intelligence (AI) creation of images or videos is only permitted for non-operational purposes i.e. Media teams and L&D colleagues. 

3.6.5 It is crucial that any material processed in any way via Copilot is checked for accuracy before being used, shared, or stored. This includes but is not limited to:

• internal reports
• external reports
• intelligence documents
• briefing documents
• correspondence
• any other non-evidential content

Users remain responsible for ensuring the accuracy and appropriateness of all Copilot-assisted material as well as verifying its evidence source. 

3.7 Use of Copilot in the evidential chain

3.7.1 Consultation is ongoing with the Crown Prosecution Service both at a force and national level with regard the creation of casefile and MG series documents. Further clarity will be added in due course, however in line with CPS guidance at the time of writing Copilot must not be used to enhance or create any material that forms part of the evidential chain.

3.7.2 The analysis of material collected in the course of an investigation for example to search for key elements, understand or correlate patterns, identify potential lines of enquiry is allowed but all review, research and analysis in this regard must be checked for accuracy.

3.8 Examples of inappropriate/appropriate use of Copilot:

Process/use	Use	Permission
MG2-21 inclusive	Using Copilot to create or enhance the wording, sentiment and material that makes up the MG series case papers.	No - this is using AI to create or enhance the content of a document and therefore is not currently permitted.
MG11 statements (of any kind)	Using Copilot to create in any way or to enhance the wording, sentiment and content of a statement.	No - this is using AI to create or enhance the content of a document and therefore is not currently permitted.
Reviewing statements	Reviewing a series of MG11’s and accounts obtained in a case to develop a timeline for use in a briefing.	Yes - this material does not affect the evidential chain, however, officers/staff are reminded of their disclosure obligations and the requirement to retain and disclose any relevant material generated on the appropriate unused material schedule.
Analysing evidence or intelligence	Analysing evidence or intelligence to identify potential lines of enquiry or patterns or trends.	Yes - this material does not affect the evidential chain, however, officers/staff are reminded of their disclosure obligations and the requirement to retain and disclose any relevant material generated on the appropriate unused material schedule.
Meetings	The review of recorded meetings to create transcripts or actions.	Yes - this use is approved with the reminder that all material produced should be checked for accuracy.
Briefings	The collation of material or intelligence to create briefings/papers.	Yes - this use is approved with the reminder that all material produced should be checked for accuracy.
Intel analysis	The review and research of material for patterns or trends.	Yes - this use is approved with the reminder that all material produced should be checked for accuracy.
National Policing reviews/papers	Review and summarisation of any material.	Yes - this use is approved with the reminder that all material produced should be checked for accuracy.
Creation of research papers	Review, summarisation and creation of any material.	Yes - this use is approved with the reminder that all material produced should be checked for accuracy.
Review of policies/SOPs against national guidance and comparison to other forces	Review and summarisation of any material.	Yes - this use is approved with the reminder that all material produced should be checked for accuracy.

3.9 Kent Police will not tolerate any use of MS Copilot which is offensive, inappropriate or which is otherwise incompatible with the ethical policing principles.

3.10 Retention/weeding/archiving

3.10.1 Kent Police have measures in place to protect the security of data in accordance with our Information Management Policy – W 1000 Policy – Information Management. 

3.10.2 MS Copilot Chats are stored within the application for users to refer to for 60 days. If documents are uploaded for review as part of a prompt a copy of these are retained in a system generated folder in the users OneDrive. 

3.10.3 MS Copilot is able to create documents for use by Kent Police staff which may constitute a record. Where Copilot creates a document it is the user’s responsibility to ensure they are identified/retained/disposed of in accordance with Kent Police Records Review, Retention and Disposal Procedure/SOP: W 1012 Procedure/SOP - Records Review, Retention and Disposal. 

4.0 Equality Impact Assessment (EIA)

4.1. This procedure/SOP has been assessed with regard to an Equality Impact Assessment. As a result of this assessment, it has been graded as having a low potential impact as the proposals in this procedure/SOP would have no potential or actual differential impact on grounds of age, sex, disability, race, religion or belief, marriage and civil partnership, sexual orientation, gender reassignment, pregnancy, and maternity. In order to identify or remediate any potential bias an annual audit of artificial intelligence applications will be undertaken to safeguard any unintended dysfunctional consequences.

5.0 Risk assessment

Draft RA MS Copilot.xlsx

6.0 Consultation

5.1 The following were invited to consult during the formulation of this document:

• Information Security Kent Police
• Kent Police Information Management Manager
• Kent Police Digital Business Change Lead
• Head of IT Solution Delivery
• Head of Criminal Justice Kent Police
• Commercial Applications Manager
• Head of Intelligent Automation Team
• Corporate Communications Team Kent Police
• NPCC National AI Lead
• NPCC Disclosure Lead
• Criminal Justice Operations Team, Legal and Operational Delivery Directorate CPS HQ
  • Finance
  • IT Security
  • Estates
  • Human Resources
  • Health and Safety
  • Legal
  • Professional Standards Department
  • Freedom of Information
  • Data Protection
  • Diversity and Inclusion Academy
  • Divisional Commanders
  • Supts Association
  • Unison
  • Federation

7.0 Monitoring and review

As the world of AI is developing at such pace this procedure/SOP is scheduled for full review every 3 months and will be reviewed by the author and owner to ensure it remains accurate and fit for purpose. Ongoing review of AI development with partners internally and externally, nationally and with governing bodies will be monitored by the policy owner and may well cause more frequent review of this policy.

This SOP has been reviewed both by human and Copilot review against the following the governing policies and guidance listed in 8.0.

Concerns with the performance and or accuracy of either a Copilot Agent or Copilot itself should be directed to IT HelpDesk in the first instance.

8.0 Governing force policy

Related force policies or related Procedures (Essex) / linked SOPs (Kent).

• NPCC AI Playbook
• NPCC and CPS Joint Operating Procedure
• NPCC Responsible AI Checklist.
• CPS AI Mission Statement

8.1 Data security

8.1.1 Kent Police have measures in place to protect the security of data in accordance with our Information Management Policy – W 1000 Policy – Information Management.

• W 1001 Procedure/SOP – ICT Acceptable Use
• W 1002 Procedure/SOP – User Account Management
• W 1004 Procedure/SOP – Incident Reporting and Management
• W 1005 Procedure/SOP – Information Asset Owners
• W 1006 Procedure/SOP – Government Security Classification Scheme (GSC)
• W 1008 Procedure/SOP – Physical Security
• W 1009 Procedure/SOP – Protective Monitoring
• W 1010 Procedure/SOP – Records Management (Physical and Digital)
• W 1011 Procedure/SOP – Data Protection
• W 1012 Procedure/SOP – Records Review, Retention and Disposal
• W 1014 Procedure/SOP – Information Sharing Agreements
• W 1015 Procedure/SOP – Redaction
• W 1016 Procedure/SOP – Encryption of Files and Removable Digital Media

8.2 Retention and disposal of records

8.2.1 Kent Police hold data in accordance with our Records Review, Retention & Disposal Policy – W 1012 Procedure/SOP - Records Review, Retention and Disposal.

8.2.2 Kent Police will only hold data for as long as necessary for the purposes for which we collected.