Microsoft’s new flex routing setting and GDPR considerations

Microsoft has recently implemented a new setting known as flex routing for Copilot services used by customers in the European Union (EU) and the European Free Trade Association (EFTA). This change impacts the locations in which Copilot requests may be processed during times of peak demand.

What is flex routing?

During peak periods and high system demand, flex routing allows Microsoft to process Copilot requests temporarily outside the EU Data Boundary and handle them in other regions (such as US, Canada or Australia).  This is to maintain performance, accessibility and a consistent Copilot experience.

Data at rest remains stored within the EU Data Boundary. Microsoft states that data remains encrypted in transit and at rest, and that only limited pseudonymised data may be stored outside the EU for operational purposes.

Why does this matter?

Flex routing is enabled by default for eligible tenants created after Wednesday 25 March 2026. For those created before this date, please refer to the Message Centre for further information regarding your tenant’s flex routing configuration. This means Copilot processing may already be occurring outside the EU Data Boundary, unless the setting has been explicitly reviewed and changed by an administrator.

While cross‑border processing is not prohibited under GDPR, organisations remain responsible as data controllers to ensure that:

• Any processing outside the EU is lawful.
• The configuration aligns with internal data protection policies and customer commitments.
• Relevant documentation (such as DPIAs and records of processing activities) accurately reflects how data is processed.

If your organisation has requirements for EU‑only processing, this will need an admin to disable the flex routing setting.

What we recommend customers do now

1. Check whether flex routing is enabled

Flex routing must be reviewed in the M365 admin centre by an administrator assigned the AI Administrator roll.

Then go to Copilot -> Settings -> View all -> Flex routing during peak load periods.

You will then be able to select either:

2. Allow flex routing during periods of peak load

This setting allows LLM inferencing and the storage of associated pseudonymised data to occur outside the EU data boundary during periods of peak demand.

3. Do not allow flex routing

If you select this option, LLM inferencing will occur inside the EU Data Boundary, even during periods of peak demand.

If flex routing is allowed in the M365 admin centre, then the setting will be configurable in the Power Platform admin centre. If flex routing is not allowed in the M365 admin centre, this setting will be off in the Power Platform admin centre by default.

4. Assess your GDPR obligations

Before leaving flex routing enabled, you should assess whether cross‑border processing is permitted under:

•   Internal data protection and security policies.
•   Customer or supplier contractual commitments.
•  Existing DPIAs or regulatory risk assessments.

Where necessary, documentation may need to be updated to reflect this processing activity.

 Disable flex routing if EU‑only processing is required

If your organisation requires Copilot processing to remain within the EU Data Boundary, flex routing will need to be disabled.

To summarise

Flex routing is a setting that impacts the locations in which Copilot requests may be processed during times of peak demand. Organisations should not assume existing configurations remain compliant by default.

We strongly recommend that all EU/EFTA organisations check their settings, assess GDPR impact, and decide on whether flex routing aligns with their regulatory and contractual obligations. If you need support reviewing this setting or understanding the implications for your environment, please contact your account team.

How Softcat can help

You can speak to your Softcat Account Manager or contact our Sales team.to get support on reviewing the flex routing setting, how it may impact your environment and to understand how to navigate this change