Copilot Kept CPA Data Inside Microsoft. Then Microsoft Subcontracted It to OpenAI  in July.

On July 24 Microsoft switched on OpenAI-operated models for every user in eligible commercial Microsoft 365 tenants. If nobody in your firm has changed that setting, it is still on, and there is a section 7216 question underneath it that nobody at your firm has answered.

Most companies can file this under things that don't matter to them. A tax firm can't, because it changes who does the processing when someone in your office asks Copilot about a client's return.

What firms understood when they bought it

Accounting firms picked Copilot over ChatGPT or Claude direct for one reason, and it wasn't the features. Copilot ran GPT models that Microsoft itself operated on Azure hardware, under the same Data Protection Addendum that covers your mailboxes and your SharePoint files. OpenAI the company never had the traffic. All of that was true, and it remains true of the models Microsoft operates.

What Microsoft did

There is now a second way a GPT model can answer a Copilot prompt. The model runs at OpenAI, with OpenAI acting as a subprocessor to Microsoft. Microsoft added them to its subprocessor list on June 23, made the path available on July 9, and on July 24 enabled it for all users in eligible commercial tenants unless an administrator goes in and selects No users.

Nothing about the experience changed, which is most of why this went unnoticed. Same Copilot, same answers, no indication of which path served any particular prompt.

Microsoft's contractual terms follow the traffic. The Product Terms, the DPA and Enterprise Data Protection all apply to the OpenAI-operated path, Microsoft uses OpenAI's Responses API with Zero Data Retention, and prompts, responses and Graph data aren't used to train foundation models. Anthropic sits behind the same admin control, serving the Researcher agent, model choice in Excel and Copilot Cowork.

What doesn't follow the traffic is a set of attestations. On the OpenAI-operated path Microsoft states there is no SOC 1 Type 2 report, no HITRUST CSF certification letter, no PCI DSS Attestation of Compliance and no FedRAMP High authorization. The path also falls outside in-country processing commitments where those apply, and it is unavailable in government and sovereign clouds. Firms that answer security questionnaires will hear about the SOC 1 gap first.

Which license this touches

Microsoft says "eligible commercial customers" and that's it.

The subprocessor article applies to Microsoft Copilot, the paid license that used to be called Microsoft 365 Copilot, and Microsoft says the provider setting is enforced across Copilot and Copilot Studio. The no-cost Copilot Chat bundled with Business Premium, E3 and E5 was renamed Microsoft Copilot Chat, carries the same enterprise data protection terms, and appears nowhere in the subprocessor documentation. Whether the July default reached it isn't written down anywhere public.

You can settle it in your own tenant in about a minute regardless. The control is tenant-level, not per-license, so it shows in the admin center however you're licensed, and what it says today is what is actually happening.

IRS Section 7216

Section 7216 makes it a misdemeanor for a preparer to knowingly or recklessly disclose or use tax return information for anything except preparing the return, and the definition of tax return information covers nearly everything a client hands you. Section 6713 adds a civil penalty of $250 per prohibited disclosure or use, capped at $10,000 a year, with no intent requirement.

Nobody collected a 7216 consent naming Microsoft, and nobody needed to. Storage and email are administrative support. The AICPA's rule on third-party service providers lists software application hosting as an example that doesn't even require telling the client, and firms have relied on that reading for years.

July is worth a fresh look because what is being described has changed underneath the reading. Handing files to a host, and a second company running the model that reads a prompt about a client's return, aren't obviously the same transaction, and the second one arrived without anyone in your firm evaluating it.

Your counsel owns that conclusion and we say so to every client who asks. What we can tell you is which switch is on.

Circular 230 already asks

On June 24 the IRS Office of Professional Responsibility issued Alert 2026-19 on AI in federal tax practice. Section 10.35 asks for competence in the technology itself, meaning how the system works and where it fails. Section 10.36 puts written procedures on whoever holds principal authority in the firm, and the OPR spells out that vetting third-party AI offerings and documenting what was done are part of that. The alert also tells practitioners to handle client data only with secure, enterprise-approved AI. Those procedures exist for changes that arrive without a notice.

What to check this week

Both settings live in the Microsoft 365 admin center and need the AI Administrator or Global Administrator role.

The subprocessor setting. Copilot, then Settings, then View all, then AI providers operating as Microsoft subprocessors. Open OpenAI, and under "Choose which users can access OpenAI operated models" pick No users if you want the Microsoft-operated boundary back. Repeat for Anthropic. Microsoft warns that some features and models only work when the subprocessors are enabled, so treat it as a trade.

Web search. Separate from all of the above, Copilot's web grounding sends a generated query to Bing outside the DPA, with Microsoft as controller instead of processor. The control is Allow web search in Copilot, disabled tenant-wide.

Then write down what you found, what you changed and when. Under 10.36 the record is the part that gets examined.

Sources

• Microsoft Learn, OpenAI as a subprocessor in Microsoft Online Services
• Microsoft Learn, Overview of AI subprocessors in Microsoft Copilot
• Microsoft Learn, Data, privacy, and security for Microsoft Copilot
• Microsoft Learn, Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat
• Microsoft Online Services Subprocessors List
• IRS Office of Professional Responsibility, Alert 2026-19, Introductory Guidelines for Responsible AI Use in Federal Tax Practice
• IRC section 7216, Treas. Reg. section 301.7216-1, IRC section 6713, AICPA Code of Professional Conduct 1.150.040

PK Tech is an IT provider and not a law firm. Nothing here is legal advice, and a 7216 conclusion belongs to your counsel. If you want us to check these settings in your tenant and document what we find, that's a call we're happy to have.