Microsoft 365 Copilot has arrived for the NHS but what does this mean for providers?
Microsoft 365 Copilot is beginning to become a much more familiar part of NHS working life. In June 2026, NHS England announced that more than 500,000 NHS staff would be given access to Microsoft 365 Copilot, following a trial involving more than 30,000 staff across 90 NHS organisations. NHS England reported that the trial saved users an average of around 43 minutes per day, and the wider rollout is expected to continue through to October 2026.
For GP practices, this means that Copilot is likely to become another everyday workplace tool rather than a specialist piece of “AI software”. But its introduction also creates local governance steps including providers understanding what staff are actually using it for, what information it is being given access to, and where AI-generated output could affect patients, staff or decisions.
So, what actually is Microsoft 365 Copilot?
Microsoft 365 Copilot is an AI assistant that works within the Microsoft 365 environment. The commercial version of Microsoft 365 Copilot first became generally available to enterprise customers in November 2023.
The easiest way to understand it is to think of it as an additional way of working with Microsoft 365.
Staff can type an instruction or question in ordinary language and ask Copilot to perform a task. Depending on the licence and configuration, Copilot can also work with information the individual already has permission to access in Microsoft 365, including emails, files, Teams information and meetings. Microsoft describes this as “grounding” the AI in the user's work information. Importantly, Copilot is intended to respect the user's existing Microsoft 365 permissions rather than creating a new entitlement to access information.
For example, a practice employee might ask:
“Summarise the main actions from these meeting notes.”
“Draft a patient-friendly version of this letter.”
“Compare these two policies and tell me what has changed.”
“Pull together the main themes from these documents.”
“Draft a report from this information.”
“Help me analyse this spreadsheet.”
“Summarise this email thread and tell me what I need to respond to.”
NHS England specifically anticipates uses including drafting patient letters and documents, producing meeting minutes, analysing service data, creating templates, assisting with administrative processes and preparing reports and briefings.
Why could it be useful in a healthcare provider environment?
Used appropriately, Copilot has significant potential to reduce some of the administrative burden on both clinical and non-clinical staff.
A practice manager might use it to summarise a lengthy document or produce a first draft of a board paper. An administrator might use it to help structure correspondence. A clinician could potentially use it to assist with administrative elements of their work. Staff could also use it to interrogate documents or find information without manually reading through numerous files.
The important word here is assist.
Copilot generates material for the staff member to consider, but it does not remove the staff member's professional responsibilities, nor should an AI-generated answer automatically be treated as correct simply because it appears polished and confident.
What risks does Copilot introduce?
Risks arise because Copilot can make it much easier and faster to find, combine, summarise and generate information.
For example, there is a risk that:
Copilot produces inaccurate, incomplete or misleading information;
staff rely on an output without adequately checking it;
patient information is included in a prompt or output where it was not necessary;
existing overly-broad Microsoft 365 permissions become more significant because information can be found much more easily;
staff use Copilot for purposes that were never considered when it was introduced;
an AI-generated summary removes important context or nuance from the source material;
content generated for one purpose is copied into a patient record, letter or decision without appropriate review;
staff assume that because Copilot has been provided nationally, every possible local use is automatically approved.
The NHS's procurement and deployment of Microsoft 365 Copilot provides significant central assurance about the product. It does not necessarily tell a provider whether its particular way of using Copilot is appropriate.
There is a substantial difference, for example, between using Copilot to tidy the wording of a meeting agenda and using it to summarise information about an individual patient for inclusion in a clinical communication.
Start with the use case
Practices should identify and record their main use cases. These do not need to become lengthy projects in their own right. A simple use-case record might say:
Practice managers use Copilot to summarise policies and produce first drafts of internal reports. Patient-identifiable information is not routinely required. Outputs are reviewed by the member of staff before use.
A different use case might be:
Administrative staff use Copilot to assist with drafting patient correspondence using information they are already authorised to access. Staff must verify the underlying information and review the complete correspondence before sending it.
Those two uses involve the same technology, but the risks and necessary controls are different.
Practices should be able to demonstrate that they have considered how Copilot is being used rather than simply allowing informal use to develop over time.
This does not mean practices need to reproduce assurance work already completed nationally. The aim is to connect that assurance to what actually happens locally.
For Kafico customers: assessing Microsoft 365 Copilot in LENS
If you are a Kafico customer using LENS (or myKafico), The assessment for Microsoft 365 Copilot can be assessed through the platform rather than starting a new AI governance exercise from scratch.
Within the platform, perform the pre deployment tasks
Finally, keep the use case under review as your use of Copilot develops. You do not necessarily need a completely new assessment every time somebody discovers a useful new prompt, but if the practice moves into a materially different use, particularly one involving patient-identifiable information, clinical activity, automated decisions or a reduction in human review – the use case should be revisited in LENS.
Comments