Microsoft Flex Routing: What EU Businesses Need to Know
Microsoft now routes Copilot AI processing outside the EU during peak demand — enabled by default, no consent required. Here is what changed and what you can do about it.
Last updated: April 2026
The Short Answer
- → Since April 17, 2026, Microsoft routes Copilot AI processing to data centers in the US, Canada, or Australia when EU capacity is full. This is called flex routing and it is enabled by default for all EU/EFTA tenants.
- → Your files and emails stay stored in the EU. But when Copilot processes them, the entire context — your documents, emails, and metadata bundled together — can be sent outside the EU for AI inference.
- Bottom line: "Stored in the EU" no longer means "processed in the EU." If your organization is subject to GDPR, NIS2, or DORA, check your Copilot settings today.
What is Microsoft Flex Routing?
Flex routing is a Microsoft 365 Copilot feature that allows AI inferencing — the actual computation where a large language model processes your prompt and generates a response — to occur outside the EU Data Boundary during periods of peak demand. Microsoft published the official documentation on April 3, 2026 (Message Center post MC1269223).
When a user submits a Copilot prompt, Microsoft's pipeline bundles the prompt with relevant context: emails, SharePoint files, calendar data, and system instructions. This bundle is sent to a GPU cluster for inference. Normally, EU tenants are processed on EU-based GPUs. With flex routing enabled, that bundle — including your organization's data — can be routed to data centers in the United States, Canada, or Australia when EU GPU capacity is saturated.
Data at rest — your files, emails, and SharePoint content — remains stored within the EU Data Boundary. What leaves the EU is the inference computation itself, plus what Microsoft describes as "limited pseudonymized data" for security and operational purposes.
| Date | Event |
|---|---|
| March 25, 2026 | Flex routing enabled by default for all new EU/EFTA tenants |
| April 3, 2026 | Microsoft published official documentation and Message Center post MC1269223 |
| April 7, 2026 | Community alarm raised by security researchers and IT professionals |
| April 17, 2026 | Flex routing goes live and defaults to ON for all existing EU/EFTA tenants |
Why This Matters for EU Organizations
For years, EU organizations could reasonably assume that Microsoft's defaults were conservative — that features with data residency implications would ship as opt-in. Flex routing breaks that assumption. It is opt-out, not opt-in, and it was enabled without explicit consent from tenant administrators.
The distinction between "stored in the EU" and "processed in the EU" is the core issue. GDPR Article 44 restricts transfers of personal data to third countries. When Copilot bundles your organization's emails, documents, and metadata into a RAG context and sends it to a US data center for inference, that is a data transfer — regardless of where the files are stored at rest. Organizations subject to NIS2 (critical infrastructure) or DORA (financial sector) face additional regulatory exposure.
The opt-out mechanism itself raises concerns. Administrators had until April 17 to disable flex routing — a three-week window after the official documentation was published. The setting change takes approximately one week to propagate across a tenant. For organizations that missed the announcement, their Copilot data is already being processed outside the EU.
What Your Admin Needs to Do Right Now
Open the Microsoft 365 Admin Center. Navigate to Copilot, then Settings. Look for "Flexible inferencing during peak load periods." If it says "Allow flex routing during periods of peak load," your organization's Copilot data can be processed outside the EU. Select "Do not allow flex routing" to disable it.
The setting change takes approximately one week to propagate across your tenant. Flex routing affects Microsoft 365 Copilot, Copilot Chat, Dynamics 365 Copilot, Power Platform Copilot, and Copilot Studio. All of these products will route AI inference outside the EU when the toggle is on.
One exception: Multi-Geo customers have separate data residency controls and are not affected by the flex routing default. If your organization uses Multi-Geo, your existing configuration takes precedence.
Microsoft 365 vs Veluvanto: Data Sovereignty Compared
Flex routing highlights a fundamental question: where are your documents actually processed, and who decides? Here is a side-by-side comparison of how Microsoft 365 and Veluvanto handle data sovereignty.
| Aspect | Microsoft 365 | Veluvanto |
|---|---|---|
| Data storage location | EU Data Boundary (with exceptions) | EU only — Amsterdam (NL) and Frankfurt (DE) |
| AI processing location | EU by default, US/CA/AU during peak load | EU only — Google Vertex AI (europe-west) |
| Default data routing | Flex routing ON by default since April 2026 | No cross-border routing, no surprise defaults |
| Encryption model | Microsoft-managed keys | SSE-C (AES-256) encryption at rest |
| AI training on your data | Microsoft states no training, but data leaves EU for processing | Never. Zero AI training on customer data. |
| Admin control | Tenant-level toggle, ~1 week propagation delay | Per-workspace control, immediate effect |
| Data portability | Export via admin tools, complex process | Full export anytime — your documents, your data |
| Pricing transparency | Microsoft 365 + Copilot add-on ($30/user/month) | From €9/month excl. VAT, all features included |
How Veluvanto Handles Document Processing
Veluvanto is an AI-powered document management system built with a simple rule: your data stays in the EU. There are no hidden routing defaults, no peak-demand exceptions, and no fine print about where AI processing happens.
All data is stored in EU data centers: Backblaze B2 in Amsterdam and Wasabi in Frankfurt. AI processing runs through Google Vertex AI in the europe-west region — within the EU, with no cross-border routing.
Every setting is explicit. There is no toggle buried in an admin console that silently sends your data overseas. What you configure is what happens — no surprises, no exceptions during peak demand. Every file is encrypted at rest with SSE-C (AES-256).
- ✓All data stored in EU — Amsterdam and Frankfurt data centers
- ✓All AI processing in EU — no cross-border routing, ever
- ✓SSE-C (AES-256) encryption at rest
- ✓Zero AI training on your documents
- ✓Full data export — your documents are always portable
- ✓No surprise defaults — what you see is what you get