Agencies that switch on Microsoft 365 Copilot may need their own controls to meet records obligations. New federal guidance warns the service can influence official work without preserving the prompts, outputs or context behind it.
The warning is in the Digital Transformation Agency's (DTA) AI Reference Architecture, published on 30 October. It comes with an AI Reference Architecture Companion Guide - Scenarios, which applies the framework to four common ways agencies adopt AI.
Version 1.0 of the architecture, known as AIRA, does not mandate products, platforms or solution designs. It sets out a shared structure agencies can use to design, procure and govern AI systems before committing to a technology.
"Using the architecture is voluntary. It supports agencies to meet applicable requirements, but does not replace them," said Lucy Poole, the DTA's Deputy CEO - Digital Strategy, Planning and Performance.
Those requirements include the Privacy Act 1988, the Archives Act 1983 and the Protective Security Policy Framework (PSPF) 2026. AIRA describes them as setting the legal boundaries within which all AI systems must operate.
AIRA names information management functions as one of its users. It says they should use it to clarify how record-keeping, retention, provenance and archival obligations are met across the AI lifecycle. That includes AI-generated artefacts and AI outputs used in decision-making.
The Copilot scenario in the companion guide shows what that means in practice. The DTA notes that audit logs may record prompts, outputs or referenced files, depending on service configuration and available tooling.
It also cautions that outputs are not necessarily reproducible from the same prompt. Agencies should not assume a Copilot output can be reproduced later. Outputs relied on for business purposes should be captured in line with agency record-keeping rules.
The guide says the main lever agencies hold over Copilot is configuring the data sources it can reach. Doing so "may inadvertently expose existing weaknesses in permissions, classification, information architecture and records management," it says.
Four Building Blocks
Poole compared the framework to designing a building. "Every structure needs certain fundamentals: a solid foundation, core utilities, clear points of access, and safety overrides if things go wrong," she said.
AIRA's foundation has four parts. A functional stack describes five layers: experience, application and orchestration, intelligence and analytics, data and metadata, and platform and infrastructure.
A communication construct covers how AI systems connect to people and other systems without exposing sensitive information. A trustworthiness and assurance construct lists nine domains, from observability and traceability to privacy, fairness and sustainability.
The fourth part is human agency, oversight and control. People must be able to monitor, pause, change or stop systems within appropriate timeframes.
Traceability carries the most weight for records. AIRA defines it as the ability to track and verify the provenance, ownership, processing history and outputs of AI models, data and pipelines.
It extends to attributing automated and human-assisted decisions and preserving AI systems over the long term. It also covers rolling back models, data and decision logic to a known prior state.
AIRA scales these expectations to the use. A productivity assistant may need only source attribution and human review of drafts. Where AI supports consequential decisions, traceability may need to support decision reconstruction, review, appeal and audit.
Where AI drafts or analyses material, AIRA says people should verify the output and retain responsibility for the final work. It flags automation bias, reduced attention during prolonged monitoring and the gradual loss of human expertise as design risks.