Responsible AI Governance: How Microsoft Purview Audits and Controls AI Workloads

Introduction

Every AI feature in Microsoft Purview – trainable classifiers, adaptive protection, Communication Compliance models, Security Copilot – makes decisions that affect real documents, real alerts, and real people. A classifier that labels a contract as public when it should be confidential creates a data exposure. An adaptive protection model that flags a user based on a faulty baseline creates an unnecessary investigation. A Copilot summary that hallucinates a detail creates a false lead.

Responsible AI governance means knowing what every AI model in your tenant is doing, being able to audit every decision it makes, and having controls in place to catch errors before they cause harm. Microsoft Purview provides the infrastructure for this governance – audit trails, retention controls, compliance policies – but you have to configure it. This guide walks through how to build an AI governance framework using Purview’s existing compliance tools, applied specifically to AI workloads. I cover auditing AI decisions, detecting model drift and bias, enforcing human review, and applying DLP controls to AI-generated content.

If you are just starting with AI in Purview, the AI-powered compliance guide covers the full capabilities landscape. This guide focuses specifically on governing those capabilities – the controls you need around the AI, not the AI itself.

Auditing Every AI Decision: The Audit Log as Your Governance Foundation

The unified audit log captures every AI-driven action in Purview. When a trainable classifier applies a sensitivity label, the audit log records the classifier name, the document, the label applied, and the confidence score. When adaptive protection assigns a risk score, the audit log captures the score, the contributing activities, and the baseline comparison.

When Copilot generates an investigation summary, the audit log records the prompt, the response, and the sources used. This audit trail is your primary governance control. Every AI decision is traceable to a specific model, a specific input, and a specific point in time. If a classifier mislabels a document, you can find every other document it labelled in the same batch and review them.

Configure the audit log to retain AI-related events for the maximum period your licensing allows – one year with E5, longer if you stream to Azure Log Analytics or a SIEM. Create saved searches for key AI event types: FileSensitivityLabelApplied with the classifier source, SearchUnifiedAuditLog events from Copilot, and InsiderRiskAlertGenerated events from adaptive protection. Run these searches monthly as part of your AI governance review.

Detecting Model Drift and Bias Before It Causes Harm

AI models degrade over time. A trainable classifier trained on last year’s contracts will perform worse on this year’s contracts as templates, language, and formats evolve. Adaptive protection baselines drift as users change roles. Communication Compliance classifiers miss new coded language patterns that did not exist when the model was trained. This is model drift, and it is inevitable.

Purview gives you the data to detect drift, but it does not alert you automatically. You need to build the monitoring yourself. For trainable classifiers, track precision and recall monthly. Go to the classifier, review the latest test results, and compare accuracy against the previous month. A drop of more than 5% means the classifier needs retraining. Do not wait for users to report mislabeled documents – by then, the problem is already widespread.

Bias is harder to detect than drift because it is not visible in aggregate accuracy metrics. A classifier might be 90% accurate overall but 70% accurate on documents from a specific department, region, or language. To catch this, segment your accuracy measurements. Track precision and recall by department, by document language, and by file type. The trainable classifiers guide covers the retraining methodology.

For adaptive protection, drift appears as changing alert patterns. If a department that historically generated few alerts suddenly generates many, the model’s baselines may be stale. Review adaptive protection alerts by department monthly. The adaptive protection comparison guide explains how to interpret these shifts and when to reset baselines.

Enforcing Human Review as a Mandatory Checkpoint

AI can classify documents, score risks, and summarise investigations. It cannot be held accountable. Only humans can. Every AI-driven workflow in Purview must include a mandatory human review checkpoint before irreversible actions occur – before a label is applied, before an alert is escalated, before a policy generated by Copilot is activated.

For trainable classifiers, this means running auto-labeling policies in simulation mode until a human validates the results. For Communication Compliance, flagged messages must be reviewed by a named person before any remediation action. For Copilot-generated policies, the policy must be reviewed and approved before enforcement. These are not technical limitations – Purview will let you skip them – but governance decisions. Skipping them transfers accountability from a person to a model that cannot explain its reasoning.

Document who reviewed what and when. The audit log captures the review action automatically, but it does not capture the reviewer’s reasoning. Add a note to each reviewed item explaining why it was approved, escalated, or dismissed. This creates the evidentiary record you need when an auditor asks why an AI-labelled document was shared externally, or why an AI-flagged message was escalated to HR. The model made the initial decision. A human confirmed it. Both are recorded.

For teams handling high volumes of AI-generated alerts, the automation guide explains how to build triage workflows that prioritise high-confidence alerts for immediate review while batching low-confidence alerts for periodic audit. The principle remains the same regardless of volume: every AI decision that affects real data or real people must have a human accountable for it.

Applying Compliance Controls to AI-Generated Content

AI generates content. Copilot writes investigation summaries. Trainable classifiers produce confidence scores. Communication Compliance models flag messages. This content is subject to the same compliance requirements as any other data in your tenant – retention obligations, data residency rules, and DLP protections.

Start with retention. AI-generated investigation summaries in Copilot are stored in your tenant and must follow the same retention policies as manually created content. If a Copilot summary references a specific incident, that summary should be retained for the same period as the incident records. If it contains sensitive data, it should be labelled accordingly. Copilot does not automatically apply retention labels to its output – you must configure this through auto-labeling policies or manual application.

DLP policies can be extended to cover AI workflows. If a user asks Copilot to summarise a document containing credit card numbers, the DLP policy that blocks sharing credit card data externally also applies to the summary Copilot generates. The detection rules work on the content, not the source, so AI-generated text containing sensitive patterns triggers the same policies as manually typed text. Test this with a few sample queries before relying on it – AI summarisation can sometimes paraphrase sensitive data in ways that evade pattern-based detection.

For Communication Compliance, the governance question is different: who reviews the reviewer? If an AI model flags a message and a human reviewer dismisses it, the dismissal should be auditable. Use the monitoring dashboards to track dismissal rates by reviewer. If one reviewer dismisses 90% of flagged messages while another escalates 40%, both patterns warrant investigation – one may be under-reviewing, the other over-escalating. The AI model is consistent. The humans reviewing its output may not be.