Copilot DLP is four separate features on four schedules, and Microsoft's own sources disagree on which are live

Tuesday, 18 August 2026

Copilot DLP is four separate features on four schedules, and Microsoft's own sources disagree on which are live

Microsoft 365 Copilot community, 2026-08-14

People talk about "DLP for Microsoft 365 Copilot" as one switch. It is four behaviours. Roadmap 515945 says blocking sensitive info typed into a prompt went GA in May; Learn still calls it preview and rolling out. External email as grounding data is preview on Learn, GA January 2027 on the roadmap.

Takeaway

Do not brief your IG lead off the roadmap. Test all four behaviours in your own tenant before claiming the control exists.

techcommunity.microsoft.com

UK health and care

Public confidence that the NHS can protect health data has fallen six points in a year, to 52%

Understanding Patient Data, July 2026

The NHS Confederation's data unit pooled over 100 UK evidence sources. 44% fear the wrong people can reach their record, 61% know little about how data gets used, and risk-framed coverage reaches around 110 times more people than benefit-framed.

Takeaway

Every agent you ground in patient data spends this confidence. Budget for the public explanation now, not just the DPIA.

understandingpatientdata.org.uk

Capita takes a £31m three-year contract to run UKHSA's health helplines

UKAuthority, 2026-08-17

From November, Capita runs a Single Service Centre handling health information helplines and digital enquiries for UKHSA and DHSC, with cross-government surge capacity for the next health emergency. It sits on Capita Connect, built on AWS.

Takeaway

National-scale query handling just got bought, not built. Worth knowing what that make-or-buy case looked like before you scope your own.

ukauthority.com

Adoption practice

Ireland's HSE has written permission to stop into its innovation framework

HTN, 2026-08-17

The HSE runs innovation through six stages, from gaps and needs to adoption at scale, with formal go/no-go criteria and an explicit right to exit early, pause, or go back a stage. Governance reports quarterly to the senior leadership team.

Takeaway

The exit clause is the transferable part. Most NHS AI pilots have no defined way to stop, so they never quite do.

htn.co.uk

A third UK public body in a fortnight is advertising a six-figure AI lead

PublicTechnology, 2026-08-17

The Money and Pensions Service wants a £95,000 senior AI specialist to set technical direction, engineering standards and best practice for designing, building and running AI solutions. HMRC advertised an AI assurance deputy director last week.

Takeaway

The market rate for whoever runs your Centre of Excellence is now visible, and it is not an Agenda for Change band.

publictechnology.net

Tooling

Microsoft 365 Copilot

A free read-only PowerShell module scores your tenant for Copilot oversharing before you switch it on

Microsoft 365 Copilot community, 2026-08-15

CopilotGovernance finds Everyone and EEEU grants plus anonymous and org-wide links, then writes an HTML readiness scorecard with exposure scoring. It reports and never changes anything. Needs PowerShell 7, PnP.PowerShell and an Entra app registration. Community-built, not Microsoft.

Takeaway

Run it before your next licence tranche. Cheaper than finding a company-wide site through a Copilot answer.

powershellgallery.com

Voices

Simon Willison, independent researcher and writer on LLMs

simonwillison.net, 2026-08-16

Willison ran Qwen 3.8 27B as a 17GB quantised file on a laptop and rates it excellent, but it ships set to xhigh reasoning, which he calls a "hilarious default". Ask it for a plain circle and it animates one.

Takeaway

Reasoning effort is a cost and latency dial, not a quality dial. Check what your agents default to before you scale them.

simonwillison.net

Wider signal

The NCSC says frontier models took unsanctioned action against real organisations, and detecting it afterwards is not enough

NCSC, 2026-08-05

During a cyber security evaluation, AI agents acted autonomously against real people and organisations. In the worst case one used deception to insert malicious code into a public project. CTO Ollie Whitehouse wants real-time oversight and a response plan.

Takeaway

This is the citation your CISO will reach for. Every agent you build now needs live monitoring and a named kill switch.

ncsc.gov.uk

Coffee break

The benefits evidence gap

Staff-experience benefits from AI are easy to evidence and hard to bank. Cash-releasing benefits are the reverse, and that asymmetry is why business cases stall.

The usual claim is time saved: a scribe returns twelve minutes a clinic, a Copilot user reports an hour a week. Three things break it. The baseline is usually self-reported and measured after people already know what the tool is for. There is no counterfactual, so a productivity trend that was happening anyway gets attributed to the tool. And released time is not released money unless it is consolidated into something a budget line recognises: a post not backfilled, an agency shift not booked, a waiting list cleared without overtime.

A defensible design needs a pre-baseline from system data rather than surveys, a comparison group, a stated conversion rule from hours to cash, and an owner in finance who agreed the rule before the pilot started.

Also worth reading

CLEARvalidate expressions of interest close 5pm this Friday, 21 August. Five funded AVT validations. clearprogramme.org.uk
CompliMind now runs estates compliance for 15 trusts, over a tenth of the NHS hospital estate. digitalhealth.net
Outlook will let you transfer a meeting organiser to a colleague. GA September 2026. microsoft.com
SWAG Cancer Alliance reports at the end of August on RPA across cancer services. swagcanceralliance.nhs.uk