From the Microsoft edition of November 10, 2026
Australia's DTA AI Reference Architecture flags a Microsoft 365 Copilot records gap: outputs may not be reproducible and must be captured by agencies
Australian Digital Transformation Agency (reported by Information & Data Manager) · Government (national; transferable to state and local records management) · Australia (international; transferability caveat)
- Publisher
- Information & Data Manager (IDM)
- Original publication
- 2026-11-06
- Source retrieved
- 2026-11-11
- Event date
- 2026-10-30
What happened
IDM reports that the DTA's AI Reference Architecture (AIRA v1.0, published Oct. 30) and its Companion Guide use Microsoft 365 Copilot as a scenario. The guide notes audit logs may record prompts, outputs or referenced files depending on configuration and tooling, cautions that outputs are not necessarily reproducible from the same prompt, and says outputs relied on for business purposes should be captured under agency record-keeping rules. It says configuring Copilot's data sources may expose existing weaknesses in permissions, classification, information architecture and records management. AIRA is voluntary and scales traceability from source attribution for productivity assistants to decision reconstruction for consequential uses.
Why it matters
U.S. state and local records laws impose similar duties to retain records of official business. The DTA's point that Copilot outputs cannot be regenerated on demand supports capturing relied-upon outputs at the time of use rather than counting on logs. Interpretation: applies to SLED records managers setting Copilot retention policy.
Evidence and measured results
Trade-press summary of national government guidance with direct quotes; the DTA's original PDF and companion-guide page could not be retrieved (connection errors), so details rely on IDM's reporting.
Limitations and uncertainty
Australian federal guidance under the Archives Act and PSPF; U.S. public-records and retention schedules differ by state. Published Nov. 6, before the last completed microsoft run, but not previously archived; included for its direct relevance to the Portland assessment in this edition. Original DTA documents not opened; findings rely on IDM.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-11; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies using Copilot may assume logs preserve official records, while outputs may not be reproducible and logs depend on configuration.
- Stakeholders
- Records manager / archivist
- CIO
- General counsel
- Privacy officer
- Program managers using Copilot for decisions
- Discovery questions
- How do staff capture Copilot outputs they rely on?
- Which Copilot interactions does your audit and retention configuration retain?
- Does your records schedule name AI prompts and outputs?
- Where does Copilot support consequential decisions?
- Value hypothesis
- A records-aware Copilot design can reduce gaps between official-business duties and what the tenant actually retains.
- Potential engagement
- A Copilot records-capture and retention configuration review with a tiered traceability policy.
- Unsupported claims
- That U.S. law requires the DTA approach
- That Copilot violates records rules
- Specific retention durations
- Measured compliance outcomes
Pre-sales engineering
Role takeaway
- Fit
- Government Microsoft 365 tenants with Copilot enabled where public-records duties apply.
- Architecture and integration
- Copilot audit logs and Purview retention capture prompts, outputs or referenced files depending on configuration; outputs relied on must be saved to systems of record.
- Prerequisites
- Purview audit and retention configured for Copilot
- Data-source inventory with permission state
- Records schedule update
- Constraints
- Australian guidance, not U.S. law
- Original DTA documents not inspected
- Outputs not reproducible from the same prompt
- Security
- Enabling data sources may expose oversharing and weak classification; review before connecting.
- Proof of value
- Test that a relied-upon output and its prompt are retrievable
- Verify audit capture for a sample of interactions
- Check permission state of each connected source
Delivery
Role takeaway
- Work
- Embed records capture in Copilot rollout: schedule updates, staff guidance, configuration tests and a decision-support checkpoint.
- Dependencies
- Records management staff
- Microsoft 365 administration
- Legal review of records obligations
- Ownership
- Joint ownership by the records manager and Microsoft 365 service owner.
- Skills and adoption
- Staff training on when Copilot outputs become records and how to capture them.
- Governance checkpoints
- Records schedule names AI artefacts
- Checkpoint before decision-support use
- Annual review of audit coverage
- Acceptance criteria
- Simulated records request retrieves output and context
- Guidance published to all Copilot users
- Data sources reviewed before connection
- Risks
- Reliance on logs that do not capture outputs
- Oversharing exposed by data-source configuration
- Automation bias in decision support
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Records capture must be designed around Copilot's audit and retention tooling and its configured data sources; traceability requirements scale with decision consequence.
Governance
Who approves, reviews and stays accountable for outcomes?
Provides a tiered traceability model (attribution and human review for drafting; reconstruction, review and appeal for consequential decisions) that SLED AI policies can borrow.
Security and privacy
What data, permissions and controls need testing?
Configuring data sources can surface existing permission and classification weaknesses; audit-log coverage depends on configuration.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Flags automation bias, reduced attention during monitoring and loss of human expertise as design risks; staff need records training.
Procurement
What should contracts, pricing and exit terms secure?
AIRA is meant to be used before committing to a technology, informing procurement requirements for traceability and records.
Operating model
Which teams own the service once it runs?
Records managers become formal users of the AI architecture; traceability scales with decision consequence.
Publication history
- 2026-11-10Microsoft · Issue 124 resources
Stable resource ID: australia-dta-aira-copilot-records-traceability-gap-20261106