Microsoft's unified Copilot app puts personal and work AI accounts one click apart, so Irish organisations now need controls on the account boundary as well as the licence.
This month the Microsoft 365 Copilot app stops existing under that name. Microsoft announced on 13 August that it is merging its consumer and enterprise Copilot apps into one product, called Microsoft Copilot. Mobile and web went first. The Windows and Mac apps began rolling out worldwide in mid-September, and Satya Nadella has told investors the full "super app" ships this quarter.
For commercial customers Microsoft describes most of the change as cosmetic. The admin centre looks the same, licences are unchanged and so is enterprise data protection. All of that is true. It also misses the point for an Irish board, because the change that matters happens on the employee's screen.
One app, two sets of rules
The unified app adapts to whoever is signed in. Sign in with a work account and you get the licensed experience with enterprise data protection: prompts and responses stay inside your Microsoft 365 boundary, your permissions apply, and the activity is auditable. Sign in with a personal Microsoft account, an Apple ID or a Google account and you get the consumer product, on consumer terms.
The only visible difference is a small "Work" or "Personal" label next to the profile in the navigation pane. The icon on the taskbar is the same, and so is the name and the chat box.
Until now the boundary between sanctioned and unsanctioned AI had some physical shape to it. The consumer tool was a different app, or a browser tab, or a phone. Staff had to go somewhere else to use it, and a policy saying "don't paste client material into personal AI tools" described a recognisable act. After this rollout that act is a profile switch inside the app the organisation told them to use.
Why this lands harder in Irish professional services
Take a tax manager in a 200-person practice who pays for Microsoft 365 Premium at home. Their firm has not bought Copilot licences for everyone. The unified app is now on their work laptop, and their personal account is already signed in on their phone. When the work account can't do something, the personal account is sitting one click away.
Microsoft has anticipated part of this. Employees can already bring Copilot from a personal Microsoft 365 plan into work documents. When they do, file access stays tied to the work account and its permissions, and the actions are auditable. Admins can switch that route off by cloud policy for some or all users. That route is governed.
The ungoverned route is simpler. Someone copies three paragraphs of a client's draft accounts, switches to Personal and pastes. Nothing in the Microsoft 365 audit trail records it, because it never touched the tenancy. For a firm whose engagement letters promise confidentiality, or whose regulator expects outsourcing and data-handling controls, that is a disclosure. Nobody will know it happened.
The pressure is also growing. Microsoft reports more than 30 million paid Microsoft 365 Copilot seats, up from 20 million in April. Most Irish organisations of 50 to 2,000 people have licensed a fraction of their staff. Everyone else is being handed a polished app whose work mode they can't use and whose personal mode they can.
The policy you have was written for a different screen
Most AI acceptable-use policies we read in Ireland were drafted in 2024 or 2025. They list approved tools by name and prohibit "public" or "consumer" AI tools. Put the unified app in front of the person that policy is meant to guide and they can't tell from the wording which side of the line they are on. The approved tool and the prohibited tool now share a name.
This is where governance built on declared policy breaks. The policy says the right thing. The environment makes the wrong thing the path of least resistance, and the organisation has no record either way.
What to do before the rollout reaches your desktops
Decide the account question explicitly. Either personal accounts are blocked from signing into Microsoft apps on managed devices, or they are allowed and you accept the risk in writing. Most organisations have never made this decision. It was made for them by default.
Set the personal-plan policy on purpose. Personal Copilot on work documents runs under work permissions and is auditable, so there is a case for allowing it as a stopgap while licensing catches up. Decide deliberately. Don't find out from a user.
Rewrite the policy around the boundary. Replace "don't use consumer AI tools" with the observable rule: client or firm material only goes into an AI tool when the Work label is showing. Put a screenshot of the label in the policy. People follow what they can recognise.
Tell staff what changed. A two-paragraph note from the COO about the new app, the two labels and which one to use for work will do more than any training module this quarter. Most staff will assume the new icon is simply the old app with a new name.
Look at the unlicensed majority. If a large share of your people are using the Personal side for work, you have a demand signal. Licensing a pilot group properly is cheaper than the exposure you are currently carrying.
The Acuity AI position
We diagnose before we prescribe. In this case the diagnosis starts with a question most leadership teams can't answer: how many of our people have a personal AI account signed in on a device that also holds client data? The policy won't tell you. Observed usage will.
Our AI governance work maps which AI tools and accounts are actually live across the estate, including the defaults Microsoft switches on inside existing licences, and sets controls around the boundary your people cross in practice. Where the question is whether wider Copilot licensing would pay for itself, our Copilot adoption diagnostic answers it with usage evidence instead of vendor projections.
Microsoft has made the product simpler for users. That was the right call for Microsoft. Your job is to make sure a simpler interface doesn't quietly move the line between work and personal AI.