Which Microsoft terms actually govern your business?

Microsoft's updated Services Agreement takes effect on 30 September 2026, and continuing to use the products after that date is how you accept it. The part most business owners miss is that a set of paid Microsoft 365 business products are listed as covered by that consumer agreement, until a commercial domain is established for those services. So the honest answer for many small businesses is that they do not know which contract governs their files, and there is now a date attached to finding out.

This is not really a story about AI. It is a licence hygiene problem that AI has made expensive.

What actually changes on 30 September 2026?

Microsoft is updating the Services Agreement that applies to its consumer online products and services. The company's own summary frames the update as clarification: tidying references to discontinued services, revising the Copilot section to spell out which versions of Copilot the consumer agreement governs, changing the arbitration provider, and adjusting how automatic updates are described in the Store.

Two things about it matter to a business owner, and neither is dramatic.

The first is the acceptance mechanism. Continued use on or after the date is treated as agreement. The only alternative Microsoft's notice offers is to stop using the products and close the account before then. There is no button to press and no decision to make, which is exactly why it slides past most people.

The second is the covered services list. It includes Microsoft 365 Business Standard, Business Basic, Microsoft 365 Apps, the Microsoft 365 app, Microsoft 365 Copilot, the Copilot app and Copilot Chat. A footnote explains this holds until a commercial domain is established for those services, at which point separate commercial terms take over.

Read that again if you skimmed it. Paying for a business product and being on business terms are two different things.

Is Microsoft training AI on my business files?

This is the claim doing the rounds, and it is worth being careful with, because the accurate version is more useful than the alarming one.

The permission to use customer data for developing and training AI models is not in the Services Agreement. It sits in the Microsoft Privacy Statement, which the agreement incorporates by reference, under the product improvement heading, inside a section that opens collapsed.

The Services Agreement does contain an explicit carve out: Microsoft says it does not use your email, chat, video call, voicemail, document or photo content to target advertising. There is no matching sentence about model training.

That absence is a real, checkable thing. It is not proof of anything in particular, and stating it accurately is stronger than the headline version, because a client or an auditor can go and verify it in about a minute. Say more than that and you are guessing.

There is one more trap. Most of the commentary quotes the European variant of the agreement, including a clause where microenterprises and small enterprises waive entitlements under the European Electronic Communications Code. That is an EU and UK provision. It is not Australian law and it does not apply here. Australian users are served a regional variant with different governing law, so the only correct advice is to read the version served in your own market rather than the one in somebody's screenshot.

Why does a licence question matter more than it used to?

Because the terms now govern what can be done with the content, not just where the content is stored.

For twenty years the fine print on a business software subscription was mostly about billing, storage limits and uptime. Nobody read it, and the cost of not reading it was close to zero. Add AI features to the same subscription and the same fine print starts describing how your content can be processed, how long inputs and outputs are retained for abuse monitoring, and what you may and may not do with what comes out the other end.

The practical consequence shows up somewhere unglamorous. A business that cannot say which agreement governs its own files also cannot answer the next three questions a client, an insurer or a tender panel will ask it. We see this at Handiwork more often than any actual AI failure: the tool works fine, and the deal stalls on a data question nobody had prepared for.

That is also why we run this check before we talk about tools at all. The answer changes what we would recommend, and occasionally it changes whether we would recommend anything yet.

The five minute check

Here is the whole thing. You do not need a lawyer for it, and you do not need to read the agreement.

1. Check what your Microsoft 365 sign in actually is. Is it an address on your own business domain, or a consumer style account? This single answer does most of the work.
2. Open your subscription in the Microsoft admin centre and note which product you are on. Business Basic, Business Standard, Microsoft 365 Apps and the Copilot products are the ones on the covered services list.
3. Read the regional variant served to you, not the one being quoted online. Check the governing law named at the foot of it.
4. Write the answer down somewhere you can find it. One line in whatever you use for governance notes. The value is not in knowing today, it is in being able to answer in six months when somebody asks.

If step one comes back as a consumer style account, that is your next job, ahead of whatever AI tool you were planning to add. Everything else in your governance stack sits on top of this answer, including who can reach what, which is the subject of our piece on AI assistant access and permissions.

If you want the wider version of this, our pillar on using AI safely in a small business covers the whole picture, and AI governance for small business is the one page policy version. If your AI setup holds work you could not easily rebuild, backing up your AI setup is the companion piece.

The part worth taking away

Deadlines like this one are not the problem. They are the prompt.

The problem is that most small businesses have never had a reason to know which contract their working files sit under, and have therefore never built the habit of checking. The Microsoft date will pass. The habit is what you keep.

Our governance and roadmap work starts here, at the boring end, because everything interesting further up depends on it.

Ready to find out where you stand?

Our free AI Readiness Check takes about five minutes and covers what your business has already agreed to, what your AI tools can reach, and what to fix first: start the AI Readiness Check.