Hybrid intelligence: what local AI means for your Copilot tenant

On 7 October 2026, Microsoft presented Windows as a platform for “hybrid intelligence”. AI agents are supposed to run locally on the device when that makes sense and use the cloud when they need it. For Copilot on Copilot+ PCs, this means local context, local actions and local models. Not every Copilot request would then travel to a data center.

That sounds like a win for data protection. Whether it is one, nobody can answer cleanly today. Microsoft cannot either, at least not publicly. That is exactly what this post is about.

What Microsoft announced

For Copilot on Copilot+ PCs, Microsoft names three building blocks:

• Local context: With your permission, Copilot understands files and recent activity on the device.
• Local actions: Copilot handles tasks directly on the PC, for example organizing files, device diagnostics or troubleshooting.
• Local models: Copilot uses local compute for suitable tasks and combines it with the cloud when needed.

The status matters: the features are “expected to begin rolling out over the coming months”. According to Microsoft, availability and timing depend on device, market and silicon. None of it has shipped today.

One building block for agents is already available: Microsoft Execution Containers (MXC) are generally available. With them, organizations define which files and networks an agent may access, and Windows enforces this at runtime. Management through Intune and separating agent activity from user activity in Entra are only announced for later, though.

What does not change

If you use Microsoft 365 Copilot in your tenant today, the announcement changes nothing about it. Microsoft’s documentation on data, privacy and security describes processing in data centers. For customers in the EU, Copilot is a service within the EU Data Boundary. Local processing does not appear there.

The Windows announcement mentions neither Microsoft 365 Copilot nor Entra ID. It refers to the new Copilot with Home, Code and Autopilot, which Microsoft introduced in September as AI for work. Whether local context and local actions will also come to work accounts, and under which policies, is not stated anywhere so far.

Local does not automatically mean better

Local processing can have real benefits: less latency, less data in motion, lower cloud costs. Four points cloud the picture, though.

You do not know what runs where. Microsoft talks about intelligent routing that runs tasks “local or cloud”. The criteria behind that decision are not stated anywhere. “Hybrid” without transparency is worth little for a data protection assessment.

Visibility is open. Purview audit and eDiscovery for Copilot rely on the activity history in the cloud. Whether and how locally processed requests show up there, Microsoft does not document so far. My assessment: this creates a gap unless Microsoft actively closes it.

Local context reads along. Copilot is supposed to understand files and recent activity on the device. That is powerful. It also brings back memories of the Recall debate. Which data exactly, with which exceptions and with which admin switch: not documented.

The local model landscape moves fast. Phi Silica, the local language model behind the Windows AI APIs, is already being replaced by Aion Instruct: from November 2026 for Insiders, from January 2027 on retail devices. If you assess local AI, you assess a moving target.

Then there is the device fleet. Hybrid intelligence needs Copilot+ PCs. In most companies, both kinds of devices will run side by side for years. That means two Copilot experiences, two sets of expectations and two kinds of support cases.

What you can do now

None of this is urgent, because nothing has shipped yet. That is exactly why now is the right time to ask the questions.

1. Know your device fleet: How many Copilot+ PCs do you have, and how many arrive with the next hardware cycle?
2. Ask Microsoft: Which data is processed locally, which in the cloud? Is there an admin switch for local context? Does local processing show up in the Purview audit? Does it apply to work accounts? When does it come to the EU?
3. Control new Windows features: Check how new AI features arrive in your update rings before they land with everyone.
4. Keep an eye on agents: If developers use local agents like GitHub Copilot CLI, MXC is an option. Intune management is still missing, though.

What stays

Hybrid intelligence is a sensible direction. Not every request needs a data center, and local processing can help with data protection and costs. But Microsoft is mainly selling a vision here. The questions that matter to admins remain open: control, visibility, work accounts, EU. If you already argue today that “Copilot stays local now”, you are arguing with a promise.

☕ Espresso Moment: Locally roasted sounds good. As long as nobody tells you which bean is roasted where, it is just a label.

Your takeaways

• Hybrid intelligence is announced, not shipped. Rollout “over the coming months”, only on Copilot+ PCs.
• Microsoft 365 Copilot keeps processing in the cloud, in the EU within the EU Data Boundary.
• Microsoft names no criteria for when processing runs locally and when in the cloud.
• There is no documentation yet for admin switches, audit and work accounts.
• MXC for agents is available, Intune management comes later.
• Ask questions now, do not build a data protection assessment on marketing statements.

Sources: Windows Experience Blog “Building Windows for hybrid intelligence” (7 October 2026), Windows Developer Blog on Microsoft Execution Containers, Microsoft Learn “Data, Privacy, and Security for Microsoft Copilot” and “What are Windows AI APIs?”

Have you already asked Microsoft these questions? Tell me on LinkedIn which answers you got.