Copilot Cowork for Banks and Credit Unions

Microsoft made Copilot Cowork generally available on June 16, 2026. Copilot Cowork is a Microsoft 365 Copilot capability that takes a task you describe and runs it end to end across your apps, then returns a finished result.

This is different from the earlier Copilot experience. The older Copilot drafts or answers in the app you are in. Cowork builds a multi-step plan and runs it in the background, with checkpoints where you review the work.

Banks and credit unions should care, but with caution. Cowork can run repeatable back-office tasks, yet GLBA and BSA rules govern customer financial data and reporting. Controls and oversight must come first.

What Copilot Cowork Can Do in Banking

Copilot Cowork runs multi-step tasks across Microsoft 365 and returns a finished result. In a bank, that can mean drafting internal reports, organizing data in Excel, or preparing routine documents.

It is grounded by Work IQ, which uses context from Outlook, Teams, and Excel. It runs in the background with checkpoints for your review.

Cowork shows recommended actions and applies them only after you approve. That review step matters where customer data and compliance reporting are involved.

• Draft internal reports and routine documents
• Organize and summarize operational data
• Run tasks in the background with approval checkpoints

GLBA and BSA Cautions

GLBA requires you to protect nonpublic personal information, so any Cowork task that could touch customer data needs strong safeguards.

BSA and anti-money-laundering duties cannot be delegated to an AI tool. A person must review and own any output tied to suspicious-activity monitoring or reporting.

Restrict who can run sensitive tasks, and keep a clear record of what Cowork did and who approved it.

• Safeguard nonpublic personal information under GLBA
• Keep BSA and AML decisions with accountable staff
• Limit which users can run data-sensitive tasks
• Keep an approval and audit record for every task

Controls Microsoft Provides

Copilot Cowork runs within Microsoft 365's security and governance boundaries, so identity, permissions, and compliance policies apply by default.

Microsoft states that sensitivity labels are inherited and displayed end to end and that actions and outputs are auditable, which supports examinations and reviews.

Microsoft Purview is available to govern and audit Cowork, including audit logs. Confirm which protections are active in your tenant.

Licensing and Billing

Copilot Cowork requires a Microsoft 365 Copilot license per user and then bills the Cowork work by usage in Copilot Credits.

Cowork is off by default. An admin must enable it and can set spending limits and choose which models and plugins are allowed.

Microsoft sets credit rates and they can change, so confirm current pricing with Microsoft before you budget.

A Controlled Rollout

Start with internal tasks that do not touch customer data so you can see how Cowork plans and acts.

Have compliance and IT review approved use cases, access settings, and audit logging before sensitive work.

Train staff on what they may hand to Cowork and on the duty to review every output.