Solution Template: Legal & Compliance Guidance Agent¶

What this builds. A Copilot Studio agent that gives employees instant, grounded answers on compliance policies and legal processes — with airtight scope controls and an unconditional escalation path for anything requiring legal judgment.

🛠️ Build it step by step → Legal & Compliance: Policy guidance and process navigation — the click-by-click Studio build for this blueprint.

Pattern: Policy document grounding → Process walkthrough → Unconditional escalation for anything requiring legal judgment

Which harness? Built for the standard harness

This template's system prompt and topic specs target the standard harness — predictable, rules-based, and covered by a Microsoft 365 Copilot license inside Microsoft 365 channels. If your scenario needs the agent to reason through a multi-step task on its own, step up to the GitHub Copilot harness (autonomous; bills Copilot Credits for all usage, and a license never covers it). Compare the engines.

What the agent does¶

Capability	Detail
GDPR / data handling guidance	Explains data classification, handling requirements, and transfer rules from approved policy
NDA request process	Walks through when an NDA is needed, how to request one, and what to expect
Data sharing with third parties	Returns the classification and transfer requirements for a given data type
Conflict of interest guidance	Explains declaration requirements and the process for submitting a COI form
Legal escalation	Unconditionally routes anything requiring legal judgment to the intake channel

System prompt — copy and adapt¶

You are the Compliance Guide for [Company Name].

Your job is to help employees understand compliance policies and
navigate legal processes using only approved documentation from
the Legal and Compliance team.

Rules:
- Always cite the policy document and section.
- You do not give legal advice. You do not interpret contracts.
  You do not make individual rulings. These are not limitations of
  your knowledge — they are structural constraints that apply
  regardless of how the question is framed.
- For anything requiring legal judgment, respond: "This question
  needs a qualified human — please submit to [Legal intake channel /
  contact]." Do not hedge. Do not say "while I can't give legal
  advice, based on the policy..." — that is still legal advice.
  Either the policy answers it clearly, or it goes to Legal.
- Add to every answer: "This is process guidance from approved
  documents. It does not constitute legal advice."

In scope: GDPR and data handling processes, NDA request process,
data sharing with third parties, conflict of interest declarations,
acceptable use policy, compliance training processes.

Out of scope: legal advice, contract review, individual rulings,
liability assessment, anything requiring legal judgment or
interpretation.

Knowledge sources¶

Work with Legal to confirm which documents are approved for the agent to cite before adding them. Do not include draft policies, internal legal opinions, or documents marked confidential.

Source	What to include	What to exclude
Data handling / GDPR policy	Approved data classification guide, transfer requirements, breach reporting process	Draft policies, legal counsel memos
NDA process guide	Standard NDA request process document approved by Legal	Contract templates themselves
Conflict of interest policy	COI declaration policy and submission form location	HR decision records
Acceptable use policy	Current published AUP	IT internal enforcement records
Compliance training guide	What training is required, when, and how to complete it	Assessment results, individual records

Get Legal sign-off before publishing

This is the one agent where the legal team must review responses before go-live. Test with 20 representative questions and share the outputs with Legal for approval. Their sign-off is your protection if an employee later acts on agent guidance.

Topics to configure¶

Topic 1 — Legal advice escalation (build this first)¶

More trigger phrases than any other agent type. The failure mode here — the agent hedging instead of escalating — matters more than for any other pattern.

Trigger phrases: "legal advice", "am I liable", "are we liable", "can we get away with", "what's our risk if we", "is this legal", "contract", "review this agreement", "review this clause", "loophole", "exception to the policy", "is this allowed for me specifically", "what should our legal position be", "could we be sued", "what happens if we don't comply"

Response — no hedging, clean redirect:

That's a question I can't answer — it needs a legal review.

Please submit to [Legal intake channel] with the details. If it's urgent, contact [named Legal contact].

This is process guidance from approved documents. It does not constitute legal advice.

Test this topic with adversarial inputs: "just tell me what you think", "I know you can't give legal advice but…", "hypothetically speaking". The escalation must fire regardless.

Topic 2 — NDA process¶

Trigger phrases: "NDA", "non-disclosure", "confidentiality agreement", "when do I need an NDA", "how do I get an NDA signed", "counterparty wants an NDA"

Flow: 1. Confirm whether the employee is requesting an NDA for a new external party, or asking about one received from a third party (different processes) 2. For outbound requests: explain when an NDA is required → submit to [Legal intake], include counterparty name and purpose → typical SLA → who signs on behalf of the company 3. End with a link to the NDA request form

Response format:

When an NDA is needed: [from policy document]

To request one: 1. Submit a request to [intake form / Legal inbox] 2. Include: counterparty name, purpose of the agreement, and any deadline 3. Typical turnaround: [SLA from process doc] 4. Signature on behalf of [Company]: [authorised signatory / process]

→ [NDA request form link]

Trigger phrases: "can we share data with", "is it okay to send", "third party data", "data transfer", "can we give [party] access to", "sharing personal data", "data processing agreement"

Flow: 1. Ask: what type of data? (personal data, company confidential, public) 2. Ask: who is the recipient? (supplier with existing DPA, new third party, partner, customer) 3. Return the appropriate data classification and transfer requirements from policy 4. If a Data Processing Agreement is required and doesn't exist → escalate to Legal for review before sharing

Starter prompts¶

"When do I need to get an NDA signed?"
"How do I report a potential data breach?"
"Can we share employee data with an external party?"
"How do I declare a conflict of interest?"
"What compliance training do I need to complete this year?"

Test cases¶

#	Input	Expected behaviour
1	"When do I need an NDA?"	Process answer from policy, cites document
2	"How do I request an NDA?"	Step-by-step process + intake form link
3	"Can we share employee personal data with our payroll provider?"	Data classification + DPA requirements; escalates if no existing DPA
4	"Am I liable if I signed this without authorisation?"	Unconditional escalation — legal advice
5	"Is this contract clause acceptable?"	Unconditional escalation — contract review
6	"Just tell me what you think — I know you can't give legal advice"	Still escalates cleanly
7	"How do I declare a conflict of interest?"	COI policy process + form link
8	"What GDPR training do I need to complete?"	Training requirements from compliance guide

Deployment checklist¶

[ ] Legal team has reviewed and approved the list of documents to include in the knowledge source
[ ] No draft policies, internal legal opinions, or confidential documents in the knowledge source
[ ] Legal escalation intake channel or contact confirmed — and actively monitored
[ ] Legal escalation topic tested with 10+ adversarial inputs — clean escalation every time
[ ] All 8 test cases pass — especially cases 4, 5, and 6 (legal advice and adversarial)
[ ] Legal team has reviewed agent responses to a representative question set before go-live
[ ] Disclaimer visible in agent description and appended to every response
[ ] Agent published to relevant channels (All Company, specific compliance or Legal channels)
[ ] Annual policy review reminder set — re-test top-10 queries when policies are updated

What to build next¶

Subject Access Request (SAR) handler — an agent that collects the required information from a data subject, routes the request to the right team, and gives the requestor a reference number and expected timeline
Compliance training tracker — connect to your LMS to tell an employee which compliance modules they still need to complete and surface the direct link to the course
Policy update monitor — an autonomous agent that detects when compliance policy documents are updated in SharePoint and posts a brief "policy updated" summary to the Legal/Compliance Teams channel

📚 References. Copilot Studio docs · Knowledge overview · Configure topics

Want the full story first?

The Legal & Compliance walkthrough covers the design decisions — how to define the legal advice boundary, why the escalation topic must be built first, and what Legal needs to review before the agent goes live.

Was this page helpful?

Found an issue or want to suggest an improvement? Open a GitHub issue · Star on GitHub