Microsoft 365 Copilot for Canadian Law Firms: LSO-Aligned Governance and Rollout
Fusion Computing, a Canadian-owned and CISSP-led IT firm, deploys Microsoft 365 Copilot inside your firm’s own Microsoft 365 tenant. Retrieval respects sensitivity labels, a partner-approved policy governs use, and the audit log shows who used Copilot on what, for an LSO inquiry or a client’s AI questionnaire.
The Law Society of Ontario’s 2024 generative AI guidance ties AI use to a lawyer’s duties of competence, confidentiality and supervision. The practical question is which AI, configured how, used by whom and with what supervision.
Fusion Computing deploys Microsoft 365 Copilot for Ontario law firms and other Canadian firms. Before any lawyer gets a licence, permissions are audited, Purview labels protect privileged files, and a partner-approved AI use policy is signed. The setup follows the Law Society of Ontario’s 2024 generative AI guidance, and the audit log can be produced on request.
Why generic Copilot rollouts fail at law firms
Copilot can surface content that the requesting user’s existing permissions allow them to access.
For a law firm, that can include privileged matter folders a user can technically open and has no reason to browse. Copilot has no sense of that professional discipline. It surfaces whatever the access control allows.
The fix is to configure the tenant so that the access control matches the professional discipline before Copilot retrieves. Microsoft Purview sensitivity labels, with appropriate restrictions on each label and applied automatically by content classification where the firm’s licences include it, become the boundary Copilot honours at retrieval time. That is the rollout pattern built around the LSO guidance.
According to the Law Society of Ontario’s 2024 generative AI white paper, commentary [4A] to Rule 3.1-2 expects a lawyer to understand the benefits and risks of relevant technology. The same commentary ties that to the duty to protect confidential information in section 3.3. For a firm turning on Copilot, both duties apply to every lawyer who gets a licence.
According to the Federation of Law Societies of Canada’s 2024 Model Code of Professional Conduct, commentary [4A] to rule 3.1-2 covers competence with technology. It says a lawyer “should understand the benefits and risks associated with relevant technology, recognizing the lawyer’s duty to protect confidential information set out in section 3.3.”
Commentary [4B] scales that competence to the practice and to what technology is reasonably available. A firm rolling out Copilot can show that understanding through the permissions audit, the labels and the written use policy.
| Duty in the LSO guidance | What it asks of AI use | What the Copilot rollout puts in place |
|---|---|---|
| Competence (Rule 3.1-2) | Understand the tool’s benefits and risks, and independently verify what it produces | Role-based training and a written verification step for AI-generated citations |
| Confidentiality (Rule 3.3-1) | Keep client information out of AI systems that lack proper safeguards | Copilot inside the firm’s tenant, a permissions audit, and Purview labels on privileged files |
| Supervision (Rule 6.1-1) | Set firm policies on how staff use generative AI | A partner-approved AI use policy, staged licences by role, and an audit log |
| Court requirements | Confirm and follow each court’s requirements for documents prepared with AI | Citation checks in the AI use policy; lawyers confirm and meet court-specific requirements |
The Fusion Computing Copilot rollout for Canadian law firms
I like Copilot because I have full control. I have control over what data people can access, I can audit and gain visibility into that, and I can set governance and data loss prevention policies around it.
According to LAWPRO’s 2026 excess insurance information, the primary program for Ontario lawyers carries CA$1 million per claim and CA$2 million in the aggregate. Excess coverage sits above those limits. A citation verification step and a permissions audit are there to keep an AI error from reaching a client file at all.
“Fusion is the most forward thinking and knowledgeable MSP serving Legal Entities we have encountered. I highly recommend.”
How Copilot for law firms is priced
Microsoft licences are billed at Microsoft’s price. That is the Microsoft 365 Copilot licence, plus any licence the readiness assessment finds the firm needs for automatic labelling or audit retention past 180 days, such as Microsoft 365 E5 Compliance. Fusion Computing’s work starts with the Copilot Readiness Assessment, a $1,340 fixed fee. The assessment checks the firm’s tenant against Microsoft’s Copilot security documentation and proposes the fixes that fit how the firm will use Copilot.
The permissions cleanup, label configuration, use policy, audit-log setup and pilot are then quoted in writing. A rollout typically runs 30 to 60 days, depending on how the tenant is set up and how much oversharing it holds. For the firm’s ongoing IT, see the law-firm IT hub.
According to Microsoft’s 2025 announcement on in-country data processing for Microsoft 365 Copilot, updated in 2026, local processing of Copilot interactions for Canadian customers is expected in 2027. Under PIPEDA and the duty of confidentiality, a firm needs to know where Copilot interactions are processed and where its files are stored. Discovery documents both.
Related resources
Talk to a CISSP-led Copilot-for-law-firms team
Thirty-minute walk-through of your firm’s current M365 permissions hygiene, what a Copilot rollout built around the LSO guidance looks like, and the workflow automation opportunities sitting in plain sight.
Frequently asked questions
Who can help an Ontario law firm deploy Microsoft 365 Copilot?
Fusion Computing, a Canadian-owned, CISSP-led IT firm founded in 2012, deploys Microsoft 365 Copilot for Ontario law firms and other Canadian firms. Each rollout audits permissions, labels privileged matter files in Microsoft Purview, sets a partner-approved AI use policy and keeps an audit log. The approach follows the Law Society of Ontario’s 2024 generative AI guidance. Fusion Computing has offices in Toronto and Hamilton, with staff in Metro Vancouver.
Can our firm use Copilot and still meet its LSO duties of competence and confidentiality?
Copilot can support legal work when lawyers assess each use and stay responsible for the result. The Law Society of Ontario’s 2024 guidance asks lawyers to understand a tool’s risks and verify what it produces. It also asks them to keep client information out of systems without proper safeguards. Copilot inside the firm’s own tenant, with labels on privileged files, a written use policy, citation checks and an audit log, supports that work.
What is the oversharing problem, and why does it matter for Copilot?
Broad permissions can persist in SharePoint, OneDrive and Teams after their original purpose ends. Copilot can read anything the requesting user can open, and it answers in plain language. At a law firm, that can put another matter’s privileged file in front of the wrong lawyer. A permissions audit before rollout closes that access first.
How long does a Copilot rollout take at a law firm?
Typically 30 to 60 days. Week one is the permissions audit and gap list. Weeks two to four cover sensitivity labels and tenant configuration. Weeks four to six cover drafting and signing the partner-approved use policy. Once it is signed, the leadership team are the first Copilot users. Other practice groups follow as the partners approve them, one group at a time.
What does Microsoft 365 Copilot cost a law firm?
Microsoft licences are billed at Microsoft’s price: the Copilot licence, plus any licence the readiness assessment finds the firm needs for automatic labelling or audit retention past 180 days, such as Microsoft 365 E5 Compliance. Fusion Computing’s work starts with the Copilot Readiness Assessment, a $1,340 fixed fee. The assessment checks the firm’s tenant against Microsoft’s Copilot security documentation. The permissions cleanup, labels, use policy and pilot are then quoted in writing, based on what the assessment finds.
What about CoCounsel, Harvey and other legal-specific AI tools?
Legal-specific AI tools have their own contracts on how client data is handled, separate from Microsoft’s terms for Copilot. The governance pattern stays the same. The tool is tied to the firm’s sign-in where the vendor supports it, falls under the partner-approved use policy, and keeps an audit log. The configuration differs by vendor, so each tool is reviewed on its own terms.
