Where Microsoft 365 Copilot lands in the EU AI Act risk tiers, what deployer obligations actually require, and how to build an audit-ready posture with the tools Microsoft provides and the gaps they leave.