[sailfast]

Correct. It is precisely that a user can ask about someone’s medical history (or whatever else) and not be reported that would be in violation of any heavily audited system. LLM Summaries break the compliance.

[bongodongobob]

You allow what it can and can't see. If you include PII and medical records, that's your fault, not MS's.

[sailfast]

That’s fair - unless they’re marketing the bot as compliant.