Useful distinction between EDP cover and EU Data Boundary — teams keep mixing those up. One practical addition for the pilot phase: pick one recurring work package for the Entra group (e.g. long-document research in Researcher, or a weekly Excel variance pack) and ban personal data in that pilot by process, not only by DLP. Have the DPO sign off on that package before Phase 3. Also worth writing down which prompts must stay on OpenAI-only models (customer PII, HR, regulated finance) so users don't guess. The Cowork May deadline is the right forcing function — deciding under product pressure is how Shadow AI comes back through the side door.