Microsoft✓

Stav’s assessment

Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.

• transparency

  Phi-4-reasoning-vision-15B was released with full model weights, fine-tuning code, and benchmark evaluation logs under a permissive MIT licence, continuing Microsoft's pattern of detailed technical disclosure for open-weights releases.

• compliance

  Microsoft signed the full GPAI Code of Practice in August 2025 and maintains a dedicated EU AI Act Trust Center page, among the stronger EU AI Act compliance signals from a major model producer.

• community

  The Phi family continues active development and public release under the MIT licence through 2026, enabling fully sovereign EEA self-hosting without any dependency on a Microsoft-run inference endpoint.

• security

  Microsoft's Digital Crimes Unit disrupted the StealC and Amadey malware infrastructure in June 2026, and the company maintains a transparent public incident-response blog documenting attacker techniques and defensive recommendations.

Published safeguards & certifications