Phi-4 family

Compact open model family; Microsoft's official product page calls Phi-4-mini and Phi-4-multimodal its newest Phi models. No newer flagship release was verified in this pass.

Score calculation

(7 + 6 + 6 + 2) ÷ 4 = 5.3

4 of six dimensions rated. Unrated dimensions and BDS status are excluded.

Full scoring method ↗

Setup details

Product listing establishes the latest verified family members as of this check, not that no later checkpoint exists. Environmental/privacy/customer findings are not model-specific unless noted.

Microsoft's Phi product page identifies Phi-4-mini and Phi-4-multimodal as the newest members. Checked October 23, 2026; no newer Phi release was verified through the official page.

Energy

↑

Microsoft positions Phi as small language models, which enables local deployment options, but the checked official page provides no Phi-4 training or inference energy/water/carbon measurement.

Reasoning & sources

Microsoft describes Phi as small models suited to local deployment but provides no Phi-4 energy measurement in the cited materials. Local use can change where energy is consumed rather than prove that less is used; compare the target device and workload.

No model-specific lifecycle or standardized task-energy data found.

Phi open models ↗

Training rights

↑

the product page describes capabilities and model family but not a Phi-4-specific training corpus, licensing, or consent audit.

Reasoning & sources

Microsoft’s Phi product pages, collection, and cookbook explain the family but do not provide a Phi-4 training-corpus list or rights audit. Users who need source traceability should request checkpoint-level documentation.

Need model cards and data provenance for exact Phi variants.

Privacy

↑

For Phi models that are deployed as 'Models sold by Azure' in Microsoft Foundry, Microsoft's current policy says prompts/completions are not used to train or improve foundation models, and are not stored in the stateless model; standard deployments process data in the customer-specified geography. Abuse monitoring can retain flagged prompt/completion samples for limited human review unless modified monitoring is approved. Stateful features (such as Responses/Threads/files) may store data in the Azure tenant. Microsoft's catalog lists Phi-4-family models in its Azure-sold availability material. These protections do not automatically apply to partner/community listings, other hosts, or local deployments.

Reasoning & sources

Azure Foundry’s policy says prompts and completions for models sold directly by Azure are not used to train or improve foundation models, subject to the listed service boundary. This protection does not automatically cover other hosts or Microsoft products, so verify the exact route and region.

Azure's sold-model policy provides strong no-foundation-model-training and geography controls for standard deployments, while abuse monitoring can include human review and stateful features retain data; the rating is conditional on the exact Azure deployment class.

The score applies only to a Phi deployment explicitly designated sold by Azure and configured deployment type/features; partner/community hosted models, local installations, and preview exceptions can differ.

Openness

↑

Microsoft labels Phi as an open model family and provides deployment documentation; access terms and weights are checkpoint-specific. Verify the license attached to the chosen Phi-4 variant.

Reasoning & sources

Microsoft calls Phi an open model family and publishes some weights and deployment materials, but the exact checkpoint license and artifacts vary. This reflects access to selected weights, not a claim that every Phi release or its training dataset is open.

Microsoft presents Phi as an open model family, but this pass did not verify the exact Phi-4 checkpoint license and artifacts.

No exact Phi-4 license or complete training recipe was checked here.

Worker treatment

↑

Microsoft’s FY2025 Human Rights Transparency Report describes supplier monitoring and reports findings in its Devices/Cloud Supply Chain and Provisioning scope, including 34 forced-labor/trafficking indicators (33 closed, one corrective plan), 50 fair-compensation findings (46 closed, four plans), and 75 working-hours/rest findings (68 closed, seven plans). These are supplier-audit findings, not AI-annotation-specific results.

Reasoning & sources

Microsoft reports supplier findings and closure plans, but the reported scope is not specific to AI annotation and some plans remain open. This is relevant when deciding whose business to support, while pay and working conditions for the team behind Phi-4 family remain unestablished. Ask for current worker outcomes for that team and its suppliers.

The Phi-4 card documents model provenance and licensing, not the conditions of people who prepared data or evaluations. Its technical openness cannot substitute for labor terms; users comparing worker treatment should treat this category as undocumented for Phi-4.

Microsoft reports supplier findings and closure plans, but the reported scope is not specific to AI annotation and some plans remain open. This rating describes the company relationship or supplier policy, not a finding about this particular product’s use.

Working conditions for the people building or supporting Phi-4 family are not established by this company-wide record. The published findings cover specified supplier audit scopes, not all suppliers, model evaluation labor, or all remediation outcomes.

Government & military

↑

Microsoft’s final 2026 review says its external investigation found evidence supporting elements of 2025 reporting, including IMOD Azure storage consumption in the Netherlands and AI-service use. Microsoft says it disabled specified storage/AI subscriptions in September 2025, while continuing other software, professional services, Azure and Azure AI services to IMOD.

Reasoning & sources

The company confirms defense-ministry Azure/AI use and a review supporting elements of serious surveillance-related reporting; it stopped specified services but continues others. This is relevant when deciding whose business to support. Deployment of Phi-4 family or this particular model release under those contracts remains unestablished; consider the company relationship separately from the product’s actual use.

Microsoft markets mission-ready cloud and AI for U.S. defense and intelligence, while its Phi-4 materials establish only the model release and license. That makes the parent company’s defense business relevant context, but a deployment record must name Phi-4 before attributing military use to this checkpoint.

The company confirms defense-ministry Azure/AI use and a review supporting elements of serious surveillance-related reporting; it stopped specified services but continues others. This rating describes the company relationship or supplier policy, not a finding about this particular product’s use.

Deployment of Phi-4 family under these contracts is not established. The report does not access IMOD customer content, does not establish the content/use of every service, and does not say the wider commercial relationship ended.

BDS status

↑

Microsoft is named as a consumer boycott priority target in the BNC guide. The product is developed or supplied by Microsoft.

Reasoning & sources

If following this BNC campaign is a requirement, consider alternatives to paid Microsoft products where practical. Running downloaded weights locally is a different decision from paying the developer or a cloud host; check the host as well. This label follows the named company’s campaign status; it does not claim that BDS separately reviewed this exact product.

This review covers the named targets in the BNC consumer/pressure guide and No Tech campaign, not every BDS campaign, local group, investment or supplier. Lists and ownership can change. A company’s absence from these lists is not an endorsement or proof that it has no relevant relationships.

Microsoft’s final 2026 review says Covington found evidence supporting elements of reporting about IMOD Azure storage and AI-service use, including Azure storage consumption in the Netherlands. Microsoft says it disabled specified subscriptions/services in September 2025 but continues providing IMOD with other Azure, Azure AI, software, and professional services. The report did not access customer content and does not establish all downstream uses.

How Phi-4 family is used in this relationship is not established. Microsoft describes only selected service suspensions; the report does not establish all IMOD use, civilian impact, or the full scope of continuing services.

All sources