ChatGPT for business: plans, security and house rules

Chances are your colleagues already use ChatGPT. Often with their own account, sometimes with a paid plan in their own name. For most mid-sized organisations, ChatGPT for business therefore comes down to one choice: set up a business plan, or accept that work runs through personal accounts.

Price is rarely the issue. The difference lies in management, what happens to your data and whether you can show how you have arranged it when a customer asks.

Which plans are there?

OpenAI broadly offers three kinds of plan:

• Free and Plus: personal accounts, without central management by your organisation.
• Business: for teams, with central user management, a shared workspace and custom GPTs.
• Enterprise: for larger organisations, with extra security and admin options and contractual agreements.

Prices and terms change regularly. Always check OpenAI's pricing page for current amounts. Bear in mind billing in US dollars, with VAT on top.

More important than the licence: adoption costs more. People learning to work with it, configuring applications and agreeing house rules. If you only budget for licences, you underestimate the investment.

Why a personal account isn't enough

This is the question behind "is ChatGPT safe for business". There are four concrete differences.

Training on your data

According to OpenAI, business plans don't train on your input by default. With free and personal accounts it depends on the user's settings, and as an employer you have no visibility of that. The current terms are in OpenAI's enterprise privacy statement.

Data processing agreement

Without a data processing agreement with the supplier, you can't process personal data properly under the GDPR. With an employee's personal account there is formally no relationship between your organisation and the supplier.

When someone leaves

An employee who leaves takes their personal account with them, including all the business context in it: customer names, pricing agreements, drafts and internal ways of working. A business account you simply revoke.

Accountability

When a customer or regulator asks how your AI use is organised, "everyone uses their own account" is not an answer. The AI Act also places the duty on the employer to make sure staff have sufficient AI knowledge. See AI literacy.

What can go in and what can't?

A workable split for a business account with a data processing agreement:

• Fine, without checking: marketing copy, published information, summarising public sources, general product descriptions.
• Fine, after consideration: draft quotes, internal notes, meeting minutes, process descriptions, customer data for which a legal basis and processing agreement are in place, financial figures before publication.
• Not allowed: special categories of personal data such as health, religion or trade union membership, data under a confidentiality agreement with a customer without permission, and passwords or access keys.

One rule of thumb everyone remembers: what you wouldn't email to an outside party without thinking, you don't put into an AI tool without checking. Record the split in your AI policy.

GDPR: what do you arrange?

Four steps, in this order:

• Conclude a data processing agreement with the supplier through the business plan.
• Determine your legal basis and add the processing to your record of processing activities.
• Check where the data is processed and which safeguards apply to transfers outside the EU.
• Carry out a DPIA for processing with a high risk for the people involved, for example if you systematically assess people.

Then there is the AI Act. For ordinary use of ChatGPT this is limited: making sure your people have AI knowledge and being open with customers when they deal with AI output. See the AI Act and GDPR: what do you need to sort out now?.

ChatGPT, Copilot, Claude or Gemini?

The answer depends on where your work happens.

• ChatGPT: strong for open-ended tasks, custom GPTs and quick experimenting.
• Microsoft 365 Copilot: strong if your work lives in Outlook, Word and Teams and you want to work with your own documents and email.
• Claude: strong with long documents and writing.
• Gemini: the logical choice if your business runs on Google Workspace.
• European providers such as Mistral: worth a look if you need your data to stay in Europe.

If your business runs on Microsoft 365, Copilot is often the logical starting point for daily work, with a few ChatGPT accounts for the people who want to experiment further. Forcing one tool on everyone rarely works. What each tool can do with your own systems is covered under the integrations for ChatGPT, Claude and Microsoft 365.

Where does it really save time?

A licence delivers nothing. Use does. These are the applications where mid-sized businesses notice a difference fastest:

• Drafts for quotes, customer emails and proposals. Not finished, but a starting point. See creating quotes with AI.
• Summarising long documents, reports and call notes.
• Rewriting and translating into the right tone or language.
• Analysing an export: patterns in customer feedback or categories in a list.
• Preparing conversations: background, questions and likely objections.

What doesn't work without further set-up: processes tied to systems. Processing invoices, routing email automatically or qualifying leads needs integrations, not a chat window. See automating business processes with AI.

How to stop it fizzling out

The familiar pattern: a business buys ten accounts, three people use them enthusiastically and the rest stop logging in after two weeks. This helps:

• Start with a concrete bottleneck. "Our quotes take too much time" is a starting point, "let's do something with AI" isn't.
• Start with one team, not the whole organisation.
• Agree the house rules before the roll-out, not after. One page is enough.
• Build two or three shared GPTs for recurring work, such as quote text in your own style.
• Measure something: hours per week on one task, before and after.

Keep an eye on output quality too. A language model sounds convincing even when it's wrong. See preventing AI hallucinations.

Next step

Want to know where your business has the most time to gain before you buy licences? Read which business processes suit AI, or have it worked out in the AI Opportunity Audit. If you want to get your team started first, the AI workshop is a good place to begin.