Most of the ChatGPT use in your business is probably happening on accounts the business has never seen: a free or Plus account, signed up with a work email address and paid for on a personal card.
The person using it is getting work done, and nothing about that is misconduct. Even so, the plan they are on decides three things you are answerable for: whether what they type can be used to train the model, who controls the account and what leaves with them when they go.
Two families of plan
ChatGPT comes in plans for individuals and plans for businesses, and the line between them matters more than any feature.
The plans for individuals are Free, Plus and Pro, with Go sold in some countries as a cheaper step up. Each one belongs to the person who signed up, even if they used a work email address. For businesses, the plans are Business, which was called Team until 2025, and Enterprise. Those belong to a workspace your business owns and administers.
| Free, Plus and Pro | Business | Enterprise | |
|---|---|---|---|
| Who the account belongs to | The person who signed up, even with a work email address | A workspace your business owns | A workspace your business owns |
| Training on what people type | May be used unless the person switches it off | Not by default | Not by default |
| When someone leaves | The account and its history leave with them | Removed by hand, if published comparisons still hold when you buy | Published comparisons list automatic provisioning from your directory |
On a personal plan
OpenAI's own help pages say that on its plans for individuals, Free, Plus and Pro, it may use what people type to train its models. Each person can switch that off under a setting called "Improve the model for everyone", and from then on their new conversations are not used for training. Because the setting belongs to the person, you cannot see whether it is on, set it for them or check it later.
There is also Temporary Chat, which is not used for training and is kept for up to 30 days for safety reasons. Although it helps the individual, it gives the business no record and no control.
A vendor's promise to delete conversations can be overruled. In 2025 a US court order in a copyright case required OpenAI to keep consumer conversations, deleted ones included, until the obligation ended that September. Enterprise customers were outside it. Although nothing went wrong for most people, the episode still shows that on a personal plan your client's information sits under terms neither you nor the person using the account negotiated.
Two things make a personal plan harder to live with than it first looks. Personal plans have been able to connect to email and file storage, so a work mailbox can end up linked to an account the business does not own. And when the person leaves, the account leaves with them, along with every conversation, uploaded file and custom instruction in it.
On Business
For a business of 50 to 500 people, Business is usually the first plan worth buying. OpenAI's position is that it does not train on business data by default, and the workspace is yours: you decide who is in it, you can remove someone on their last day, and sign-in can run through your company identity. A data processing agreement is available, which your clients may ask about.
The thing to check before you buy is how leavers are handled. Published comparisons put automatic provisioning from your directory, where removing someone in Microsoft 365 or Google Workspace removes them from ChatGPT too, in Enterprise rather than Business. If that holds when you buy, somebody has to remove each leaver by hand, which means it belongs as a named step in your leaving process.
On Enterprise
Enterprise adds the controls a larger or more regulated business tends to be asked for. Published comparisons list audit and content logs that your own tools can collect, settings for how long conversations are kept, a choice of region for stored data, encryption keys you can hold yourself and automatic provisioning. Because the details have moved more than once, check each one against OpenAI's current terms for your region.
Most businesses do not start here. The usual trigger is a client, a regulator or an insurer asking for something specific: logs of what went in, data kept in a named region or proof that a leaver lost access the day they left. If nobody is asking yet, Business with a written leaving step covers most of it.
Moving your people onto a plan you control
The order matters, because a business plan bought before anyone asks who is on what tends to sit alongside the personal accounts.
- Ask who is using ChatGPT, on which plan and for what, and say in the same message that nobody is in trouble for the answer.
- Set up the business workspace under company sign-in, for the people who need it first rather than everyone at once.
- Ask people to bring their ongoing work across and stop using personal accounts for work. Their old history stays on the personal account, so tell them what to delete from it.
- Stop personal accounts reaching work systems. Microsoft 365 and Google Workspace both let an administrator restrict which outside apps a person can grant access to their work account, which closes the route from a personal ChatGPT plan into your mailbox and files.
- Write the rule down. What an AI policy should contain has a sample line for personal accounts that people will follow.
Where this fits
Bringing sign-in under your company account is part of Govern, because it is the step that makes the policy's rule on personal accounts true in practice. Whether ChatGPT is the right tool at all is a separate question, covered in Claude, ChatGPT or Copilot, and it is worth answering before you buy seats for everyone.
If you do not yet know which accounts are in use, on whose logins and reaching what, the readiness snapshot finds them. For a first look on your own, ten questions take about two minutes and send nothing anywhere.