At a housing association, Microsoft Copilot is the approved AI tool and ChatGPT is the one people open most. Then the communications team asks for Claude, because they have heard it writes well. While looking into the request, the IT lead finds a setting in the Microsoft 365 admin center that would let Copilot use Claude too.
Which of the three writes or reasons best is not something we measure, and it shifts with every model release. What happens to the organisation's data comes down to three layers: the account, what the assistant can reach and the overlap, because Microsoft Copilot, the new name for Microsoft 365 Copilot, also runs on Claude. The details for each tool are in our pieces on ChatGPT, Claude and Copilot.
What the account decides: training, contract and storage
For data, the dividing line runs through each brand rather than between them. A personal account falls under consumer terms: the vendor can use chats for training unless the user switches that off, and there is no data processing agreement. A business account excludes training by default, comes with one and gives an admin control, including over the chats themselves (can your employer see what you do in ChatGPT?). Why this works the same way at every vendor is explained in our comparison of free and business AI accounts.
The account does not change the company behind the tool, and it changes where data is stored only for a few business variants.
| Tool and account | Training | Data processing agreement | Company | Storage | Reach |
|---|---|---|---|---|---|
| ChatGPT Free, Go, Plus, Pro | Can be used for training unless the user opts out | No | OpenAI, US | No choice of region | What is pasted, uploaded or connected |
| ChatGPT Business | Not used for training by default | Yes | OpenAI, US | No choice of region | The same, within the apps the admin allows |
| ChatGPT Enterprise, Edu | Not used for training by default | Yes | OpenAI, US | Europe possible for new workspaces | The same, within the apps the admin allows |
| Claude Free, Pro, Max | Used for training when the setting is on | No | Anthropic, US | No choice of region | What is pasted, uploaded or connected; Cowork on Pro and Max |
| Claude Team, Enterprise | Not used for training | Yes | Anthropic, US | United States | The same, with connectors and Cowork as the admin sets them |
| Copilot with a personal Microsoft account | Depends on the app version | No | Microsoft, US | No choice of region | The web and what the user adds |
| Microsoft Copilot Chat (work account) | Not used to train foundation models | Yes | Microsoft, US | EU Data Boundary; Claude models, web searches and flex routing can process outside it | Mostly the web and what the user adds; in Outlook also mail and calendar |
| Microsoft Copilot (licence) | Not used to train foundation models | Yes | Microsoft, US | EU Data Boundary; Claude models, web searches and flex routing can process outside it | Everything the user can open in Microsoft 365 |
In the training column, Claude's personal plans changed most recently: Anthropic announced the change on 28 August 2025, and existing users had to choose by 8 October 2025.
The storage column is based on what the vendors themselves say. OpenAI offers storage in Europe only to eligible new Enterprise and Edu workspaces (OpenAI). Anthropic says data from its commercial products is stored in the US (Anthropic); in Europe, Claude is available with regional storage through AWS Bedrock and Google Cloud Vertex AI (Claude). Microsoft stores Copilot data for EU customers within the EU Data Boundary (Microsoft). Processing can still take place outside it: when a Claude model handles a request, for web searches and, at peak load, through flex routing, which is on by default in tenants created after 25 March 2026. And all three companies are American, so none of them is a European alternative.
What each assistant can reach
ChatGPT and Claude work with what someone gives them: pasted text, a file, a screenshot and the apps someone connects, such as a mailbox or a drive. What needs managing is what ends up in the prompt and which connections people switch on.
A licensed Microsoft Copilot starts from the other side. It searches mail, calendar, Teams chats, SharePoint and OneDrive through Microsoft Graph, with the permissions of the person asking. It grants no new access, but a folder shared too widely years ago becomes findable with one question. Copilot Chat without the licence works mostly with the web and what the user adds, plus mail and calendar in Outlook (Microsoft).
For ChatGPT and Claude the thing to manage is the prompt; for Copilot it is the permissions. What that means for connectors and administration in ChatGPT and Copilot is set out in ChatGPT versus Microsoft Copilot for business use.
Copilot also runs Claude
Microsoft Copilot runs on several models: GPT models that Microsoft hosts itself, GPT models operated by OpenAI and Claude models from Anthropic (Microsoft, application card). Anthropic acts as a subprocessor of Microsoft, so Microsoft's Product Terms and Data Protection Addendum apply, not a contract with Anthropic. The exception is a set of advanced models Microsoft calls "Anthropic models with Data Retention": those fall under Anthropic's own terms and have to be switched on separately (Microsoft).
For most commercial customers, Microsoft switches the Claude models on by default. In the EU, EFTA and the UK they are off by default, with one exception: in Word, Excel and PowerPoint, Copilot uses Claude by default in tenants created after 25 March 2026, and older tenants find their default in the Message Center (Microsoft). Whenever Claude handles a request, the processing takes place outside the EU Data Boundary.
For the decision, this means that approving Copilot can include Claude without anyone having asked for it. Check the "AI providers operating as Microsoft subprocessors" setting in the Microsoft 365 admin center, and decide whether processing outside the EU Data Boundary fits your AI policy. The request from communications is then a separate question: Claude through Copilot falls under Microsoft's contract, Claude Team under Anthropic's.
What ChatGPT Work, Claude Cowork and Copilot Cowork can reach
All three vendors now have an agent that does more than answer. It opens files, uses connected apps and keeps going while you do something else; ChatGPT Work and Claude Cowork can also work in a browser. The reach grows from the prompt to folders, connectors and the browser, and each agent is tied to different subscriptions.
ChatGPT Work launched on 9 July 2026 as an agent for longer tasks across connected apps and files. In the desktop app it can use local files and desktop apps with permission, and work in a built-in browser. It is available on every plan in the desktop app for macOS and Windows, with limited access on Free and Go, and on web and mobile for Plus, Pro, Business, Enterprise and Edu (OpenAI).
Claude Cowork comes with the paid plans: Pro, Max, Team and Enterprise (Anthropic). It works in a browser, in folders you share through Claude Desktop and in connected apps such as Gmail, Google Drive, Microsoft 365 and Slack. Since 16 September 2026, Anthropic has been merging chat and Cowork into one Claude, starting with Pro and Max (Anthropic).
Copilot Cowork carries out tasks across Microsoft 365: it sends mail, schedules meetings, creates documents, posts in Teams and manages files in OneDrive and SharePoint, within the user's permissions. With a work account it needs a Microsoft Copilot licence and usage-based billing (Microsoft); for personal accounts it is in preview. Microsoft's application card names Claude models from Anthropic as the models behind it (Microsoft), so the previous section applies here as well.
On personal plans, the agent runs under consumer terms with the user's own folders and accounts: ChatGPT Work on the desktop even on Free and Go, Claude Cowork on Pro and Max. In the business variants the admin decides which apps and connectors the agent may use; on OpenAI's and Anthropic's Enterprise plans the admin also decides whether it is switched on at all, and at Microsoft the licence determines who gets it. So a decision about the chat is not automatically a decision about the agent. For each variant, record whether the agent is included; what Anthropic itself advises for Cowork is covered in our article on Claude's privacy risks.
All three in use: a decision per variant
The housing association is in exactly that position. The licences are in place, ChatGPT is already open in many browsers and a decision on paper will not make the other accounts disappear. The useful question is which status each variant gets: allowed, limited use, no decision yet or not allowed.
For the housing association, it works out like this:
- Microsoft Copilot with a work account: allowed, and the alternative employees are offered. The Anthropic setting stays off until the privacy officer has assessed the processing outside the EU Data Boundary.
- ChatGPT Business: limited use, with the condition "General questions are fine, no personal or customer data."
- Claude Team: no decision yet. The request from communications is on hold until the privacy officer has looked at storage in the US and at what Cowork may open.
- Personal ChatGPT, Claude and Copilot accounts: not allowed, with Microsoft Copilot as the alternative.
In BeeSensible's catalogue, the consumer and business variants of a service are separate entries, each with its own risk score. The extension shows which AI tools are opened and reports only the domain, at most once per day per device and without a user ID. The administrator records a decision for each variant. When someone opens a tool set to "Limited use" or "Not allowed", they see that decision in the browser: the condition, or the allowed alternative first. Side by side:
