OpenAI vs Copilot enterprise compliance: which one for procurement

TL;DR. ChatGPT Enterprise is a standalone OpenAI product with its own contract, DPA, and admin surface. Microsoft 365 Copilot is a feature inside an existing Microsoft 365 tenant, governed by the M365 contract and Microsoft's Products and Services DPA. ChatGPT Enterprise is the cleaner pick for a generation-and-analysis workflow that lives outside the buyer's existing Microsoft tenant; Copilot is the cleaner pick when the use case is grounded in M365 data and existing Microsoft 365 controls should govern. The Azure OpenAI route bridges the two for buyers who want OpenAI models with Microsoft contracting.

The three routes a Microsoft buyer faces

A buyer that wants OpenAI-class generation has three procurement routes:

1. ChatGPT Enterprise direct from OpenAI. Separate contract, separate admin console, OpenAI as data processor.
2. Microsoft 365 Copilot. OpenAI's GPT models run either as Azure OpenAI models operated by Microsoft or, since July 2026, as OpenAI-operated models with OpenAI as a Microsoft subprocessor (enabled by default for eligible commercial customers from 24 July 2026). The Microsoft 365 contract governs, and Microsoft is the processor under its DPA.
3. Azure OpenAI. OpenAI models hosted and operated by Microsoft on Azure for developer use. Microsoft is the processor, OpenAI is not a subprocessor on this route, and the contract is Azure's.

The first two are the comparison below. Azure OpenAI comes between them as a developer-facing option that mirrors many of Copilot's contracting properties.

The full reads live at the OpenAI profile and the Microsoft 365 Copilot profile.

1. Contract structure and data processor

| | ChatGPT Enterprise | Microsoft 365 Copilot | |---|---|---| | Contract | OpenAI Services Agreement (updated 1 December 2025, effective 1 January 2026) and Order Form, with the DPA incorporated by reference | Microsoft Customer Agreement / Enterprise Agreement + Microsoft Products and Services DPA | | Data processor | OpenAI | Microsoft | | Subprocessor for foundation model | N/A (OpenAI is the model maker) | Anthropic (since 7 January 2026) and OpenAI for OpenAI-operated models (since 23 June 2026). Azure OpenAI models are operated by Microsoft itself | | Cloud subprocessor | Microsoft, CoreWeave, Oracle Cloud Infrastructure, Google Cloud Platform, Amazon Web Services and Cerebras (cloud infrastructure), with Cloudflare for content delivery and web hosting, per OpenAI's sub-processor list of 14 October 2026 | Microsoft Azure (first-party) | | Existing buyer relationship needed | None, direct OpenAI contract | Existing M365 contract |

ChatGPT Enterprise is the direct path; Copilot is the indirect path through Microsoft. For buyers already on M365 with mature procurement and DLP controls, the indirect path is often simpler because the controls already exist. For buyers without M365 or with a generation-heavy use case that does not need to be grounded in M365 data, the direct ChatGPT Enterprise contract is cleaner.

2. Where customer data lives

| | ChatGPT Enterprise | Microsoft 365 Copilot | |---|---|---| | Default data location | OpenAI infrastructure (OpenAI does not state a default region). New ChatGPT Enterprise and Edu workspaces can store in-scope content at rest in one of ten regions, including Europe and the UK, at no extra cost, and eligible workspaces can add inference residency in Europe, the US or the UAE. API residency outside the US requires approval for abuse-monitoring controls and a Modified Retention amendment | Buyer's existing M365 tenant, EU Data Boundary service for tenants provisioned in the EU or EFTA (not Multi-Geo), with exceptions for flex routing, Anthropic models and Bing web search queries | | Customer content tenancy | OpenAI workspace tenant | Microsoft 365 tenant | | Underlying storage of conversations | OpenAI's enterprise storage with admin export and retention controls | M365 substrate: conversations are stored in the buyer's Microsoft 365 environment |

Copilot's tenant-bound default means the buyer's existing M365 data governance flows through to the AI feature. ChatGPT Enterprise runs in a separate OpenAI-managed environment, which adds a parallel environment to govern alongside the Microsoft 365 tenant.

3. Training default

| | ChatGPT Enterprise | Microsoft 365 Copilot | |---|---|---| | Use of customer content to train base models | No by default. If the customer explicitly opts in to share data, for example through opt-in feedback, OpenAI may use the shared data to train its models | No | | Use of prompts and responses to improve the AI feature | No, unless the customer explicitly agrees, for example through OpenAI's opt-in feedback mechanisms | No, except optional user feedback, which Microsoft may use to improve Copilot (not to train foundation models) | | Contract location of commitment | OpenAI Services Agreement s 4.2, supported by the DPA's purpose limitation (s 1.2) | Microsoft Product Terms (Microsoft Generative AI Services, Use of Content for Training), not the DPA |

The commercial default at both is protective. OpenAI states the commitment in section 4.2 of its Services Agreement: "OpenAI will not use Customer Content to develop or improve the Services, unless Customer explicitly agrees to such use." Microsoft states it in the Product Terms (Universal License Terms for Online Services, "Use of Content for Training") rather than in the DPA.

4. Subprocessor depth

| | ChatGPT Enterprise | Microsoft 365 Copilot | |---|---|---| | Foundation model providers as subprocessors | N/A (OpenAI is first-party) | OpenAI for OpenAI-operated models (since 23 June 2026) and Anthropic (since 7 January 2026). Azure OpenAI models are operated by Microsoft and involve no model subprocessor | | EU Data Boundary scope of the Anthropic route | N/A | Explicitly out of scope as of 2026-01-07 | | Cloud subprocessor | Microsoft, CoreWeave, Oracle Cloud Infrastructure, Google Cloud Platform, Amazon Web Services and Cerebras, plus Cloudflare (OpenAI sub-processor list, 14 October 2026) | Microsoft Azure (first-party) | | Implication for buyer's TIA | Six cloud infrastructure providers across several countries, plus support, data and moderation sub-processors, so the transfer assessment needs to cover OpenAI's full list. Data residency changes where content is stored and, in some regions, where inference runs | More complex, Microsoft + OpenAI + Anthropic, with named EU Data Boundary exceptions (flex routing, Anthropic models, Bing web search queries) |

Buyers who chose Copilot in part because of the published EU Data Boundary commitment should read the exceptions that arrived in 2026. The Anthropic route, added in January 2026, is outside the EU Data Boundary. It is off by default for EU, EFTA and UK tenants, except that Copilot in Word, Excel and PowerPoint uses Anthropic by default in tenants there created after 25 March 2026. Flex routing, on by default for eligible EU and EFTA tenants created after that date, lets Copilot inferencing leave the boundary at peak demand. Bing web search, whose generated queries fall outside the boundary and the DPA, is on by default in every commercial tenant. OpenAI-operated models, added in June 2026, are excluded from in-country processing commitments and included in the EU Data Boundary "except as otherwise noted in the EU Data Boundary documentation", which allows an AI subprocessor to process and store a pseudonymised user ID or session GUID outside the boundary, including in the United States.

5. EU/UK transfer mechanism

| | ChatGPT Enterprise | Microsoft 365 Copilot | |---|---|---| | SCC version | EEA and Swiss data: processed by OpenAI Ireland, whose onward transfers rest on its own agreements containing SCCs or on an adequacy decision, so the customer enters no SCCs with OpenAI for that data. UK data: the 2021 SCCs as amended by the UK Addendum, deemed entered into with OpenAI OpCo (Module Two where the customer is controller, Module Three where it is processor) | 2021 SCCs implemented by Microsoft between Microsoft Ireland Operations Limited and Microsoft Corporation, processor-to-processor module (Module Three is our gloss), so the customer is not a party | | UK Addendum | Yes | Yes | | EU residency commitment | Europe (EEA and Switzerland) storage at rest for new Enterprise and Edu workspaces, with optional inference residency in Europe. Workspace metadata and billing information may be stored, and non-GPU processing may run, outside the region | EU Data Boundary service for tenants provisioned in the EU or EFTA (not Multi-Geo), with exceptions for flex routing, Anthropic models and Bing web search queries | | Sovereign cloud option | N/A within OpenAI direct | Microsoft Sovereign Cloud (formerly Microsoft Cloud for Sovereignty) for governments and regulated industries, as Sovereign Public Cloud (Microsoft-operated, within boundaries such as the EU Data Boundary), Sovereign Private Cloud or National Partner Clouds. Microsoft's overview does not name Copilot among the services, and Microsoft 365 Local in the private model runs Exchange, SharePoint and Teams |

For buyers in heavily regulated EU / UK contexts, Microsoft publishes sovereign deployment models under Microsoft Sovereign Cloud, although its overview does not say which of them support Copilot, so that needs confirming with Microsoft. ChatGPT Enterprise's EU residency is set when a workspace is provisioned and covers stored content and, where chosen, GPU inference, but not all processing.

6. HIPAA BAA

| | ChatGPT Enterprise | Microsoft 365 Copilot | |---|---|---| | BAA available | Yes. ChatGPT Enterprise and ChatGPT Edu on sales-managed accounts, ChatGPT for Healthcare, ChatGPT for Clinicians (an individual BAA signed in the product) and the OpenAI API (no enterprise agreement needed, and self-serve acceptance requires a history of API usage). OpenAI offers no BAA for ChatGPT Business (formerly ChatGPT Team). Azure OpenAI is a Microsoft service, so any BAA for it is Microsoft's, not OpenAI's | Yes. Microsoft's BAA is part of the DPA by default for covered entities and business associates (customers can opt out), Microsoft lists Microsoft Copilot and Copilot Chat in scope, and generated web search queries are excluded | | Eligible tier | Sales-managed ChatGPT Enterprise and Edu, ChatGPT for Healthcare, ChatGPT for Clinicians and the API. Not ChatGPT Business or the consumer plans | Any commercial or GCC customer that is a covered entity or business associate, for in-scope services (consumer Copilot is not in scope) |

OpenAI signs BAAs for the API, for sales-managed ChatGPT Enterprise and Edu accounts and for ChatGPT for Healthcare, and an individual US clinician can sign one in ChatGPT for Clinicians. Microsoft includes its BAA in the DPA by default for covered entities and business associates, and Azure OpenAI, as a Microsoft service, falls under Microsoft's terms rather than OpenAI's. The rest of the procurement workflow is the same. See the HIPAA hub.

7. AI Act deployer-side read

OpenAI is the provider of the general-purpose AI models behind ChatGPT Enterprise. Microsoft is the provider of Copilot as an AI system, which runs on general-purpose AI models from other providers, including OpenAI and Anthropic. The deployer-side obligations fall on the buyer based on use case:

• ChatGPT Enterprise used for general writing, research, code, and analysis falls minimal-risk or transparency-tier.
• Copilot used for office productivity falls the same way.
• Either product used for an Annex III purpose brings the deployer obligations in Article 26 onto the buyer from 2 December 2027 (a fixed date set by Article 113 as amended by Regulation (EU) 2026/1744), unless the Article 6(3) exception applies (a system that profiles natural persons is always high-risk). Annex III covers, among other uses, recruitment or selection, decisions on promotion or termination, task allocation, and monitoring or evaluating workers' performance and behaviour (point 4), evaluating the creditworthiness of natural persons or establishing their credit score, "with the exception of AI systems used for the purpose of detecting financial fraud" (point 5(b)), and "risk assessment and pricing in relation to natural persons in the case of life and health insurance" (point 5(c)). Underwriting of other insurance is not listed. Because neither product is classified as high-risk, a buyer that puts either to an Annex III use should assess whether it has become the provider of a high-risk system under Article 25(1)(c).
• Custom Copilot Studio agents that act on M365 data can climb the AI Act risk tier quickly - the use case classifies the deployment, not the platform.

See the EU AI Act hub for the deployer assessment workflow.

8. Admin controls and integration surface

| | ChatGPT Enterprise | Microsoft 365 Copilot | |---|---|---| | Identity | SAML / SCIM / OIDC | M365 identity (Entra ID) | | DLP integration | OpenAI Compliance Platform (Enterprise and Edu), which feeds workspace logs and metadata to the buyer's eDiscovery, DLP or SIEM tools, with partner integrations including Microsoft Purview, Netskope, Forcepoint and Palo Alto Networks | Microsoft Purview: sensitivity labels, DLP policies that can stop Copilot processing sensitive prompts or labelled files and emails, and Insider Risk Management | | Conditional Access | Configured in the buyer's identity provider and applied when users sign in through it, so Entra Conditional Access applies where Entra is the SSO provider. OpenAI notes that users who can sign in another permitted way may not be covered by the same rules | Entra Conditional Access policies that include Microsoft 365 services in scope, as Microsoft's Copilot deployment guidance recommends | | Audit logging | Workspace audit logs through OpenAI's Compliance Logs Platform, which retains data for 30 days | Purview Audit (prompts and responses are captured in the unified audit log) | | Custom agents / extensions | GPTs and apps in ChatGPT, and the Responses API for custom builds | Copilot Studio, declarative agents, and Microsoft 365 Copilot plugins that package agents, skills, Copilot connectors and MCP integrations |

For an organisation already on M365, the admin surface favours Copilot for office productivity, because the Purview and Entra controls in the table apply to it without a separate integration. Buyers without that estate, or with a generation-heavy use case that does not need the M365 integration, get cleaner results from ChatGPT Enterprise directly.

Picking between them

Pick ChatGPT Enterprise when:

• The use case is generation, drafting, code, analysis, or research and is not grounded in M365 data
• The buyer is not already on M365 or the existing M365 contract is small
• The deployment needs OpenAI's API (Responses, files, vision and voice) as well as the chat product

Pick Microsoft 365 Copilot when:

• The use case is grounded in M365 content (Outlook, SharePoint, Teams, Loop, Word, Excel)
• The buyer's procurement gate values the Purview / Entra / Conditional Access integration
• The compliance frame benefits from the published EU Data Boundary documentation (subject to the flex routing, Anthropic and web search exceptions)
• Copilot agents (built in Copilot Studio or as declarative agents) are the planned production AI surface

Pick Azure OpenAI when:

• The buyer wants OpenAI models on the Microsoft contract surface for region-locked deployment
• The use case is developer-facing rather than office-productivity-facing
• A Microsoft Sovereign Cloud (formerly Microsoft Cloud for Sovereignty) deployment is part of the procurement gate

Run both when:

• ChatGPT Enterprise covers staff-facing generation workflows outside M365
• Copilot covers in-M365 productivity
• Two distinct deployer assessments because the use cases differ

The Anthropic subprocessor question changes the read

For any buyer whose procurement gate specifically values EU Data Boundary commitments, the January 2026 Anthropic addition to the Copilot subprocessor list is a compliance-side question that needs answering before signing. Anthropic models are off by default for EU, EFTA and UK tenants, but Copilot in Word, Excel and PowerPoint uses Anthropic by default in tenants there created after 25 March 2026. The realistic responses:

1. Accept the exception and document that Anthropic-routed Copilot features are outside the EU Data Boundary scope.
2. Leave the Anthropic subprocessor setting off and turn off the Word, Excel and PowerPoint setting where it is on.
3. Move generation-heavy workloads to ChatGPT Enterprise direct, where Anthropic is not in the processing chain, accepting that OpenAI's own list names six cloud infrastructure providers.

The decision depends on which Copilot features the buyer actually uses and how strict the procurement gate is.

Related reading

• The DPA hub: DPA for AI vendors
• The AI Act deployer-side read: EU AI Act for AI buyers
• The HIPAA-specific checklist: HIPAA for AI tools
• Cross-comparison: OpenAI vs Anthropic DPA
• Cross-comparison: Copilot 365 vs Google Workspace AI compliance

For ongoing AI compliance support, work with Janus DPO-as-a-Service. Browse the vendor index, other vendor comparisons, or the AI Agent Incident Register.