Vendor comparison

Perplexity vs ChatGPT for regulated industries: compliance comparison

Independent compliance comparison from Janus Compliance. Reviewed by Michael K. Onyekwere, CIPP/E. Last reviewed 2026-10-15. Not legal advice.

Profiles: Perplexity · OpenAI (ChatGPT)

Share this Perplexity vs OpenAI (ChatGPT) profile:Share on X Bluesky

TL;DR. ChatGPT Enterprise and ChatGPT Edu carry ISO/IEC 27701 certification alongside SOC 2 Type 2 and ISO/IEC 27001, and OpenAI signs BAAs for sales-managed Enterprise and Edu accounts. Perplexity Enterprise holds SOC 2 Type 2 and ISO/IEC 27001, and its terms provide for a BAA. Perplexity has a structural advantage for regulated-industry research workflows: its search answers come with source citations the buyer can verify, which simplifies the audit trail. For research and discovery tasks under regulated supervision, Perplexity Enterprise is often the better procurement choice. For drafting, transactional and integration work, ChatGPT Enterprise is usually the better fit.

The comparison frame

Financial services (FCA, PRA, SEC, FINRA), healthcare (HIPAA, NHS DSPT, EU national health laws), legal (SRA, BSB), pharmaceutical (FDA, EMA) and other regulated industries share three procurement concerns when picking an AI tool:

Evidence trail. Output the regulator can audit back to source.
Tier eligibility. The contracted product, not a consumer adjacent one.
Data controls. Training defaults, retention defaults, BAA where applicable, region commitments where applicable.

Perplexity and ChatGPT solve a different first-order problem (search-with-citation versus general-purpose generation), and that difference flows into the regulated-industry read.

The full vendor reads live at the Perplexity profile and the OpenAI profile.

1. What the tool actually does for a regulated user

| | Perplexity Enterprise | ChatGPT Enterprise | |---|---|---| | Primary mode | Search-grounded answers with inline citations | General-purpose chat, document generation, code, analysis | | Default output structure | Answer + cited sources (URLs the user can click) | Answer. Responses that use web search (run automatically or on request, where the workspace allows it) may include citations to the sources | | Retrieval source | Live web + connected knowledge bases | Model knowledge, web search where enabled, uploaded files, and internal sources connected through apps that admins enable | | Strongest use cases for regulated buyers | Regulatory research, market intelligence, due diligence summaries, expert-witness preparation | Drafting, summarisation, code, structured-data work, customer support, integration with other systems |

The citation behaviour is the structural advantage for Perplexity in regulated work. A compliance officer reviewing a research summary can click each citation, confirm the source, and document the evidence trail without re-running the workflow. ChatGPT searches the web when it judges that a question needs current information or when the user asks, and responses that use search may include citations. A response drawn only from the model's own knowledge is not tied to a source the reviewer can open, so a compliance reviewer needs to know which kind of answer was relied on.

2. Tier eligibility and the consumer trap

| | Perplexity Enterprise | ChatGPT Enterprise | |---|---|---| | Eligible tier for regulated use | Perplexity Enterprise | ChatGPT Enterprise, ChatGPT Edu, ChatGPT for Healthcare and the OpenAI API, with a BAA in place before any PHI. Azure OpenAI is a separate Microsoft service under Microsoft's terms | | Tier without enterprise contract | Perplexity Free, Pro and Max | ChatGPT Free, Go, Plus and Pro (consumer terms). ChatGPT Business (formerly ChatGPT Team) has OpenAI's Services Agreement and DPA, but OpenAI offers no BAA for it | | BAA eligibility (US healthcare) | Perplexity's Enterprise and API terms prohibit processing PHI unless a BAA has been executed with Perplexity. No BAA template is published, so scope is agreed with Perplexity | Yes. ChatGPT Enterprise and ChatGPT Edu on sales-managed accounts, ChatGPT for Healthcare, ChatGPT for Clinicians (an individual BAA signed in the product) and the OpenAI API (no enterprise agreement needed, and self-serve acceptance requires a history of API usage). OpenAI offers no BAA for ChatGPT Business, and Azure OpenAI is a Microsoft service, so any BAA for it is Microsoft's | | Training default on the eligible enterprise tier | No training on customer data | No training on customer data |

A staff member using free Perplexity or free ChatGPT for regulated work is operating outside the enterprise default. Both vendors' consumer tiers create the same exposure: the procurement policy has to address consumer use directly, either by blocking the consumer products or by an explicit signed-policy approach.

3. Data controls

| | Perplexity Enterprise | ChatGPT Enterprise | |---|---|---| | Training on customer data (enterprise tier) | No | No | | Default retention of enterprise interactions | Files attached to sessions are deleted after seven days. Organisations with 50 or more seats or an Enterprise Max seat can set session retention. Admins can enforce incognito mode (threads kept 24 hours) | API: OpenAI may retain inputs and outputs for up to 30 days to provide the services and identify abuse, except on endpoints its documentation lists, some of which keep application state longer. ChatGPT Enterprise: admins set retention, and deleted conversations are removed within 30 days unless OpenAI must keep them by law | | ZDR equivalent | None published for Enterprise Pro or Max (Perplexity states that its agreements with model providers include zero data retention). API: ZDR for eligible customers under a written agreement, not on by default | ZDR is an API option (eligible endpoints, qualifying use cases, subject to OpenAI's approval). OpenAI describes no ZDR option for ChatGPT Enterprise, where admins set retention | | SOC 2 Type II | Yes | Yes | | ISO 27001 | Yes, ISO/IEC 27001:2022 (certificate listed among the trust center resources) | Yes | | ISO 27701 | Not listed on the trust center | Yes | | EU data residency | None published. All listed subprocessors are in the US | Europe (EEA and Switzerland) storage at rest for new Enterprise and Edu workspaces, with optional inference residency in Europe. Azure OpenAI is a separate Microsoft service |

OpenAI lists ISO/IEC 27701 certification for ChatGPT Enterprise and Edu and offers EU data residency, and Perplexity publishes neither. Both vendors list SOC 2 Type 2 and ISO/IEC 27001. Buyers in regulated industries should obtain the current reports and certificates through each vendor's trust portal rather than rely on marketing pages.

4. AI Act deployer-side read

OpenAI is a provider of general-purpose AI models. Perplexity provides an AI system (its answer engine) built on its own Sonar models and on models from other providers. The deployer-side obligations fall on the buyer based on the use case, not the vendor:

Regulatory research, market intelligence, and due-diligence summarisation generally fall minimal-risk under the Act.
In financial services, Annex III covers AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, "with the exception of AI systems used for the purpose of detecting financial fraud" (point 5(b)), and AI systems intended to be used "for risk assessment and pricing in relation to natural persons in the case of life and health insurance" (point 5(c)). Underwriting of other insurance, and credit decisions about companies, are not listed. Where a listed use is high-risk (the Article 6(3) exception can take it out, but never where the system profiles natural persons), the deployer carries the obligations in Article 26 from 2 December 2027 (a fixed date set by Article 113 as amended by Regulation (EU) 2026/1744) and must carry out a fundamental rights impact assessment before first use (Article 27(1)). A buyer that puts Perplexity or ChatGPT to such a use should assess whether it has become the provider of a high-risk system under Article 25(1)(c).
Clinical decision support is not, as such, an Annex III use. It is high-risk under Article 6(1) and Annex I where the software is a medical device, or a safety component of one, that must undergo third-party conformity assessment under the Medical Devices Regulation (EU) 2017/745 or the In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746, and those rules apply from 2 August 2028 (also a fixed date under the amended Article 113). Emergency healthcare patient triage is listed separately in Annex III (point 5(d)).
Buyers in financial services or healthcare are usually also subject to sectoral AI guidance (FCA / PRA on AI in financial services; FDA on AI/ML-based Software as a Medical Device; EMA on AI in medicines regulation) - these apply on top of the AI Act.

See the EU AI Act hub for the deployer assessment workflow.

5. Subprocessor depth

| | Perplexity Enterprise | ChatGPT Enterprise | |---|---|---| | Foundation models in use | Perplexity's Sonar (built on Meta's Llama 3.1 70B) plus OpenAI, Anthropic, Google and xAI models, some served through Microsoft, Google Cloud or AWS | OpenAI's own models | | Cloud subprocessor | Amazon Web Services and Microsoft Azure (infrastructure), with Google Cloud and Amazon Bedrock listed for AI models, all US | Microsoft, CoreWeave, Oracle Cloud Infrastructure, Google Cloud Platform, Amazon Web Services and Cerebras, plus Cloudflare (OpenAI sub-processor list, 14 October 2026) | | Search index | Web search plus connected sources | Search using OpenAI's internal index and online web search, which at times sends rewritten queries to partner search providers | | Implication for buyer's TIA | Several cloud providers, plus third-party model providers as subprocessors | Six cloud infrastructure providers plus support and moderation sub-processors |

For buyers in regulated industries with strict transfer impact assessment requirements, both vendors involve several cloud providers. Perplexity adds third-party model providers (Anthropic, OpenAI, Google and xAI) as subprocessors, while ChatGPT Enterprise uses OpenAI's own models. Buyers who want OpenAI models under a Microsoft contract can consider Azure OpenAI, which is a separate Microsoft service.

Picking between them

Pick Perplexity Enterprise when:

The regulated-industry use case is research or due diligence and the citation-by-default behaviour materially shortens the evidence trail
The compliance officer needs to check research answers against named sources
The buyer's team is small and the workflow is "research → summary → human review → file" rather than "AI in production"

Pick ChatGPT Enterprise when:

The use case includes generation, drafting, summarisation, and code in addition to research
The buyer needs a BAA together with ISO/IEC 27001 and ISO/IEC 27701 certification for the same product
The buyer is building AI into a product surface (integrations, agents, customer-facing workflows) and needs the breadth of the OpenAI API

Run both side by side when:

The buyer's compliance owner is auditing a research workflow and the regulated-industry use case demands citations the regulator can click through
The team's drafting and generation workflow can run on ChatGPT Enterprise while the research workflow runs on Perplexity Enterprise

The shared regulated-industry checklist

Both vendors require the same buyer-side controls before any regulated-industry deployment:

Enterprise tier confirmed; consumer tier blocked or policy-controlled
DPA or BAA executed before any in-scope data enters the system
Sectoral AI guidance reviewed (FCA, FDA, EMA, SEC, FINRA, NHS DSPT, etc.)
Use-case classification under the EU AI Act if any EU exposure
Logging cadence set; human-review checkpoint documented
Workforce training delivered on the actual approved tool, not a generic AI policy
Quarterly review of vendor subprocessor changes (on Perplexity this includes new third-party model providers, where the DPA's only recourse is to stop using the model)