Copilot vs ChatGPT Enterprise: what organisations approve

01

What organisations run on each

Copilot and ChatGPT are reported alongside each other in federal office work. In the 2025 inventory, 36 of 45 US federal agencies and offices reported a Microsoft Copilot assistant for at least one of 20 common tasks, and 11 of 45 reported ChatGPT. Ten of the 11 agencies and offices reporting ChatGPT also reported Copilot. Only the Department of Energy named ChatGPT Enterprise; the other ChatGPT users did not specify an edition. Agencies write Copilot loosely, from M365 Copilot to Copilot Chat, so these figures do not isolate paid Microsoft 365 Copilot. In August 2025, the General Services Administration offered ChatGPT Enterprise to every participating agency for $1 for one year; in September it offered Microsoft 365 Copilot at no cost for up to 12 months to agencies on Microsoft's G5 licences.

02

Which data each assistant may take

Under their own approvals, seven universities permit the same or more sensitive data in Copilot than in their listed ChatGPT options.

Of these seven universities, four set a higher routine data limit for Copilot and three set the same limit for both. Four of the seven list a university-licensed ChatGPT Edu edition, two have no university ChatGPT licence, and Southern Methodist University does not name its edition. Oregon and Maryland Baltimore publish no comparable ChatGPT ceiling: Oregon requires its own technology review first, and Maryland Baltimore is arranging a ChatGPT Business licence.

Clemson, CU Anschutz and Utah have enterprise ChatGPT agreements, yet their approvals range from public data only at Utah to Highly confidential at CU Anschutz. CU Anschutz allows HIPAA and FERPA data in both assistants.

03

Why the limits differ

The limits differ because each organisation approves a particular edition under its own agreements and data rules.

For Microsoft 365 Copilot, existing permissions help determine what it can retrieve. Microsoft says it "only surfaces organizational data to which individual users have at least view permissions", and Oregon tells its staff that Copilot "follows the same permissions and protections as Teams, Outlook, and SharePoint." Assess ChatGPT under its own agreement and settings. Iowa allows patient data in its Copilot services, while its ChatGPT Edu "is currently not HIPAA compliant and is not approved for use with patient data." Ohio State has no licence for ChatGPT Edu or Enterprise, and limits every unlicensed tool to public information.

The edition matters too. Southern Methodist University warns that approval of an enterprise service "does not automatically extend to the free, consumer, personal, or individually purchased version of the same product", and that approval of a platform does not mean every feature or integration is approved.

Federal agencies had temporary procurement offers, and these universities use their own education agreements and patient or student data rules. A company needs to assess its own tasks, contracts and settings before approving either assistant. Equal limits are appropriate only where both services meet its requirements.

04

What to check in each vendor's documentation

Check training on your data, access, retention and audit, residency, and the edition covered by the terms.

Work through which data the assistant can use and which systems it can access for each proposed task. Copilot can surface organisational data a user is permitted to view, so review who can open what before the rollout. OpenAI's FedRAMP-authorised service lists apps (formerly connectors) as off by default until the customer's administrator enables them. For a commercial workspace, verify its own defaults and approve apps individually.

05

How to write the split into your approval

For each assistant, name the edition, permitted tasks, data limit and required work account.

Approve tasks and data together. 'Summarising reports' leaves a decision unresolved if staff do not know which reports they may upload. Use the data classes your AI use policy already names, and specify the approved work account and integrations.

Microsoft says its enterprise data protection puts Copilot's prompts and responses under the same contractual commitments as Exchange email and SharePoint files. Check whether the terms and configuration cover your proposed use, including the model, web search and any agents.

To decide whether a second assistant is worth approving, try the work you need done with data it is allowed to use, and have the responsible person judge the result. Its additional value needs to justify the support and training you will take on.

Then train people in the tools you approved. In AI training, participants practise in the tools the company has approved and learn where a person must decide.