The enterprise tiers of the main AI assistants, Microsoft 365 Copilot, ChatGPT Enterprise, Claude for Work and Enterprise, contractually commit that business data submitted through them is not used to train the underlying models. That one commitment answers the concern behind most blanket blocks on AI tools and is the first control in a governed-access model. It is also widely misunderstood: it applies to specific tiers, it covers specific things, and it should be read rather than assumed.

What the commitment covers

That prompts, uploaded files and outputs from your tenancy are not used to train or improve the provider’s models. That is the headline, and on the enterprise tiers it is contractual rather than a setting. It is what lets you say to IT governance, legal and the board that company data entering the tool stays yours.

What it does not automatically cover

  • Consumer and some individual tiers. Personal accounts, and in some cases individual paid plans, have different defaults. The staff using personal ChatGPT accounts “outside work” are not covered, which is why the block that pushed them there made the risk worse.
  • Retention. Not training on data is not the same as not storing it. Enterprise tiers typically retain conversations for a period for abuse monitoring and for the customer’s own history; the period and the controls over it are separate terms.
  • Residency. Where the data is processed and stored, which matters for data-protection assessments and for some customer contracts, is a separate term again, and the options differ by provider.
  • Third-party integrations and plug-ins. A connector to another service carries that service’s terms, not the assistant’s.
  • Human review. Some providers reserve the right for staff to review flagged content for abuse. Understand when and how.
  • Your own agents built on the API. Terms for API use differ from the assistant products; if you build on a model, the API agreement is the one that applies.

Six things to confirm at contracting

  1. Which tier you are buying, and that the no-training commitment is in the agreement for that tier, not in a marketing page.
  2. Retention period for prompts and outputs, and whether you can shorten it or switch it off.
  3. Data residency options, and which you are getting.
  4. Admin controls: who can see usage, set policies, manage integrations, and export or delete data.
  5. Subprocessors and where they are, for your data-protection assessment.
  6. What happens on exit: how you get your data out and how long until it is deleted.

Write the answers into the usage policy, so the terms the business relies on are the terms the business tells its staff about.

Why this matters more than the choice of tool

Which assistant a business picks matters less than whether its access is governed. All three major providers now offer enterprise tiers with no-training commitments; the differences between them are real but secondary. The decision that changes the risk is moving staff from ungoverned personal accounts onto a governed enterprise tier, and the licence terms are what make that move defensible.

We are platform-agnostic and take no margin on any licence, so the reading of the terms is clean. The selection and rollout are described under AI tools and platform rollout, and the governance model the terms sit inside under AI governance and the EU AI Act.