A paid AI seat costs about $20 to $30 per person per month. It buys four things a free login cannot: a contract saying the vendor will not train on your content, control over how long conversations are kept, a tie to your corporate identity system, and a record you can audit. That is the whole security case, and it is a good one. The catch is that no invoice fixes the other half of the problem: Netskope finds that 47% of the people using generative AI at work do it on a personal account.
Search “enterprise AI vs consumer AI” and you get essays about software categories and governed data lakes. Useful for a platform team. Useless if what you hold is a seat-count decision and 180 staff who all already have a free login.
What enterprise AI vs consumer AI means at the login screen
The same model sits behind both buttons. What changes is the paperwork wrapped around it, and four clauses of that paperwork carry almost all the security value.
| What you are buying | Free or personal paid login | Managed workspace seat |
|---|---|---|
| Training on your content | Opt-out, user-controlled, often on by default | Contractually excluded, off by default |
| Retention | Vendor’s default cycle, user-controlled deletion | Admin sets the window; deletion is enforceable |
| Identity | Personal email, personal password, no link to your directory | Single sign-on, and on higher tiers automatic provisioning and deprovisioning |
| Visibility | None. The conversation does not exist as far as you are concerned | Audit logs, and on higher tiers a compliance API for eDiscovery |
Read the fourth row twice. The first three reduce exposure. The fourth decides whether you can answer a question under oath, and it is what turns a security conversation into a legal one.
Anthropic publishes the tier boundary plainly on its pricing page: Free, Pro and Max say “opt-out” on training, Team and Enterprise say “none by default,” single sign-on arrives with Team, and provisioning, audit logs, role-based access and a compliance API are held for Enterprise. Microsoft draws the line differently, giving Copilot Chat enterprise data protection at no extra per-user cost so prompts stay inside the tenant boundary, are logged for eDiscovery, and are excluded from foundation-model training. Google commits contractually that paid Workspace prompts and content do not train its public models.
None of them is hiding any of this. The problem is that none of them will tell you the part that follows.
The court order that drew its line at account tier
For four months in 2025, the difference between a free login and a managed seat stopped being a feature comparison and became a question of whose litigation you were caught up in.
On 13 May 2025, a magistrate judge in The New York Times v. OpenAI ordered the company to preserve output log data that would have been deleted. Deleted chats and temporary chats from Free, Plus, Pro and Team plans fell inside that order, along with API traffic not covered by a zero-retention amendment. ChatGPT Enterprise, Edu, and API customers with a zero-data-retention agreement sat outside it. The order lifted on 26 September 2025, and a limited set of logs from that window remains under legal hold.
Nothing about that was anybody’s security failure. A copyright dispute between two companies you have never dealt with reached into the retention policy of the account your staff happened to be using, and tier is what decided whether it reached yours. A policy document cannot protect you from that. Only the tier can.
What the seats cost, published
Every figure below was read off the vendor’s own public page or corroborated across several independent sources in October 2026. These pages change, so check before you put a number in a board pack.
| Plan | Published price | Minimum | Notable boundary |
|---|---|---|---|
| ChatGPT Business | $20 per seat per month billed annually, $25 monthly | 2 seats, capped at 200 paid seats since August 2026 | Admin controls, single sign-on, no-training commitment |
| ChatGPT Enterprise | By quote | Sales-led | Admin-set retention, compliance API, no seat cap |
| Claude Team | $20 per seat per month annually, $25 monthly | 2 seats | Single sign-on; no provisioning, no audit logs |
| Claude Enterprise | From $20 per seat per month annually plus usage | 20 seats | Provisioning, audit logs, role-based access, compliance API |
| Microsoft 365 Copilot | $30 per user per month, annual commitment, on top of a base license | Add-on | Tenant boundary, sensitivity labels, Purview eDiscovery |
| Microsoft 365 Copilot Chat | Included for many Microsoft 365 users | None | Enterprise data protection at no extra per-user cost |
| Google Workspace Business Standard | $14 per user per month annually | None | Gemini included; contractual no-training commitment |
Now the arithmetic that settles it. Put 180 people on a $25 monthly seat and you are at $54,000 a year. IBM’s 2026 Cost of a Data Breach Report, built on Ponemon Institute research across 602 organizations between March 2025 and February 2026, puts the average breach at $4.99 million and breaches involving unsanctioned AI at $5.39 million. Ninety years of seats costs less than one average breach.
Anyone still arguing the seat price is not arguing about money. They are arguing about who has to own the rollout.
Why buying seats does not close the gap
Here is where most coverage of this topic stops being honest. Buying the managed workspace moves the contract. It does not move the habit.
Netskope’s Cloud and Threat Report for 2026 found that 47% of people using generative AI at work do so through personal accounts. That is down sharply from 78% a year earlier, which is real progress worth saying out loud, and still close to half at a point when nearly every mid-market company has bought seats. The same report found about 3% of users committing an average of 223 data policy violations a month.
The shape of the residue matters more than its size. Cyberhaven’s 2026 adoption research reports that 39.7% of AI interactions involve sensitive data, and that personal-account use swings by more than a factor of two across tools: 24.9% for Gemini, 32.3% for ChatGPT, 58.2% for Claude, 60.9% for Perplexity. Read that as a sentence rather than a list. Companies buy a workspace on the one tool they standardized, and staff keep a personal login on the three they also use.
IBM’s data says the same from the incident side. Shadow AI was involved in 43% of breached organizations, up from 20%, and 92% of those with an AI-related incident lacked proper AI access controls. Policy adoption went backwards: 32% of breached organizations had an AI policy, down from 37%.
A paid seat is a control. Whether anyone uses it is a question about behavior, and behavior is a training problem. That is the argument we make at length in the safe AI use playbook, and it is the same gap between purchase and capability that runs through the case against treating licenses as enablement.
Four ways a paid rollout quietly fails
In workshops we run, the companies that bought seats and saw nothing change usually hit one of these four. None shows up on a usage dashboard as a problem.
Partial coverage. You licensed one assistant. An analyst uses a second for citations, a designer uses a third inside a creative tool, and sales found a fourth that writes call summaries. Three of the four are personal accounts, so your contract covers a quarter of the surface and your reporting covers a quarter of the risk.
The paid path is slower. Single sign-on adds a redirect, and the workspace build sometimes trails the consumer app on new features. Staff who were already productive in the free app keep the tab they have open. Friction decides this, not policy.
No link to offboarding. When someone leaves, a provisioned seat is revoked and the work stays in the workspace. A personal account walks out with eighteen months of history inside it, including whatever was pasted in. If AI accounts are not in the same deprovisioning checklist as email and your code repository, you have no offboarding process for them.
A policy nobody can apply. Staff have signed a line that says do not put confidential data into unapproved AI tools. Few of them can look at a browser window and say which account they are in, whether it trains on their input, or whether a client name counts as confidential there. A rule nobody can apply is not a control. That is most of the difference between AI risk training and the annual security module: the phishing module teaches suspicion, and this problem needs judgment.
Thirty days to move usage onto the account you pay for
Six steps, in order. The sequence matters more than the speed.
- Inventory the real surface, not the approved one. Pull the list of AI domains your network or browser management already sees, and ask four teams what they really use. Expect two or three tools you have never licensed. Most companies are surprised here.
- License the surface you found, or block it. One of the two for each tool. A tool that is neither is the default failure state, and it is where most of that 47% lives.
- Turn on identity, then provisioning. Single sign-on first, because it links the account to a person you employ. Automatic provisioning second, because it links the account to someone you still employ. Put every AI tool into the offboarding checklist the same week.
- Set retention deliberately. Pick a window, write down why, and have legal see it. Defaults are a decision somebody else made for you.
- Make the paid path the fast path. Deep links, a pinned tab, the workspace app installed by default, connectors wired to the document stores people use. If the managed account is more convenient than the personal one, this problem mostly solves itself.
- Teach the boundary in a working session, on real documents. Not a slide deck. An hour where people bring their own work, try it in the managed account, and get corrected in the moment about what belongs in it. That is where judgment forms, and it is what the security and risk-awareness training options compete to deliver.
Then measure one number monthly: the share of your AI prompts running through managed accounts. Not seats bought. Not logins. Prompts. It is the only figure that says whether the control you bought is attached to the behavior you were worried about.
What to ask a vendor before you sign
Seven questions. Any vendor worth buying from answers them in writing without a call.
- Is the no-training commitment in the data processing agreement, or only on the marketing page?
- Can an administrator set the retention window, and is deletion contractual or best-effort?
- Does this tier include automatic provisioning and deprovisioning, or only single sign-on?
- Is there an audit log, and is there an API that eDiscovery tooling can read?
- Which compliance attestations are current, and will you sign a business associate agreement if we need one?
- What are the seat minimum and the seat cap, and what happens when we cross either?
- Where is data processed and stored, and can we pin it to a region?
If you want a second opinion on where your stack sits, the free AI-readiness call is a 30-minute version of the first two steps above. Leaders who need the oversight framing rather than the configuration detail should start with the governance training options for boards and executives.
Frequently asked questions
Does a paid AI account stop the vendor training on our data?
On business and enterprise tiers, yes, and it is a contract rather than a setting. Anthropic lists “none by default” for Team and Enterprise against “opt-out” for individual plans, Microsoft excludes prompts under enterprise data protection from foundation-model training, and Google commits the same for paid Workspace editions. On a personal account the protection is a toggle, so it depends on each user having found it.
Is ChatGPT Business enough, or do we need Enterprise?
For most companies of 50 to 500 people, Business is enough until an auditor, regulator or client contract asks for what it lacks. The usual triggers are admin-set retention windows, a compliance API your eDiscovery tooling can read, and a seat count above the 200-seat cap Business has carried since August 2026. Buy Business and keep the list of what would force the upgrade.
What happens to an employee’s chat history when they leave?
In a managed workspace the seat is revoked and the content stays with you. In a personal account it leaves with the person, and you cannot retrieve it or prove what was in it. This is the most persuasive argument for the paid tier in front of a CFO, because it is a property question rather than a security one.
Can we just block personal AI accounts instead of buying seats?
Blocking without an alternative moves the activity to a phone, where you see nothing at all. What works is a licensed tool that is genuinely good, a block on the unlicensed ones, and a short session explaining why. Blocking alone has a poor record against staff trying to get work done.
Does paying for an enterprise account make us compliant?
No. It gives you the technical and contractual means to be compliant. Regimes also want a written policy, evidence of staff training, a record of decisions, and someone accountable. If you operate in the EU, Article 4 of the EU AI Act has required providers and deployers to ensure staff AI literacy since 2 February 2025, and a seat purchase is not evidence of literacy.
How much should a 200-person company budget for AI seats?
At list prices, $20 to $30 per person per month puts a fully licensed 200-person company between $48,000 and $72,000 a year before discount, and most do not license all 200 in year one. Budget the training alongside it. A facilitated session on the team’s own documents runs in a $2,000 to $15,000 market range, small against the seat spend and worth more to the risk number.
Why do people keep using their personal login after we buy seats?
Usually because it is faster, already signed in, and holds their history. Sometimes because the managed workspace lacks a connector they rely on. Almost never because they are reckless. Treat it as a product problem with your rollout rather than a discipline problem with your staff and you will fix it quicker.
Do we need a separate paid account for every AI tool?
You need a licensed account or a block for every tool in real use, which is not the same as licensing everything. Cyberhaven’s per-tool personal-account rates run from about a quarter to about three-fifths, which says the gap sits in the tools nobody standardized on. Find those first.
We bought seats and nothing changed. What now?
Measure the share of prompts running through managed accounts, which is usually lower than expected, then work the six steps above in order. The two that move it fastest are licensing or blocking every tool you found, and making the managed path more convenient than the personal one.
Key takeaways
- A paid seat buys a no-training contract, admin-controlled retention, a tie to corporate identity, and an audit trail. Those four are the security case.
- Account tier is a legal boundary. The 2025 preservation order in The New York Times v. OpenAI held logs from Free, Plus, Pro and Team plans and spared Enterprise, Edu and zero-retention accounts.
- At $20 to $30 a seat, the purchase is never the expensive part. IBM puts the average breach at $4.99 million and breaches involving unsanctioned AI at $5.39 million.
- Paying does not finish the job. Netskope still finds 47% of workplace AI users on personal accounts, and IBM found 92% of organizations with an AI-related incident had no AI access controls.
- License or block every tool in real use, wire AI accounts into provisioning and offboarding, make the paid path the fast path, and teach the boundary on real documents.
- Track the share of prompts running through managed accounts. Seats bought says what you spent. Prompts says what you changed.
Dirk Jan van Veen, PhD
