Four assistants make up most enterprise shortlists in October 2026: Microsoft Copilot (formerly Microsoft 365 Copilot), ChatGPT Enterprise, Claude Enterprise and Gemini, inside Google Workspace or as Gemini Enterprise. For IT the deciding question is not which one writes better. It is which one fits the identity, permissions, retention and residency you already run, and on that test your estate usually decides before the demo does.
This is for the IT manager, CIO, informatiemanager or security officer of a Dutch or Flemish organisation with 250 to 5,000 people. Crux Digits is an AI partner that works alongside your ICT partner, and every vendor fact below links to the vendor's own page as read on 26 October 2026.
Which enterprise AI assistant fits our existing estate?
If you run Microsoft 365 with Entra ID and Purview, evaluate Copilot first; if you run Google Workspace, evaluate Gemini first. Both work inside permissions, retention and audit tooling that has already passed your audits. Microsoft states that Copilot only surfaces data a user can at least view (Microsoft Learn). Google states that Gemini follows existing Workspace permissions and that admins manage its retention with Vault (Google Workspace privacy hub).
ChatGPT Enterprise and Claude Enterprise are separate SaaS tenants with their own admin console, retention settings and compliance API. They earn a place when a named group has a use the incumbent does not serve, for example developers who want Claude Code. Our decision rule: add a second assistant only for a named group with a named use, and only after the residency and connector questions below have a written answer. If the real need is an assistant over a fixed set of internal documents, with your own retention and hosting, a private AI assistant is the alternative to another seat licence.
Where does each assistant store and process our data?
Copilot is an EU Data Boundary service for EU customers; ChatGPT Enterprise and Gemini offer EU options; Claude Enterprise stores data in the US.
Microsoft states that for EU customers Copilot is an EU Data Boundary service and that EU traffic stays within the boundary (Microsoft Learn). One exception matters: Anthropic models inside Copilot, Researcher, Copilot Studio and the Microsoft 365 apps are excluded from the EU Data Boundary and in-country processing commitments. They are off by default for EU, EFTA and UK tenants, and anyone with the AI Administrator or Global Administrator role can switch them on (Anthropic models in Microsoft Online Services). That toggle belongs in your change process, not in one admin's afternoon.
OpenAI offers data residency at rest in Europe (EEA plus Switzerland) and, for eligible Enterprise customers, inference residency in Europe, which keeps GPU processing in the region (OpenAI Help Center). Read the limits: CPU steps such as extracting text from a PDF, routing and authentication may run elsewhere, and apps, MCP servers and web search fall under their provider's terms. The article describes residency as set when a new workspace is provisioned, so decide it before the pilot workspace exists.
Anthropic's privacy centre says, for commercial products including Claude Enterprise, that data is stored in the US and that traffic may by default be routed to the US, Europe, Asia and Australia (Anthropic Privacy Center). The one location control in the Enterprise app is US-only inference, available on usage-based Enterprise plans and billed at 1.1 times standard API rates for recent models (Claude Help Center). EU storage and processing for Claude exist through AWS Bedrock and Google Cloud Vertex (Anthropic regional compliance), but that is the API route: you build or buy an application on top.
In Google Workspace, every Data Regions version covers Gemini prompts and responses at rest, but only Enterprise Data Regions (Enterprise Plus, Frontline Plus or the add-on) and Assured Controls cover processing in use (Google Workspace Data Regions). Gemini Enterprise supports an eu multi-region, yet some features run only in the global location, including Gemini 4 Argon and Grounding with Google Search (Gemini Enterprise locations). Residency can cost you the newest model. For the wider picture, see our post on data residency for AI in the EU cloud.
Are our prompts and files used to train the models?
No, not by default, for all four business products; the differences sit in feedback buttons and opt-ins that your admins can usually switch off.
Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation models, and that optional feedback is not used for that either (Microsoft Learn). OpenAI does not train on business data by default, but may use data a customer explicitly shares through its opt-in feedback mechanisms (OpenAI enterprise privacy). Google says Workspace does not use customer data for training without prior permission (Google Workspace privacy hub).
Anthropic's detail matters most. It does not train on Claude for Work inputs and outputs by default, but a thumbs up or down stores the entire related conversation for up to five years and may be used for training. Owners can disable that with the Rate chats setting under Organization settings, Data and Privacy (Anthropic Privacy Center). The evidence is the setting, not the sentence: screenshot the feedback control in each admin console and file it with the DPIA.
How do connectors inherit SharePoint and Drive permissions?
All four use the signed-in user's own permissions, so each one surfaces whatever your current SharePoint, OneDrive or Drive sharing already overshares. An assistant does not create new access. It makes old access findable.
What the AVG asks before any of them reads SharePoint, from the DPIA to the works council, is in our post on AI access to SharePoint and the DPIA.
Copilot grounds through Microsoft Graph and the Semantic Index, which honours the user's identity-based access boundary and the usage rights of Purview sensitivity labels (Microsoft Learn). Microsoft's price page lists SharePoint Advanced Management with the Copilot licence (Microsoft). The permissions clean-up before a Copilot rollout is the work described on our Microsoft Copilot implementation page.
Claude's Microsoft 365 connector shows the detail to ask for. It uses delegated permissions and users cannot bypass SharePoint sharing or folder permissions, but SharePoint search needs the tenant-wide Sites.Read.All permission, because site-specific Selected permissions are not supported (Claude Help Center). Location-based Conditional Access behaves differently from what you may expect: after sign-in, Entra sees requests coming from Anthropic's IP range, so a policy that limits access to your own network blocks the connector for everyone.
OpenAI says ChatGPT respects existing permissions, requires each user to authenticate to a connected app, and lets workspace admins choose which apps are enabled (OpenAI enterprise privacy). Gemini does not retrieve content the user cannot open (Google Workspace privacy hub), and Gemini Enterprise indexes sources such as Microsoft 365 under each user's permissions (Google Cloud).
What do retention, audit logs and eDiscovery look like?
Copilot and Gemini write AI interactions into Purview and Vault; ChatGPT Enterprise and Claude Enterprise expose them through a Compliance API.
Copilot stores prompt, response and citations as the user's activity history, which admins find with Content search and retain with Microsoft Purview (Microsoft Learn). Users can delete their own history in My Account, so design retention around that. Gemini in Workspace keeps prompts and responses from 90 days to indefinitely, as admins decide, managed in Vault, with Gemini activity in the Workspace audit logs (Google Workspace privacy hub).
In ChatGPT Enterprise, workspace admins set retention, deleted conversations leave OpenAI's systems within 30 days, and an audit log of conversations and GPTs is available through the Enterprise Compliance API (OpenAI enterprise privacy). Claude Enterprise adds audit logs, a Compliance API and custom retention controls that the Team plan lacks (Claude pricing). Deleted chats leave Anthropic's back end within 30 days, but chats flagged by its trust and safety systems are kept up to two years and their classification scores up to seven (Anthropic Privacy Center).
For eDiscovery that means one search against two: with a separate assistant, legal needs an export from a second system and a written procedure for it.
Which identity and admin controls come only with the enterprise tier?
SSO is available below enterprise level, but SCIM, role-based access and audit logs arrive only with ChatGPT Enterprise and Claude Enterprise.
Anthropic's table gives the Team plan SSO, while SCIM, role-based access, audit logs, the Compliance API, custom retention and IP allowlisting are Enterprise only (Claude pricing). OpenAI lists SCIM, Enterprise Key Management, role-based access controls and domain verification under Enterprise, and SAML SSO under Business (ChatGPT pricing). Both smaller tiers also stop below your size band: ChatGPT Business is for teams of 2 to 200, Claude Team for 2 to 150.
For Copilot and Gemini, identity is the Entra ID or Google admin console you already run, and Copilot agents are allowed one by one under Integrated apps in the Microsoft 365 admin center (Microsoft Learn).
What does each assistant cost, as published on 26 October 2026?
Microsoft and Anthropic publish an enterprise list price; OpenAI and Google quote enterprise seats through sales.
Microsoft's Dutch page lists Microsoft 365 Copilot at €26.00 per user per month on annual payment, or €27.30 paid monthly on an annual subscription, excluding VAT, and requires a qualifying Microsoft 365 plan (Microsoft). Metered features on top are a separate line, covered in our post on Copilot Credits and usage-based billing. Anthropic lists Claude Enterprise at US$20 per seat per month, billed annually, with a 20-seat minimum, plus usage at API rates that varies with model and task (Claude pricing).
OpenAI shows ChatGPT Enterprise as custom pricing, with credit-based and token-based options (ChatGPT pricing). Google publishes no price for Workspace Enterprise editions, and its Business editions stop at 300 users (Google Workspace pricing), and the Gemini Enterprise page shows only a sales contact and a 30-day Plus trial (Google Cloud).
A worked example, assuming 500 users and list prices: Copilot costs €156,000 a year in licences, before VAT, metered credits or plan changes. Claude Enterprise costs US$120,000 a year in seat fees plus a usage line nobody knows until a pilot measures it.
What evidence should we ask each vendor for?
Ask for the document or admin screen that proves each claim; a sales deck proves nothing in an audit.
Microsoft: the Product Terms and the Data Protection Addendum, the subprocessor list on the Service Trust Portal, a screenshot of Copilot settings, AI providers operating as Microsoft subprocessors, showing who may use Anthropic models, and your Purview retention policy for Copilot interactions.
OpenAI: the signed DPA, requested through the form on its enterprise privacy page, the sub-processor list (dated 14 October 2026), the Data Residency Region and Inference Residency Region fields under Workspace settings, General, the retention setting, and the SOC 2 Type 2 material in its Trust Portal.
Anthropic: the Data Processing Addendum, the subprocessor list, the Rate chats and US-only inference settings under Organization settings, Data and privacy, the custom retention setting, and the Entra consent record with the Graph permissions granted to any Microsoft 365 connector.
Google: the Cloud Data Processing Addendum, which covers Workspace, the Workspace subprocessor list, your Data Regions policy showing whether it covers data in use, the Vault retention rule for Gemini, and, for Gemini Enterprise, the location chosen when the app was created.
What the pages above do not offer: a published enterprise price from OpenAI or Google, an EU storage option for the Claude Enterprise app, or EU Data Boundary coverage for Anthropic models inside Copilot. Turn each gap into a written question to the vendor and file the answer next to the DPIA.
Where Crux Digits fits
We work between the vendor's documentation and your change board, while your ICT partner keeps administering the tenant. That means turning the evidence list above into a decision record your security officer can sign, checking what a connector would expose before it is switched on, and, where Copilot wins, the permissions clean-up and rollout. Where none of the four fits, we build an assistant over your documents and hand over code you own.
For the wider rollout question, see AI implementation in the Netherlands.
Last updated: 26 October 2026.
We build custom AI and LLM systems that run in production: a clickable MVP by the second call, fixed steps, and you own the code.
AI development agency in the Netherlands →
