For an Italian SME the useful question is not “ChatGPT yes or no”, but which architecture: consumer account, Business workspace, Enterprise, or a system/agent on internal processes. Paying for Plus does not make it a company product. Business is not “Plus for the team”. Enterprise is not “Business with more messages”.
OpenAI plans, prices, and policies move quickly. This is aligned with official docs checked on 21 August 2026. Before you buy, reconfirm checkout and the Data Processing Addendum. General information, not legal advice.
Plus and other consumer plans are not a company workspace
Free, Go, and Plus (and Pro, where offered) are individual products. They do not give you central user admin, organisational billing, workspace SAML/OIDC SSO, company roles, or a structural split between personal and work use. That is explicit on the Italian pricing page.
On consumer services, content may be used to improve models unless you turn off “Improve the model for everyone”. Chats stay until the user deletes them; after deletion OpenAI typically schedules removal within 30 days, with legal/security exceptions. See Data Controls and chat and file retention.
A personal Plus account, even with training switched off by hand, is not an enterprise-managed workspace. That is the usual Shadow AI pattern: the work need remains, the data leaves through an account IT does not administer.
ChatGPT Team is not a fourth plan in 2026: on 29 August 2025 it was renamed ChatGPT Business.
What actually changes between Business and Enterprise
Business is the self-service starting point for everyday governed use. Shared workspace, central billing, users and roles, SAML/OIDC SSO, spend controls, GPTs, Projects, Apps, and Company Knowledge. Minimum two Standard seats. By default OpenAI does not use Business input and output to train models (Business data privacy).
It is not cheap Enterprise. There is no SCIM: joiners/movers/leavers stay manual. The admin cannot force migration of consumer accounts on the domain. Custom retention is documented for Enterprise, not self-service Business; when a member is removed, chats/files/canvas are kept indefinitely per the Help Center. In Business, apps are on by default; in Enterprise/Edu they stay off until an admin configures them.
| Control | Business | Enterprise |
|---|---|---|
| Workspace and central billing | Yes | Yes, sales-led |
| SSO | SAML/OIDC | Enterprise SSO; can extend to the Platform |
| SCIM / directory sync | No | Yes |
| Training on workspace data | No by default | No by default |
| Custom retention | Not in self-service | Yes |
| Data residency | Not a standard plan feature | For eligible customers |
| Compliance / eDiscovery–DLP–SIEM | Not Compliance Platform | Compliance Platform |
| Official price (check 21/08/2026) | Verify IT checkout; ~€21/user/month annual on the EU page, or $20/$25 Help Center | Custom / contact sales |
Enterprise makes sense when IT, security, privacy, procurement, or audit require identity lifecycle, defined retention, residency, exportable logs, or custom terms. A 40-person SME with turnover and ISO can need it more than a larger firm with loose identity. That is not an OpenAI headcount rule: it follows from the documented controls.
Premium seats (announced 10 August 2026) raise capacity versus Standard; as of 21 August they still looked like waitlist/rollout. Do not treat them as generally available.
“No training” is not zero retention and not GDPR solved
These are three different questions: training purpose, how long the service keeps data, and who is accountable for processing.
Chats in ChatGPT stay until you delete them. A file in a GPT or Project stays until that GPT/Project is deleted, then typically 30 days. If a GPT or app calls a third party, that third party has its own terms: a Business workspace does not absorb them automatically (GPTs, Apps/connectors).
The API is not ChatGPT. Billing and retention are their own: 30-day abuse monitoring on many endpoints, Conversations or files with different lifecycles, Zero Data Retention only where you are eligible and configured (API data controls). “We use the API so we store nothing” does not follow by itself.
The OpenAI DPA (in force from 1 December 2025) covers Customer Data on business services, subprocessors, and extra-EEA transfers via SCCs or adequacy. EU data residency ≠ no international transfers. Enterprise can offer residency to eligible customers; you still read the contract. Under GDPR, the company remains controller of its own processing (Commission, data protection).
When Business is enough and when you need an internal system
If the goal is to find, synthesise, and draft on documents people can already read (Drive, Microsoft 365, Slack), Company Knowledge can be enough: search with source permissions and citations. It is not a deterministic database. OpenAI itself warns the model can produce plausible but false output; a citation does not certify that the summary is correct.
If the goal is to apply 17 pricing rules, create an order, respect an approval, and leave evidence, you need a process system: rules, identity, least privilege, human-in-the-loop, process logs. The LLM can extract and classify; it should not be the system of record. Same line as AI agents vs chatbots and build, buy, or partner.
| Requirement | More reasonable choice |
|---|---|
| Experimentation on non-sensitive data | Consumer |
| Daily use, no-training-by-default, SSO, basic admin | Business |
| SCIM, custom retention, residency, audit/SIEM, SLA | Enterprise |
| ERP/CRM, writes, approvals, evidence | Internal agent/system (API optional) |
| Enterprise governance and deep automation | Enterprise plus integration, not either/or |
AI Act: literacy already due, Article 50 on channels toward people
Article 4 (AI literacy) already applies: the Commission explicitly mentions staff using ChatGPT for copy or translation and hallucination risk. It is not a single certificate; it is policy on allowed data, output checks, and approved channels. See mandatory Art. 4 training.
Article 50 applies from 2 August 2026. An employee using ChatGPT internally is not automatically a customer-facing chatbot. If you embed an assistant on the site or a portal, you need to map provider/deployer roles. Detail: AI Act Art. 50.
FAQ
Does ChatGPT Team still exist in 2026?
Not as a separate plan. It was renamed Business on 29 August 2025. Use current Business docs, not old Team comparisons.
Does ChatGPT Business use data for training?
By default no, like Enterprise and the API. That is not “data is not stored” and not “GDPR solved”.
When is Enterprise needed?
SCIM, configurable retention, data residency, exportable audit/compliance, SLAs and custom terms. Not “above X employees”.
Does Business include the API?
No. Separate products and invoices.
Can I put customer data on Plus?
Plus is not a company workspace. For customer data the typical step is Business (with upload policy) or an internal system.
What does Business cost in Italy?
Check OpenAI checkout. As of 21 August 2026: about €21/user/month annual on the EU page, or $20/$25 Help Center; Plus $20/month; Enterprise via sales. No third-party blog lists.
Sources
- ChatGPT Pricing and Italy pricing
- Business pricing, What is ChatGPT Business?, rename FAQ
- Business data privacy, DPA, retention
- Company Knowledge, API data controls
- Consolidated AI Act, Art. 4 Q&A, Art. 50 Q&A
- UK NCSC on LLMs and risk
Dig deeper in the series
- Shadow AI: why banning ChatGPT is not enough
- AI agents vs chatbots
- AI agents for companies: when they are justified
- AI Act deployer duties
- Build, buy, or partner
- Microsoft Copilot for companies
If you are moving from personal accounts to company use (licences, data policy, or an assistant/agent on your systems), we can start from a concrete perimeter. Write to info@zendata.it or visit zendata.it.
Pietro Ciattaglia, CEO of Zendata AI, Rome