Opens in a new tab
Two laptops on a desk displaying cybersecurity icons, Microsoft and OpenAI interfaces, surrounded by office items and plants, highlighting digital security in a modern workspace.

Copilot vs ChatGPT for a Small Business: Which to Pay For, and How to Keep Client Data Safe in Either

By Jason Russell · October 26, 2026

This is when owners decide what 2027 pays for, and AI subscriptions are on a lot of those lists. The question I hear most is some version of Copilot vs ChatGPT: which one should we buy, do we need both, and can staff paste client files into either one?

The short version: these tools are less alike than the comparison suggests. Paid Copilot lives inside Microsoft 365 and can reach whatever each user can already open. ChatGPT is a separate workspace that sees what people type, upload, or connect to it. That difference decides what each one is good at and where your client data ends up.

Below: what each tool sees, what each costs as of October 2026, the free versions your staff already use, what it means for law, CPA, and medical offices, and a one-page AI acceptable-use policy.

Copilot vs ChatGPT: where each one lives and what it can see

Copilot works inside your Microsoft 365

The paid version of Copilot runs inside Word, Excel, PowerPoint, Outlook, and Teams and works from a user’s meetings, emails, chats, and files. That’s the selling point.

It’s also the catch. Microsoft says Copilot “only surfaces organizational data to which individual users have at least view permissions.” That sounds reassuring until you remember how many files in an older tenant are open to everyone in the company. Copilot doesn’t create those permissions. It makes them easy to search.

So fix sharing first. If a payroll spreadsheet is readable by the whole office today, Copilot can surface it for anyone who asks the right question. I covered the sharing defaults to check in five Microsoft 365 settings worth checking in an older tenant. Do that before you buy a single license.

A naming note: as of October 2026, Microsoft says Microsoft 365 Copilot is now named Microsoft Copilot, and the free version is Copilot Chat. The consumer Copilot app, used with a personal Microsoft account, now has the same name and very different terms.

ChatGPT is a separate workspace

ChatGPT sees what your staff type, paste, or upload, plus any apps you connect, which can include SharePoint and Outlook depending on your plan. OpenAI says many apps are enabled by default in ChatGPT Business, and that its company knowledge feature “respects permissions in the connected source.” Connect an overshared SharePoint, and you’ve handed the same problem to a second vendor.

The other difference is where the data goes. On a work account, Copilot stays under the Microsoft agreement that already covers your email and files, web searches aside. ChatGPT sends data to OpenAI under OpenAI’s terms. That isn’t automatically worse. It’s one more vendor to vet and put under contract.

What one, the other, or both actually cost

The ChatGPT vs Copilot question looks different with the prices side by side. List prices per user per month on annual plans unless noted, as of October 2026:

Option Per user, per month What you get
Copilot Chat on a work account Included Web chat, uploaded files, Copilot in Outlook
Copilot Business add-on $21 list, $18 promo through Dec. 31, 2026 Copilot in Office apps, using your mail, files, chats, meetings
Business Premium with Copilot $32, versus $22 without Copilot The same Copilot, bundled into the plan
ChatGPT Business, Standard seat $20 billed annually, $25 monthly Shared workspace, admin controls, no training on your data by default
Copilot add-on plus ChatGPT Business $41 to $46 Both tools, two vendors

Details the table can’t hold:

  • Copilot Business is the small-business version, for organizations with up to 300 users. Microsoft says it has the same capabilities as the enterprise version, which lists at $30 per user per month, the figure you may have seen quoted.
  • The $18 price is a promotion on an annual subscription, extended through December 31, 2026. Budget for $21.
  • The bundle changes the math. Since July 1, 2026, Microsoft has sold Business Standard and Business Premium with Copilot included as permanent plans. Business Premium with Copilot lists at $32, against $22 without it, so Copilot works out to about $10 per user. Check how switching fits your current term first.
  • ChatGPT Business needs at least two seats. Premium seats with five times the usage run $100 per user per month billed annually; most offices won’t need them. The $25 monthly option makes a pilot easier to walk away from.

For a 25-person office buying for everyone, the Copilot add-on runs $6,300 a year at list, ChatGPT Business $6,000 on annual billing, and both $12,300. Moving that office from Business Premium to Business Premium with Copilot costs about $3,000 a year.

My advice: don’t buy for everyone on day one. Pick the five or six people who write, summarize, or analyze all day, give them 60 to 90 days, and see who actually used it.

The free versions your staff already use

In a Pew Research Center survey of 5,123 U.S. adults in early 2025, 28% of employed adults said they had used ChatGPT for work, up from 8% in early 2023. If your firm hasn’t bought a business plan, anyone doing that in your office is using a personal account.

There are four versions in play:

That Plus detail matters. When someone leaves, their personal account and its chat history leave too, beyond the reach of your offboarding. It’s the same kind of gap I described in where the employee lifecycle breaks in Microsoft 365 and Google Workspace.

The cheapest fix in this post: tell everyone to use Copilot Chat on their work account. You already pay for it, and Microsoft’s admin guidance says to instruct users to sign in that way for enterprise protections. For the risk side of unapproved AI tools, see how AI is reshaping insider risk.

Is ChatGPT confidential?

It depends on which ChatGPT. On ChatGPT Business, OpenAI says workspace admins control how long data is kept, deleted conversations are removed within 30 days, with exceptions for legal requirements and preventing harm, and it will sign a data processing addendum. On Free and Plus, OpenAI may train on content unless the user opts out. Either way, “not used for training” isn’t the same as “confidential” in the sense your clients and regulators mean.

Is Microsoft Copilot safe?

On a work account, prompts and responses get the same contractual protections as your Exchange email and SharePoint files, and admins can set retention policies for Copilot interactions in Microsoft Purview. Two caveats. Web searches go to Bing under separate terms, with Microsoft acting as an independent data controller, and admins can turn web search off. And paid Copilot is only as safe as your permissions.

Can staff paste client files into either one?

For law, CPA, and medical offices in Central Florida, this is the question that matters most. The honest answer: only into a business account, only after you’ve checked your professional obligations, and for some data, not at all. This isn’t legal advice; your attorney (and your CPA, for tax questions) decides the legal questions.

Medical and dental practices

Don’t put protected health information (PHI) into any AI tool unless a business associate agreement (BAA) covers it. Microsoft makes its HIPAA BAA available by default to covered entities and business associates and lists Microsoft Copilot and Copilot Chat as in-scope services. But web search queries aren’t covered by the BAA, and Microsoft says using its services doesn’t, on its own, achieve HIPAA compliance.

OpenAI is blunt: “we don’t offer a BAA for ChatGPT Business.” Its BAAs cover a short list of products, such as ChatGPT for Healthcare. Without a BAA, ChatGPT Business is no place for PHI. We help medical and dental practices sort this out.

Law firms

ABA Formal Opinion 512 (July 29, 2024) says that for self-learning AI tools, a client’s informed consent is required before inputting information relating to the representation, and boilerplate in an engagement letter isn’t enough. It also expects lawyers to understand a tool’s terms of use and privacy policy, possibly with help from IT or cybersecurity professionals.

Florida Bar Ethics Opinion 24-1 (January 19, 2024) says lawyers may use generative AI but must protect confidentiality, including by researching a program’s policies on data retention, data sharing, and self-learning. It recommends informed consent before using a third-party program if that would disclose confidential information. Advisory opinions aren’t binding, but they show the Bar’s thinking.

A business plan that doesn’t train on your data changes the facts your lawyers weigh. It doesn’t decide for them. More on how we support law firms.

CPA and accounting firms

The FTC Safeguards Rule treats a tax preparation business as a financial institution. Among its requirements: choose service providers that can safeguard customer information, require those safeguards by contract, and assess them periodically. In practice, treat any AI vendor that receives client data as one of those providers.

In an August 2026 release, the IRS reminded tax professionals that federal law requires them to create and maintain a written information security plan (WISP). If yours doesn’t mention AI tools, add them, and keep Social Security numbers and full returns out of personal accounts. Here’s how we work with CPA and accounting firms.

So which should you pay for?

If you came here for a Microsoft Copilot vs ChatGPT verdict, here’s mine for most 15 to 75 person offices:

  1. Start with what you own. Copilot Chat for everyone, on work accounts, as the approved tool. Cost: nothing extra.
  2. Buy Copilot for people who live in Microsoft 365: all day in Outlook, Word, Excel, and Teams.
  3. Buy ChatGPT Business for people who don’t. Open-ended drafting, research, and analysis that isn’t tied to your files.
  4. Buy both only for a few heavy users, and only after a pilot shows they use both.
  5. If you handle PHI, only Microsoft’s business plan here comes with BAA coverage, minus web searches.

A one-page AI acceptable-use policy

You don’t need a long AI policy template. You need one page your staff will actually read. Here’s the outline we start from:

  1. Approved tools, by name and account, AI note-takers included. For example, Copilot Chat on work accounts and your ChatGPT Business workspace. Anything else needs approval.
  2. No personal accounts for work. No client or company information in free or personal AI tools, including ChatGPT Plus and consumer Copilot.
  3. Data that never goes in. Social Security numbers, full tax returns, bank and card numbers, passwords, and PHI, unless a tool is approved for that data.
  4. A human checks everything. Facts, figures, names, and citations get verified before anything leaves the office.
  5. Client consent where required. Law firms follow their consent obligations; everyone follows client contracts.
  6. Only IT connects AI to company systems such as SharePoint, email, or a client portal.
  7. AI accounts follow onboarding and offboarding, like every other account.
  8. Report mistakes the same day, without blame. You can’t fix what you don’t know about.
  9. Review every six months. These products change faster than most policies.

The honest tradeoffs

  • Permission cleanup is real work. Copilot makes it unavoidable, and it’s work you should do whether or not you buy Copilot.
  • Neither tool is reliably right. Microsoft says Copilot may produce ungrounded results, and OpenAI says ChatGPT can produce incorrect or misleading outputs. Review time is a cost that never shows up on the invoice.
  • Two tools means two vendors. Two contracts, two admin consoles, two sets of settings, and two places to remember at offboarding.
  • Free Copilot Chat has limits: standard access that may be limited during peak times, and no work data beyond uploaded files.
  • A policy won’t stop a personal phone. Good rules and a good approved tool cut down on shadow AI. They don’t eliminate it.

Where I have a stake in this

Harmony sets up and supports both Copilot and ChatGPT Business, writes AI acceptable-use policies, and trains staff on them. We also provide managed cybersecurity in Orlando, which includes the permission cleanup Copilot forces. So I benefit whichever tool you pick, and if you decide it’s worth paying someone to set it up.

The less flattering part: the oversharing Copilot exposes usually built up over years, sometimes in tenants an IT provider was managing the whole time. If we manage yours, some of it may have happened on our watch. Copilot makes those mistakes easy to find, which is uncomfortable for us too, and exactly why you want to find them before your staff do.

Frequently asked questions

Which is better, Copilot or ChatGPT?

Neither wins across the board. Copilot fits best when the work lives in your Microsoft 365 email, files, and meetings, because the paid version can draw on all of them. ChatGPT Business fits work that isn’t tied to your Microsoft files, and it can be bought month to month. The deciding factors are where the work happens and what your data rules allow.

What’s the difference between Copilot Premium and standard Copilot Chat?

Free Copilot Chat, included with Microsoft 365 business plans, gets standard access that may be limited at peak times, and its access to work data is limited to files a user uploads. A paid Copilot license adds priority access, full use of the user’s meetings, emails, chats, and files, Copilot in the Office apps, and advanced agents such as Researcher and Analyst. Microsoft’s in-app labels, such as “Basic” and “Premium,” vary, but the paid license is the real difference.

What are the downsides of Copilot?

It finds whatever a user can open, so years of loose sharing become easy to search. The paid version is $21 per user per month at list on an annual plan as of October 2026, and it pays off mainly for people who spend their day in Outlook, Word, Excel, and Teams. Like ChatGPT, it can give answers your documents don’t support, so someone still has to check the work.

Where to start

If you’re deciding what to buy for 2027, start with two questions: what does free Copilot Chat already give your staff, and what can each of them open in SharePoint today? The answers make the buying decision much easier.

We’re happy to walk through both with you, with no pressure and no obligation. Harmony provides AI consulting and automation, plus IT support in Orlando and across Central Florida. Give us a call at (407) 720-6540 whenever you’re ready.

Sources

Our latest posts