ChatGPT, Claude and Gemini Enterprise: Governance Decides, Not the Model

Three vendors sell an enterprise AI assistant, and on answer quality they are close enough that a bake-off rarely separates them. On governance they are not close at all. Claude Enterprise exports 180 days of audit events and strips chat content out of them. ChatGPT Enterprise offers data residency in 10 regions. Gemini Enterprise ships its most useful log type switched off.

What actually separates the three enterprise plans

Most enterprise AI evaluations start the same way. Someone assembles a prompt set, runs it through three assistants, and scores the answers on a spreadsheet.

The exercise is worth doing once. It stops being worth doing the moment the three scores land within a few points of each other, which is now the ordinary result rather than the surprising one.

What survives the tie is administrative. Who can switch a connector on. Where the data sits at rest. What the log records, how long it keeps it, and who can read it eighteen months later during a regulatory review.

The model tier stopped being the variable

All three vendors put their strongest general-purpose model on the enterprise plan. All three replace it several times a year. Your evaluation is a photograph of a moving object.

That is not an argument for ignoring quality. It is an argument for treating quality as a threshold rather than a ranking. Run a two-week test, confirm each candidate clears the bar for your actual work, then stop measuring.

I would spend the rest of the evaluation window on the admin console, because admin architecture changes slowly and it is the part you can write into a contract. A model benchmark is not a contractual term. A retention setting is.

Identity, roles and where the admin console lives

Start here, because it is the cheapest thing to verify and the most expensive thing to get wrong. Every one of the three ships the basics.

SSO and SCIM are universal, the defaults are not

Anthropic lists SSO with domain capture, SCIM provisioning, role-based access control, usage analytics and spend controls on the Claude Enterprise plan. It also states that audit logs, OpenTelemetry monitoring and data retention controls are Enterprise-only features, not Team features.

ChatGPT Enterprise carries domain verification, SAML SSO, SCIM, IP allowlists and role-based access control. The default that matters more than any of those: on Enterprise, apps and connectors start disabled, and an admin enables them one at a time. On the Business plan they start on.

Gemini Enterprise does not build a separate identity plane. It uses Google Cloud IAM, with Workforce Identity Federation, Google Identity and Workload Identity Federation as the supported authentication paths.

Where each vendor puts the control plane

That last difference is the real fork in the road. Two of these products give you a new console with a new permission vocabulary. One gives you a surface your cloud team already administers.

Reuse is not automatically an advantage. Google's own security overview warns that incorrect changes to workforce pool attribute mappings risk enabling user impersonation, which can lead to unauthorized document access. A powerful control plane is also a large blast radius.

Spend controls are the underrated line in this table. Claude Enterprise exposes per-user and per-organisation limits, which is what makes a usage-based plan safe to hand to 800 people. If you are budgeting for one of these, the forecasting problem is covered separately in the piece on tools that actually predict AI spend.

Compiled from vendor documentation opened in August 2026. "Not published" means the vendor does not state it on a public page, not that the capability is absent. Ask for it in writing during procurement.

Data handling: who trains, who stores, and where inference runs

All three contractually exclude enterprise content from model training. That is the answer to the question every board asks, and it is the least interesting part of the topic.

The interesting part is what happens on the plans your employees are already using without asking. Anthropic's August 2025 consumer terms update applies to Claude Free, Pro and Max, and explicitly excludes Claude for Work, Government, Education and API use. Users who allow training move from a 30-day retention window to a five-year one.

So the governance risk on day one is not your enterprise tenant. It is the personal accounts already holding your contracts, and the shadow tooling around them. That is the same rationalisation problem described in the analysis of 291-app software estates, arriving through a new door.

Residency is the widest single gap

OpenAI expanded at-rest data residency in November 2025. It covers ChatGPT Enterprise, ChatGPT Edu and the API across Europe, the UK, the US, Canada, Japan, South Korea, Singapore, India, Australia and the UAE. For Enterprise and Edu the setting applies only to new workspaces, which is a migration problem rather than a switch.

Read the fine print on inference separately from storage. Computerworld reported at the time of that expansion that model processing still ran on US infrastructure regardless of storage location. HFS Research analyst Akshat Tyagi put at-rest residency at 70 to 80 percent of the compliance friction, and called the remainder a grey area for defence and government buyers.

Anthropic's first-party answer is narrower and more explicit. US-only inference is available on usage-based Enterprise plans, billed at 1.1x standard rates for Opus 4.6, Sonnet 4.6 and later models. There is no European equivalent on the first-party plan, and the setting governs inference rather than storage. Anthropic also states plainly that it does not cover connected services, which process data on their own infrastructure.

Google inherits the widest set of controls and publishes the exclusions. Gemini Enterprise supports data residency, customer-managed encryption keys, VPC Service Controls and Access Transparency. The exclusions are named: CMEK and Access Transparency are unsupported in the global region and do not apply when Grounding with Google Search is on. Google also documents that it deletes user-requested data within 60 days.

Certification lists are what each vendor publishes, not an equivalence claim. Scope statements differ, and a certification covering a company is not the same as one covering the specific product you are buying. Ask for the scope section of the report.

Audit logging is where the three diverge most

This is the section that should decide the shortlist in any regulated business, and it is the section vendor comparison pages skip.

Claude Enterprise: 180 days, identifiers rather than content

Anthropic documents 25 audit event types. They cover sign-ins, sign-outs, invitations, user deletion, project creation and deletion, document additions to project knowledge, conversation lifecycle, file uploads, SSO configuration changes and data exports. Exports cover the past 180 days and arrive by email as a link that expires in 24 hours.

The limitation is stated in the same document, and it is the one to plan around. Titles and content of chats and projects are not exported, only their identifiers. If you need the content, that is the Compliance API, which is a separate entitlement enabled in organisation settings. Organisations using customer-managed keys cannot use the export button at all and must go through the API.

ChatGPT Enterprise: a compliance platform with a partner ecosystem

OpenAI's Compliance API records time-stamped interactions including conversations, uploaded files, workspace GPT configuration and metadata, memories, and workspace users. It was announced in July 2024 alongside integrations with eDiscovery and data loss prevention vendors.

The practical advantage is not the log format. It is that Microsoft Purview, Palo Alto Networks and Sumo Logic all ship documented connectors into it, so the data lands in a tool your security team already runs. Content is in scope by default rather than behind a second entitlement.

Gemini Enterprise: the best plumbing, half of it switched off

Gemini Enterprise writes into Cloud Audit Logs, which is the most mature logging system of the three by a wide margin. Admin Activity logs record operations such as CreateAssistant, UpdateDataStore and DeleteEngine, and they cannot be disabled.

Data Access logs are the other half. They record the reads: Search, CompleteQuery, GetDocument. Google states that except for BigQuery, Data Access audit logs are disabled by default because they can generate large volumes of data.

That is a defensible engineering decision and a trap for a buyer who assumes logging is on. If nobody enables Data Access logging during rollout, the question "which employee searched the acquisition folder in March" has no answer, and the gap is silent.

Connectors are a permissions problem, not a feature count

Every vendor page counts connectors. Gemini Enterprise lists roughly 30 third-party sources, from Confluence and Jira to Salesforce, ServiceNow, SharePoint, Workday and Zendesk, plus direct access to BigQuery, Drive, Gmail and the rest of Google's own estate. ChatGPT ships a large app directory. Claude connects through remote MCP servers and a public directory.

The count tells you almost nothing. The question is what an admin can prevent, and here the three are genuinely different products.

What a connector does not inherit

Anthropic ships the most granular control I have seen from any of the three. Claude Code administrators can deploy a managed-mcp.json file that defines the only servers that will load, or run an approved catalogue using allowedMcpServers with allowManagedMcpServersOnly. Servers match by URL pattern, exact command, or name.

What makes it credible is the warning in the same document. Anthropic states that a name entry is not a security control, because the name is the label a user assigns, so a user can call any server "github". A vendor that documents how its own control can be defeated is telling you something useful.

Anthropic is equally direct that it reviews directory listings against criteria but does not security-audit or manage any MCP server. Google says the parallel thing about its own perimeter: VPC Service Controls govern Google Cloud services and do not inherently block or secure traffic to external, non-Google endpoints. The protocol layer underneath all this is covered in the piece on MCP as an interoperability standard.

Both statements point at the same hole. Once a connector authenticates, your controls end and the third party's begin, and no amount of tenant configuration changes that. Treat every connector as a subprocessor and diligence it like one.

The exposure that is not on any feature page

Retention settings are a vendor promise. A court order outranks a vendor promise, and one of these three has already been tested in public.

In May 2025 a federal magistrate directed OpenAI to preserve and segregate output log data that would otherwise have been deleted. That obligation was released going forward in October 2025. In November 2025 Magistrate Judge Ona Wang ordered production of 20 million ChatGPT conversation logs, which OpenAI characterised as roughly 0.5 percent of its logs. District Judge Sidney Stein affirmed the order on 5 January 2026.

Nothing about that sequence is specific to OpenAI. Any vendor holding conversation logs is subject to discovery in litigation it is party to, and your retention configuration does not travel with the data once a court is involved. OpenAI is simply the one whose turn came first.

The practical response is contractual rather than technical. Ask for notice obligations, ask what happens to your tenant's data under a preservation order, and get the answer in the agreement. The clauses worth insisting on are set out in the CFO's list of AI contract terms, and the remedy side is covered in the piece on liability caps for agent failures.

Where this comparison is weakest

Three things you should hold against everything above.

The source base is not symmetric

Anthropic and Google publish their admin documentation openly, and every claim about those two here traces to a page opened during research. OpenAI's enterprise privacy pages and help centre refused automated retrieval, so the ChatGPT column leans on the public trust portal and on secondary reporting from Computerworld and SecurityWeek.

That asymmetry is itself a small procurement signal, because documentation you cannot read is documentation your security team cannot review before a call. It also means the ChatGPT column here is thinner than the other two, and you should treat it as a starting point rather than a finding.

Two further caveats. Feature parity in this category moves in weeks, so verify every row against the vendor's current page before you rely on it. And the prices are not comparable. Google publishes list pricing, at $30 per seat per month for Gemini Enterprise and $21 for Gemini Business at the October 2025 launch. Neither OpenAI nor Anthropic publishes an enterprise rate card. Any per-seat figure you read for those two is deal data, not a published price. How usage-based terms change that maths is covered in the analysis of Anthropic's shift away from seat pricing.

A scoring sheet you can take into the evaluation

Weights are the argument, so change them rather than adopting mine. The point is to force the conversation into rows a vendor has to answer in writing.

These weights are my judgement, not measured outcomes. They deliberately push quality below a quarter of the total, because quality converges and governance does not. If your deployment is customer-facing rather than internal, raise the first row.

Frequently asked questions

Where to start this week

Skip the bake-off for a moment and run two checks that cost nothing.

First, ask each vendor for the audit log event list, the retention window, and a plain answer on whether message content is included. Three sentences in an email. The vendor who answers with a link to documentation rather than a call is the one whose controls are real, and the exercise takes an afternoon.

Second, pull the list of AI tools already authenticated against your identity provider and mark which ones are personal accounts. That inventory decides more about your actual exposure than the platform you eventually pick, and it usually finds something. The failure patterns that follow are catalogued in the breakdown of how agent pilots fail.

Related reading