ChatGPT Enterprise: “unlimited” does not mean risk-free
ChatGPT Enterprise removed caps and added controls, but no label replaces a contract, test and owner. This matrix turns enterprise promises into evidence.
OpenAI launched ChatGPT Enterprise on August 28, 2023, not August 29. The official announcement promised GPT-4 access without usage caps, faster responses, 32,000-token context, data analysis, centralized administration and a policy not to train on business conversations or data. For an organization, the important word was not “unlimited,” but the exact scope of each control.
“No usage caps” described how many queries customers could make under the product; it did not guarantee infinite availability, correct answers or an absence of contractual conditions. “Not used for training” answered one purpose question; by itself it did not explain retention, operational access, location, subprocessors or deletion. Turning marketing into a decision requires a control matrix and tests.
What was available
OpenAI listed AES-256 encryption at rest and TLS 1.2 or later in transit, SOC 2 compliance, single sign-on, domain verification, an admin console and usage analytics. It also offered GPT-4 at up to twice the speed, advanced data analysis and shared templates.
The 32,000-token window allowed inputs or files four times longer than the company’s comparison point. A token is a processing unit, not a stable word or a memory guarantee. Fitting a document into a request does not show that the model retrieves every clause, preserves order or cites the correct page.
No price appeared in the announcement; the company invited sales enquiries. Any figure not contained in a dated commercial proposal would have been speculation. Enterprise cost also includes integration, review, training, support, migration and the work required to correct answers.
No training does not mean no processing
OpenAI’s sentence was precise: business prompts and data would not be used to train its models. That removes one reuse route. Producing an answer still requires the service to process content, and secure operations may retain records for defined purposes. A training policy does not answer every lifecycle question.
The buyer should obtain six items in writing: which categories are retained, for how long, in which regions, which people or providers can access them, which exceptions exist and how deletion is evidenced. Content, metadata, files and logs should be separated. A promise about “data” may have different scope in each agreement.
Ownership does not prevent an employee from pasting information the company has no right to submit. A client’s secrets, health data, privileged material or third-party code keep their restrictions. The tool cannot determine by itself whether the person typing has proper authorization.
Encryption and SOC 2 do not certify the answer
Encryption in transit protects the channel while data moves; encryption at rest protects storage under stated conditions. Neither establishes that an answer is factual or that a user was allowed to request it. Identity, permissions, minimization and review remain separate controls.
SOC 2 concerns controls at a service organization within a defined scope and period. The label does not show that every feature, subprocessor or configuration was examined in the same way. Procurement should review the available report under confidentiality, its exceptions, customer responsibilities and covered dates.
Single sign-on and domain verification help govern accounts, but they do not classify documents. Effective access policy assigns groups, handles joiners and leavers, limits file use and prevents conversations from leaving the perimeter. Administration is a capability that needs operating rules.
A larger context also enlarges exposure
Uploading a full contract makes complex questions easier and increases the volume exposed when selection was wrong. Before using 32,000 tokens, reduce the document to necessary sections, remove identifiers and preserve a copy of exactly what was submitted.
To measure comprehension, create 20 questions with known answers distributed across the beginning, middle and end. Include negations, tables, appendices and two questions without an answer. Record accuracy, citations, omissions and false certainty. Repeat with shorter excerpts: less context can sometimes produce a more verifiable answer.
The GPT-4 technical report warned that the model was not fully reliable and could fabricate facts or make reasoning errors. Enterprise changed the product, capacity and controls; its announcement did not say it removed that model limitation.
Data analysis means executing a workflow
Advanced Data Analysis allowed users to upload files and write and run code over them. That turns a conversation into a small data process. Teams need to identify permitted formats, isolation, network access, persistence, libraries, downloadable output and treatment of generated code.
Testing starts with synthetic data. Check totals against a reference spreadsheet, ensure missing values do not silently disappear and verify that charts preserve units and filters. Then inspect the code. A conclusion can sound convincing after the program mixed decimal separators, time zones or categories.
Never approve a result because the system produced a polished visualization. The auditable chain preserves input file, instruction, code, output, review and decision. In finance or research, a number without that provenance remains unverified.
From pilot to authorized use
NIST’s AI Risk Management Framework 1.0, published in January 2023, proposed managing risk throughout design, deployment and use. Its govern, map, measure and manage functions provide a better structure than “enable it for everyone.”
Govern means an owner, policy, training and incident route. Map identifies tasks, affected people, data and consequences. Measure compares quality, privacy, security, bias, time and cost against a human baseline. Manage decides which uses are allowed, which need review and which are prohibited.
A useful pilot selects two low-impact tasks and a non-AI baseline. Fifty anonymized real cases reveal more than a demonstration. Record total time to an accepted result, corrections, data exposure, material errors and variation across attempts. The metric is approved work, not generated responses.
Availability and speed need their own numbers
“Up to twice as fast” does not set latency for every task or establish a service commitment. The contract should define availability, maintenance, support, size limits and peak-time priority. A pilot measures median and tail latency because an average can hide delays that break an urgent process.
Test degradation too: what happens when GPT-4, analysis or file upload is unavailable? The workflow needs a manual route, clear messages and no silent loss. Unlimited queries do not remove technical limits on files, conversations or concurrency. Recording those thresholds prevents an internal service from being designed around an overly broad reading of “unlimited.”
A decision card
The minimum card contains version, surface, permitted data, contractual retention, training, encryption, administrator access, tools, human review, owner and exit path. Add a date and evidence to every field. A marketing page proves what was announced; the contract and tests prove what was purchased and observed.
There should be a reversal procedure: export required results, revoke accounts, remove integrations, delete data under the agreement and return to the earlier process. Dependency appears when a critical template or knowledge exists only inside personal conversations.
ChatGPT Enterprise addressed real administrative barriers and offered clearer commitments than the consumer product. It did not remove the need to decide what enters or who validates what comes out. The transferable skill is mapping every vendor promise to a contractual field, technical control, test and accountable owner. If a promise lacks those four counterparts, it is still sales material.
This article was produced with artificial intelligence under human editorial oversight.
