D&S-02: Free, Business, Enterprise: What an AI License Actually Buys You

Part 2 of the Data & Security series. In Part 1 we followed your data on its journey through an AI tool. Here we look at the piece of paper that governs the whole trip: your license.

A question came up this month from a company that works in financial services, and it is the question I hear most often right now: should we upgrade to the enterprise level of our plan, so our data stays safe when we use AI?

It is a good question, and the honest answer is: probably not for the reason you think. The tier name is not what protects your data. The terms attached to the tier are. And the difference between tiers is mostly not about safety at all. It is about control.

What a tier actually changes

Strip away the marketing and an AI plan tier changes five things.

Training. On business tiers from the major vendors, your prompts and files are contractually excluded from training the models. Microsoft states this for Microsoft 365 Copilot under its Enterprise Data Protection. OpenAI states it for its business and enterprise products. This promise is the single most valuable line in the whole agreement, and it usually starts at the business tier, not the enterprise one.

Retention. Who decides how long your chats and uploads are kept, and how deletion works. Business accounts give the company settings and policies. Personal accounts give you a delete button and a hope about backups.

Administration. One place to add and remove people, set sign-in rules, and see who has access. The day an employee leaves, a business account lets you close the door behind them. A drawer full of personal accounts does not.

Audit. Logs of who asked what, when. Regulated industries live on this, and so does any owner who has ever had to answer the sentence “who sent this to the AI?”

Support and liability. Response times, uptime commitments, and a contract with a real company name on it that your lawyer can read. This sounds boring until the first incident, when it becomes the only thing that matters.

What a tier does not change

The model itself. In most cases the business and enterprise tiers run the same underlying AI as the cheaper plans. You are rarely buying a smarter brain. You are buying the fence, the logbook and the contract around the same brain.

This is why “we bought the expensive one, so we are safe” is a dangerous sentence. I have seen companies pay for top tiers and then leave every setting at its default, share accounts between staff, and let people paste client files into personal tools on the side. The license was enterprise. The behavior was not.

So, about that upgrade

For the finance company in the question, my answer was this. If you are on a proper business plan with a major vendor, the data protection promise is most likely already in your terms, including in Microsoft 365 Copilot, where Enterprise Data Protection covers eligible business accounts without jumping to the highest tier. Upgrading buys you deeper controls: finer retention rules, stronger audit, data loss prevention, legal hold. A regulated firm may genuinely need some of those, and that is a conversation about your regulator, not about AI fear.

Buy the tier whose controls you can name. If nobody can say which control the extra money buys, it buys a feeling.

The five-minute version

Before you change any plan, answer three questions about the one you have. One: do the terms exclude training on our data, in writing? Two: who in this company can see, set and revoke access? Three: how long is our data kept, and who decides?

If your current tier answers all three well, your data is as safe as a license can make it. The remaining risk is not in the plan. It is in the habits, which is where this series goes next: what the big vendors actually promise about training, name by name.