For a business, the first legal question about an AI assistant is not how clever it is. It is what happens to the information staff put into it. The answer depends far more on the tier than on the brand.
Consumer tiers
According to a November 2026 review of published policies:
ChatGPT trains on consumer conversations by default; users can opt out in settings, and some data is kept for up to 30 days for abuse monitoring.
Gemini may use conversations to improve its services and have them reviewed by people; users can turn this off.
Claude trains only if the user has the model improvement setting on, with longer retention if they do.
Microsoft Copilot may train on signed-in personal accounts, with an opt-out and regional exceptions.
Grok may use content for training, with an opt-out and a private chat mode.
Business tiers
All five offer business or enterprise versions that, by default, do not use customer content to train their models, with administrator controls over retention.
Why it matters
If staff paste client documents into a consumer tier, the business may be disclosing confidential information and personal data to a third party for its own purposes. That can breach confidentiality duties and the GDPR, whatever the opt-out settings on an individual’s phone.
The policy question is not “which AI” but “which account”.
What to do
Choose an approved business tier, block or discourage personal accounts for work, and recheck the terms at least twice a year: they change often.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.