Personal ChatGPT accounts are already inside your company, whether you know it or not: according to PagerDuty's Shadow AI Survey (11-Jun-2026, 1,250 office professionals surveyed), two out of three employees (66%) admit having used an AI tool at work even though they believed it was against company policy. That usage typically runs through free or personal accounts with no corporate single sign-on, no role-based access control, and no documented guarantee of what happens to the data typed into the chat. ChatGPT Enterprise closes that blind spot: SSO-based access, a central admin console, and OpenAI's explicit commitment not to use company conversations by default to train its models. At Summum IA we implement ChatGPT Enterprise end to end — from auditing current usage to internal assistants connected to your company's real documentation — with compliance with the EU AI Act (Regulation (EU) 2024/1689) built in from day one.
The question is not whether your company already uses generative AI, but whether it does so under governance. PagerDuty's survey (Jun-2026) confirms what many IT leads already suspected: workplace generative AI usage is ahead of company policy, and much of that usage happens on personal accounts outside any IT oversight. The risk is not only reputational: every conversation on a personal account can include customer data, internal figures or contract drafts leaving the company's security perimeter without anyone knowing.
According to OpenAI's official documentation ("Introducing ChatGPT Enterprise" and "Enterprise privacy at OpenAI", openai.com, accessed 16-Jul-2026), ChatGPT Enterprise adds what a personal account lacks: single sign-on (SSO) and domain verification, a central admin console — OpenAI expanded this layer in 2026 with the Global Admin Console at admin.openai.com for organizations with multiple business units —, encryption in transit and at rest, SOC 2 and ISO/IEC 27001:2022, 27017, 27018 and 27701 certifications, multi-region data residency (including Europe), and a data processing agreement (DPA) with standard contractual clauses for GDPR. OpenAI also states that, by default, it does not use ChatGPT Enterprise data — neither inputs nor outputs — to train or improve its models, unlike standard consumer accounts.
The EU AI Act (Regulation (EU) 2024/1689, EUR-Lex) adds a regulatory layer that must be planned at design time, not after rollout. Its Article 50 imposes, from 2 August 2026, transparency obligations for any AI system that interacts directly with natural persons: disclosing that it is an AI system when this is not obvious, and marking any synthetically generated content in a machine-readable format. These obligations apply with particular force when a company deploys customer-facing or public-facing custom GPTs — not only internal, employee-only use — and that is exactly the scenario covered in the compliance checklist we deliver with every rollout.
We map which departments already use ChatGPT or other generative AI on their own accounts, what kind of data they share, and which use cases have the highest volume or highest risk. The result is a prioritized inventory, not a blanket ban.
We configure single sign-on (SAML/OIDC) against your identity provider, define roles and permissions by department, set conversation retention policies, and sign the data processing agreement (DPA) with OpenAI.
We move users from their personal accounts to the company workspace without losing relevant work history, and decommission ungoverned access within the agreed transition period.
We build custom assistants (GPTs) connected via retrieval-augmented generation (RAG) to your manuals, internal policies and knowledge bases, so answers are grounded in your company's real information, not generic model knowledge.
The operational detail: what we deliver as part of the work and what we keep alive afterwards.
Shadow AI audit
Prioritized inventory of current ungoverned generative AI usage across the company, with data risks identified by department.
SSO and admin console configured
Single sign-on integrated with your corporate identity provider, defined roles and active conversation retention policies.
Internal GPTs with RAG
Custom assistants connected to your company's real documentation and knowledge bases via retrieval-augmented generation.
AI Act compliance checklist
Document covering the Article 50 transparency obligations of Regulation (EU) 2024/1689 applicable to each deployed use, and how they are met.
Training and adoption plan
Practical sessions for teams built on the real use cases identified in the audit, not generic examples.
Support and quarterly review
Ongoing monitoring of actual usage, adjustment of access and data policies, and onboarding of new use cases as they emerge.
ChatGPT Enterprise is one piece of your company's AI governance, not the whole of it: it combines with the Microsoft partner service when the ecosystem is already Copilot, with shadow AI control when several AI providers coexist, and with AI Act legal assessment when usage reaches customers or the public.
If your company already runs on Microsoft 365, Copilot is the natural path; the split by LLM partner brand: Copilot covers the Microsoft ecosystem, ChatGPT Enterprise covers OpenAI, with no overlap in scope.
View service → iaWhen several generative AI tools coexist in the company — not only ChatGPT — the corporate AI Gateway centralizes control of all of them behind a single audited gate.
View service → consultoríaSummum Consultoría assesses the legal risk of each AI use against the EU Regulation and defines the company's compliance position; Summum IA implements and documents the corresponding technical layer.
View service →According to OpenAI's official documentation, ChatGPT Enterprise adds single sign-on (SSO) and domain verification, a central admin console to manage users and policies organization-wide, encryption in transit and at rest, security certifications (SOC 2, ISO/IEC 27001:2022, 27017, 27018, 27701) and multi-region data residency. A personal or small-team account offers none of that level of control or auditability.
According to the official "Enterprise privacy at OpenAI" page, by default OpenAI does not use ChatGPT Enterprise data — neither inputs nor outputs — to train or improve its models. This is a contractual commitment, not just a user-editable setting.
It depends on the use, not the tool itself. Article 50 of Regulation (EU) 2024/1689 (AI Act), applicable from 2 August 2026, requires informing people that they are interacting with an AI system and marking synthetically generated content when the system interacts directly with customers or the external public. If usage is purely internal, employee-only, the obligations differ and are governed mainly by the data protection rules applicable to the company. Either way, we include the corresponding checklist as part of the rollout.
That is exactly the starting point of our shadow AI audit: we identify who uses what, with which data, and design the migration to corporate workspaces without losing work already done or abruptly cutting off a tool the team already considers essential.
Yes. We build custom GPTs with retrieval-augmented generation (RAG) over your manuals, policies and internal knowledge bases, so answers are grounded in your company's real information rather than the model's generic knowledge.
OpenAI negotiates Enterprise licence pricing directly based on user count and does not publish a fixed rate; that cost belongs to the model provider, not to Summum IA. Our quote covers exclusively the implementation service — audit, configuration, migration, internal GPTs, training and compliance checklist — and is scoped to your project after the discovery phase.