ChatGPT Enterprise solved data retention. It didn't solve governance.
Buying the enterprise tier settles the training and retention question, and that matters. It does not tell you who is still using personal ChatGPT on the side, what your custom GPTs can reach, which team is burning the spend, or how any of it maps to an EU AI Act obligation. Govern360 governs the sanctioned tenant and the shadow usage running beside it.
The sanctioned-tool illusion. Deploying ChatGPT Enterprise is a governance improvement, not a governance programme. The compliance and usage APIs give you raw material; someone still has to turn it into policy, enforcement and evidence — and to account for the personal accounts that never migrated.
What the enterprise tier does not cover
The accounts that never migrated
Personal ChatGPT logins persist after an enterprise rollout, especially where the enterprise tier feels slower or more restricted. Sanctioned adoption does not displace shadow use on its own.
Custom GPTs and connectors
A custom GPT wired to internal data is an AI system with a data path and a blast radius. It needs an owner, a classification and a review, not just a creator.
Raw telemetry, not governance
The compliance and usage APIs expose conversations and consumption. Turning that into policy, attribution, enforcement and framework-mapped evidence is work the platform leaves to you.
Spend without an owner
Workspace and API consumption climb with adoption. Without per-team attribution the bill is a single number nobody can defend or plan against.
No inbound inspection
Controls concentrate on what users send. What the model returns — and what a user then pastes into a system of record — is rarely inspected at all.
Regulatory classification is on you
The EU AI Act cares about how a system is used, not which vendor supplied it. Classification, documentation and evidence remain your obligation.
What Govern360 adds
Sanctioned and shadow in one inventory
The enterprise workspace and the personal-account usage running beside it in a single AI inventory, discovered through your identity, network and endpoint signals.
Custom GPTs treated as AI systems
Each custom GPT and connector inventoried with an owner, a data classification and a review date, rather than living as an untracked artefact in someone's workspace.
Per-team consumption and budgets
Workspace and API spend attributed to teams and cost centres, feeding the Executive AI Bill with budgets that alert before the invoice.
Data Shield and Response Scan
Outbound detectors for regulated data, secrets and source code, and inbound scanning designed to inspect what the model returns before it lands in a system of record.
Policy compiled to your planes
Restrictions on personal-account use and on what may be shared compile into Purview, Intune, SASE or your AI gateway — applied by a human, never auto-remediated.
EU AI Act classification and evidence
Use-case classification, documentation and continuous evidence mapped across six frameworks. EU AI Act readiness reflects obligations as currently published and remains subject to the Digital Omnibus process.
How it connects
Organisation, workspace and consumption data are read through OpenAI's APIs to build the sanctioned side of the inventory and attribute spend.
Entra plus your network or endpoint sources reveal the personal-account usage that no vendor API will ever show you.
Policy compiles into native configuration for Purview, Intune, SASE or your AI gateway, with a diff for human review before anything is applied.
Questions, answered
Is ChatGPT Enterprise enough for AI governance?
It resolves data retention and training concerns for the sanctioned workspace, which is a real improvement. It does not inventory the personal accounts still in use, attach owners to custom GPTs, attribute spend to teams, inspect what the model returns, or produce framework-mapped evidence. Those remain your responsibility.
How do we detect employees using personal ChatGPT accounts?
Vendor APIs only see the tenant you pay for, so shadow use has to be discovered from your own signals: identity, network and endpoint telemetry. Govern360 is built to combine those with sanctioned-tenant data so both appear in one AI inventory.
How should we govern custom GPTs?
Treat each one as an AI system rather than a document: a named owner, a data classification, a review date and a decommissioning path. Govern360 inventories custom GPTs and connectors alongside your other AI systems.
Can Govern360 attribute ChatGPT spend to teams?
Yes. Workspace and API consumption is attributed to users, teams and cost centres and rolled into the Executive AI Bill, with budgets and anomaly alerts. Budgets alert and capture evidence rather than blocking usage.
Does the enterprise tier make us EU AI Act compliant?
No. The EU AI Act attaches obligations to how a system is deployed and used, not to which vendor supplied the model. Classification, documentation and evidence remain the deployer's responsibility, and readiness is subject to the ongoing Digital Omnibus process.
Does Govern360 read our employees' conversations?
Govern360 is designed to operate on governance signal — inventory, consumption, policy events and detector outcomes — and what is ingested is scoped with you at connection time. It does not proxy traffic or hold standing write credentials into your tenant.