A twenty-person wealth advisory firm. They’ve been on ChatGPT Plus for eight months, using it for client correspondence drafts, meeting summaries, and investment commentary. Then a corporate client sends a supplier security questionnaire. One question asks which AI tools handle client data, who has access, and what audit controls are in place.
The founder reads the Plus subscription terms more carefully.
That question, “should we use ChatGPT at all?”, has been answered by many small firms already. The live question now is whether they’re on the right tier, and what it costs them to have that wrong.
What choice are you actually facing?
ChatGPT runs across five tiers: Free, Go, Plus (around £16 per user per month), Business (around £25 per user per month on annual billing), and Enterprise, where pricing is negotiated directly with OpenAI and is materially higher per seat. Business was previously called Team. Enterprise adds single sign-on, audit logs, role-based access control, and stronger data governance, features many owner-operators have never needed or asked about.
For the majority of small businesses, the practical choice sits between Plus for individual productivity and Business for teams wanting a shared workspace with basic admin. Enterprise sits above that, carrying controls that are necessary for some situations and irrelevant for others.
Tier selection should follow your actual workflows and compliance obligations, not which option carries the most impressive name.
When Plus or Business is the right call
For owner-operators with a handful of AI users doing assistant-style work, Plus or Business will cover the majority of scenarios adequately. If staff mainly use ChatGPT for drafts, summaries, brainstorming, and internal productivity, and you’re not processing special-category personal data or feeding client-confidential detail into prompts, the incremental compliance benefits of Enterprise rarely justify the cost and governance overhead.
Several conditions suggest staying at the lower tier is the rational call. Your team is small, perhaps under twenty regular AI users, and you can manage access manually without needing identity providers like Azure AD or Okta. Your AI use is assistant-style, not embedded in automated decisions or customer-facing outputs. You’re not in a sector where logging and audit trails are mandated for the specific activities you’re running. And the monthly cost matters, because moving from Business to Enterprise pricing can consume thousands of pounds annually that might generate better returns invested in training or process redesign instead.
UK SME support network Enterprise Nation reports that the majority of small businesses they work with are well served by Plus and, for shared workspaces, occasionally Business.
When Enterprise makes sense even at small headcount
The case for Enterprise at small scale rests on three triggers: regulated data in prompts, AI embedded in customer-facing workflows, and client demands for documented controls. Any one of these can shift the calculus decisively. A firm of fifteen with all three in play has a stronger case than a firm of two hundred using AI purely for internal drafts.
Take regulated personal data first. The ICO has made clear that UK organisations using generative AI remain data controllers with full UK GDPR obligations, including the need for Data Protection Impact Assessments where AI processing is likely to be high risk. A firm using ChatGPT to draft suitability letters, clinical summaries, or credit assessments for individual clients is operating in high-risk territory. Business-level controls may be adequate with good internal policies and careful redaction, but Enterprise features, including audit logs, role-based access, and data residency options, make it considerably easier to evidence adequate controls if the ICO asks.
The NCSC adds a second dimension. Where AI outputs directly affect customer outcomes, rather than internal drafts that a human reviews before acting, the security guidance recommends monitoring, validation, and clear change controls. A firm sending AI-drafted communications directly to clients, or using ChatGPT to shape pricing recommendations, is in scope for that guidance in a way that a team using it solely for internal meeting notes is not.
Client expectations are often the most immediate driver. Legal and insurance commentary in the UK notes that corporate clients increasingly expect suppliers to document AI governance and confirm that consumer-grade tools are not handling sensitive work. If you’re already receiving security questionnaires that ask about AI controls, Enterprise logging and audit capabilities give you answers you can actually stand behind. That’s a real commercial pressure, not a theoretical one.
For UK firms with clients in the EU, the EU AI Act adds a further consideration. SMEs providing services into the EU as AI deployers may need to demonstrate risk management and transparency, which Enterprise documentation and logging supports more readily than Plus.
What it costs to get this wrong
The error runs in both directions. Staying on Plus when Enterprise is warranted can leave a firm unable to reconstruct a data incident, expose it to ICO scrutiny, or cost a contract when a client’s security review flags consumer-grade AI in regulated work. Moving to Enterprise before those triggers are present brings wasted spend and a governance burden that can stall the adoption it was meant to support.
On the under-investment side, the ICO can impose enforcement action for serious UK GDPR breaches, including fines of up to £17.5 million or four per cent of global annual turnover. That threshold is rarely reached in a small-firm AI context, but the inability to produce logs showing who accessed what and what AI generated is a real vulnerability in a regulatory enquiry or a client incident. The FCA has indicated separately that regulated firms using AI for advice or decisions need to demonstrate governance and oversight, and that applies regardless of firm size.
On the over-investment side, McKinsey’s 2024 global survey found that only 26 per cent of organisations had successfully scaled AI beyond pilots. Complexity and change-management failure were identified as common blockers. Deploying Enterprise properly requires identity integration, governance policy work, and ongoing admin overhead. For a firm where only a few people use AI occasionally for internal tasks, that overhead may deliver no material benefit over a well-managed Business subscription with a clear usage policy.
What to ask before you decide
Before booking an Enterprise sales call or upgrading to Business, five questions should shape your decision. They cover data handling, access control, auditability, integration depth, and what your clients already expect. The answers tell you whether Enterprise controls add real value to your workflows or whether they’re features you’ll pay for but never use.
First, ask whether any of your business data is used to train OpenAI’s models by default, and where it’s stored. Business-level contracts already exclude business data from training. Enterprise contracts typically go further on data residency options and sub-processor commitments, which matters if clients impose their own data-handling requirements or if your DPIA requires it.
Second, ask whether you need SSO and centralised access management now. The NCSC recommends centralised control for AI tools carrying sensitive workflows. For a firm of five with two AI users, manual account management with a clear joiners and leavers checklist may cover you adequately for the next twelve months.
Third, ask whether you could reconstruct an AI-related incident. If a client raised a complaint about AI-generated advice tomorrow, could you identify the prompt, the output, and the user who sent it? If the answer is no, and AI is involved in client-facing work, that’s a material gap in your governance.
Fourth, consider integration depth. If you plan to connect ChatGPT to your CRM, finance tools, or project systems, check what the current plan supports and what throughput is guaranteed. The biggest productivity gains come from integrating AI directly into workflows, and Enterprise plans, or Azure OpenAI equivalents, typically provide higher throughput and better service-level commitments than Plus for that kind of use.
Fifth, check what your clients are already asking. If a client has included AI governance questions in a security questionnaire or a contract clause, you already have external pressure defining your minimum. That’s often the clearest signal that Plus or Business is no longer enough for the work you’re doing.
If you can’t clearly articulate which Enterprise-only features would change your day-to-day and why, stay on Business for now. Run a clear internal usage policy, keep sensitive data out of prompts, and revisit when your workflows or client obligations require it. Book a conversation if you’d like to work through where your firm sits.
