Your staff are already using AI. Some of it is on a company account, much of it is on personal accounts, and almost none of it is logged. The fix isn't a ban, which pushes usage further out of sight. It's giving people a better tool than the one they found themselves, on an enterprise plan, with the controls switched on before the first login.
I run those rollouts for mid-market and enterprise companies: Claude Enterprise and Claude Team most often, plus ChatGPT Enterprise, Gemini Enterprise and Microsoft 365 Copilot, and very often more than one of them behind a single governance layer.
Choosing the platform
There is no single best model for every team, and the right choice depends as much on your identity provider, your data and your regulators as on benchmark scores.
| Platform | Where it fits best | Watch for |
|---|---|---|
| Claude Enterprise / Team | Long documents, careful writing, analysis, coding and agentic work (Claude Code, connectors over MCP) | Which features a HIPAA configuration covers; connector and MCP sprawl without an allowlist |
| ChatGPT Enterprise | Broad general use, custom GPTs, a familiar interface for large non-technical teams | The Business tier is not covered by a BAA; connector and app permissions need RBAC |
| Gemini Enterprise | Google Workspace companies; agents over Google data | Logging trade-offs when VPC Service Controls are on; confirm BAA scope for each product |
| Microsoft 365 Copilot | Microsoft 365 shops that want AI inside Outlook, Teams, Word and SharePoint | It sees everything the user can see, so years of oversharing in SharePoint become instantly searchable |
Many of the companies I work with land on two: Copilot inside Microsoft 365 for everyday office work, and Claude or ChatGPT for the deeper analysis, drafting and agent work. That's fine, as long as both sit under the same policy and the same logging.
The controls to switch on before day one
Every enterprise plan ships with controls. Few companies turn them all on. Before anyone outside the pilot group gets access, I configure:
- Identity. SAML single sign-on through Entra ID, Okta or Google, SCIM provisioning so leavers lose access the day they leave, and role-based access for admins.
- Data use and retention. Confirm that business data is excluded from model training (the default on Claude and ChatGPT enterprise plans), then set retention to match your records policy and legal holds.
- Audit and compliance feeds. Claude's Compliance API and OpenAI's Compliance API push conversations and activity into your SIEM, eDiscovery or archive, so AI use is reviewable like email.
- Connectors and MCP. Allowlist the connectors and MCP servers people may use, and block the rest. A connector that can read your CRM or file shares is the biggest data-exposure decision in the whole rollout.
- Claude Code and developer tools. Managed settings delivered through MDM or the admin console, so policy beats a developer's local config: approved MCP servers only, restricted commands, no secrets in prompts.
- Spend and residency. Organization and per-user spend limits, and US-only processing where your contracts require it.
- For Copilot, the SharePoint clean-up first. Sensitivity labels, a review of the most-shared sites and restricted content discovery for anything that should never show up in an answer.
The governance layer
Vendor admin consoles govern one vendor. Most companies need one set of rules across several models, plus agents that act on their own. That's the layer I put in front of everything:
- An AI gateway. One OpenAI-compatible endpoint (LiteLLM, Kong, Portkey, Cloudflare or Azure API Management) that every internal app and agent calls. It handles keys per team, model allowlists, budgets, rate limits and a full request log, and it can route sensitive prompts to a private model.
- Data loss prevention for AI. Microsoft Purview DSPM for AI, Netskope or Zscaler to see and stop sensitive data being pasted into unapproved AI sites, and PII redaction (Microsoft Presidio) on the way into any model that shouldn't see it.
- Permission-aware retrieval. When AI searches your documents, it must respect the same access rules your file shares do. Permissions are captured when documents are indexed and enforced inside the search, never after it.
- Agent governance. As soon as agents can send email, update records or call APIs, you need an inventory of what's running, policies enforced at runtime and an audit trail you can hand to an auditor. That's the problem Agentomy exists to solve. I co-founded it, and it slots into the same architecture.
Policy and training people actually follow
A 20-page acceptable-use policy nobody reads doesn't protect you. What works is a one-page matrix: your data classes down the side (public, internal, confidential, client-privileged, regulated), your approved tools across the top, and a simple green, amber or red in each cell. Pair it with short role-based training for legal, HR, finance and engineering, and a named owner who reviews new tools and use cases every month.
Regulated industries
Healthcare. HIPAA coverage depends on the plan and the feature. At the time of writing, Anthropic's BAA covers the API and a HIPAA-ready Claude Enterprise configuration but excludes features such as connectors and Claude in Chrome, and OpenAI does not offer a BAA for ChatGPT Business. I map every feature you plan to use against the vendor's current covered-services list before PHI goes anywhere near it, and route PHI-heavy workloads to private AI where that's cleaner.
Law firms and legal departments. ABA Formal Opinion 512 and the State Bar of Arizona's generative AI guidance both put the burden on the lawyer: understand how the tool handles client data, protect confidentiality, verify every output and bill honestly. Enterprise plans with no training on your data, firm-controlled retention and a verification step built into the workflow make that defensible.
Government contractors. FedRAMP status differs by product and impact level, CUI rules still apply even with CMMC Phase 2 paused, and the FY2026 defense authorization act bars DoD contractors from using DeepSeek. The approved list for a defense supplier looks very different from a law firm's.
A typical rollout
| Phase | What happens | Typical length |
|---|---|---|
| Discovery | Shadow-AI inventory, data classes, regulators, identity and integration review | 1 to 2 weeks |
| Design | Platform choice, controls, gateway and DLP design, policy matrix, success measures | 1 to 2 weeks |
| Pilot | 25 to 50 users across departments, controls live, weekly review of usage and incidents | 3 to 4 weeks |
| Rollout | Staged waves with training, champions in each department, connectors added one at a time | 4 to 8 weeks |
| Run | Monthly usage and risk reporting, new use cases, vendor and model reviews every quarter | Ongoing |
Frequently asked questions
Does Claude train on our company's data?
Not on Claude Team or Claude Enterprise: business data is excluded from model training by default. The same is true of ChatGPT Enterprise and Gemini Enterprise. The risk is usually the personal accounts your staff use today, which is why the rollout replaces them.
Claude Team or Claude Enterprise?
Team covers single sign-on, central billing and admin controls for connectors, and suits smaller groups. Enterprise adds SCIM provisioning, audit logs, the Compliance API, custom retention, fine-grained roles and the HIPAA-ready option. Most regulated or larger organizations need Enterprise.
Is Claude HIPAA compliant?
Anthropic signs a BAA for its API and for a HIPAA-ready Claude Enterprise configuration, but the BAA excludes some features. No tool makes you compliant on its own: you need the BAA, the right configuration, the right features switched off and a policy your staff follow.
Can we use Claude and ChatGPT and Copilot at the same time?
Yes, and many companies should. Put them behind one identity provider, one policy and, for internal apps and agents, one AI gateway so logging, budgets and redaction work the same way everywhere.
How long does an enterprise AI rollout take?
A governed pilot is usually live in four to six weeks from kickoff. A company-wide rollout typically takes two to four months, mostly gated by training, connector reviews and how much SharePoint or file-share clean-up is needed first.
Do you work outside Arizona?
Yes. I'm based in Scottsdale and work with companies across Phoenix and the rest of Arizona in person, and nationally on site or remotely.