10.9 The same policy on both AI vendors

In everyday life. A company gives its drivers fuel cards. The card company lets the owner block some kinds of purchases and look back at past charges. It cannot see what a driver buys with a personal card. And the rules for drivers come from the company, not from the card company.

What you will learn. How each AI vendor's own pages say you can carry out the same AI policy, and the three differences that change your setup. You practice it in steps 3 and 8 of the lab.

Why it matters. Your policy stays the same on both AI vendors. Which settings carry it out, who can change them and how long records last do not. So Dave, Brightline's controller, may enforce a rule on one AI vendor that he can only hope for on the other.

The answers in 10.1 to 10.8 are the same on either AI vendor: Anthropic, which makes Claude, or OpenAI, which makes ChatGPT. Sections 10.3 and 10.7 gave each AI vendor's settings for training, retention, memory, connectors and apps. The two boxes below add the rest. They use the same six lines, in the same order. Team, Business and Enterprise are the AI vendors' plans for companies.

Anthropic, as verified 12 October 2026.

• Usage Policy. A new version takes effect on November 12, 2026, replacing the one 10.3 summarizes. Its high-risk rules cover recommendations about one person, such as a credit, housing or employment decision. A qualified person must review each one, with authority to change it, before it is delivered or used. The person affected must be clearly told that AI was used. Internal drafts that are not the final recommendation are excluded. So is business work that advises or decides nothing about a specific person. Users must make sure their agents' actions, through tools, browsers or connected systems, follow the policy.¹
• Your policy in the product. Owners on Team and Enterprise can write organization instructions, which Claude follows in every conversation. Only Owners and the Primary Owner can see them. Anthropic warns that in rare cases, when instructions directly contradict each other, behavior may vary.²
• Work accounts. Team and Enterprise offer single sign-on, so staff sign in with their work account.³ Once the company's email domain is verified, an Owner on either plan can stop people creating new personal accounts with it. On Enterprise, domain capture goes further. Personal accounts on the domain must move into the company's organization or close within 30 days, and the setting cannot be reversed.⁴
• Who switches features on. Of the standard roles, only Owners and the Primary Owner can turn on capabilities, such as web search, and integrations.⁵ On Enterprise, custom roles give features to groups. But if an Owner turns a feature off for the whole organization, no custom role can turn it back on.⁶ Some settings start on. Members may use Cowork's "Automatically approve" mode, in which Claude checks its own actions instead of asking, unless an Owner turns it off.⁷⁸ Owners can also turn off members' thumbs-up and thumbs-down ratings, the feedback that 10.3 says can be used for training.⁹
• Records. On Enterprise, Owners can export the audit log for the past 180 days. It records events such as file uploads and deleted conversations, but not chat titles or content.¹⁰ Only the Primary Owner can turn on the Compliance API, which can also pull chat data and files.¹¹
• Security documents. The Trust Center lists Claude Team and Enterprise as covered by SOC 2 Type 2 and ISO 27001. Sensitive documents need a request form.¹²

OpenAI, as verified 12 October 2026.

• Usage Policies. They still carry the date October 29, 2025, the version that 10.3 summarizes. OpenAI says its rules are no substitute for legal requirements or professional duties. A form lets you follow updates.¹³
• Your policy in the product. On Enterprise, a workspace can set its own AI policy. ChatGPT shows it to users in a pop-up every 30 days, and again when the policy changes.¹⁴
• Work accounts. Business and Enterprise support single sign-on.¹⁵ Verifying the company's domain does not delete or merge anyone's personal workspace. Claiming the domain is only for approved use cases, by request to OpenAI.¹⁶ On Business, admins cannot require anyone to merge or delete a personal workspace.¹⁵ On Enterprise, joining can require one on the company's domain to be merged or deleted.¹⁷
• Who switches features on. On Enterprise, only Owners create and assign custom roles, which decide who may use each feature. Roles add up. If any role a member holds grants a feature, the member has it, even when another role turns it off. A Lockdown Mode role is the exception: it can block some network features that other roles grant.¹⁸ If a business opts in to share data, for example through feedback, OpenAI may use it for training.¹⁹
• Records. The Compliance Platform is for Enterprise and Edu. Only a workspace Owner can grant access to conversation messages. Its logs are kept for 30 days, so a company that needs them longer should download and keep them itself.²⁰
• Security documents. The Trust Portal offers its SOC 2 Type 2 report, for July 1, 2025 to June 30, 2026, to users who request access.²¹

The comparison. Three differences change your setup.

Personal accounts: on Claude, an Owner can block new personal accounts on the company's email domain. On Enterprise, an Owner can also move or close the old ones. On ChatGPT, verifying the domain leaves personal workspaces in place, and claiming it needs OpenAI's approval. So on ChatGPT, more of this rule rests on your written policy. On both, these domain settings do not reach an account made with a personal email address. That is why 10.4 fixes the slow approved route, instead of relying on rules alone.

Records: Claude's audit log export reaches back 180 days. ChatGPT's compliance logs are kept for 30 days. If a problem is found after 30 days, the platform no longer has the logs from its start, unless you kept them. So on ChatGPT Enterprise, set up a regular download before anything goes wrong. Neither AI vendor offers these logs on Claude Team or ChatGPT Business.

Where the policy shows: Claude's organization instructions reach the AI, and members cannot see them. ChatGPT's pop-up reaches people, every 30 days. So on Claude, tell people the policy another way, such as when they join. On ChatGPT, still put the worker's rules in its brief (Chapter 5).

What stays the same. On either AI vendor, settings carry out a policy that people wrote and approved. They do not write it. A pop-up reminds, and an instruction asks. Neither is a control (10.3). Audit records and custom roles come with Enterprise, not with Claude Team or ChatGPT Business. So a small company keeps more of its policy with named people. And each AI vendor's usage policy is an outer edge. Your own rules, such as Brightline's sign-off matrix, sit inside it.