ChatGPT and the OpenAI platform: what UK businesses are actually choosing between

Somebody in your business has said you should be using AI. There is a good chance the sentence contained the word OpenAI, and a better chance that nobody in the room could say what agreeing to it would involve.

That is not a failure of attention. It is because two entirely different purchases share one brand. One of them is a subscription your operations manager could start using this afternoon, on a card, with no involvement from anyone technical. The other is infrastructure that engineers build systems on, which arrives as a project with a specification, a budget and somebody's name against it afterwards. Both are OpenAI. One is a monthly licence. The other is a capital decision.

Most of the confusion in this market comes from people arguing across that line without noticing they are on opposite sides of it. The IT director who says the tool cannot be trusted with client data is usually describing the consumer product. The supplier who says you will need to build something because AI cannot run unattended is describing the product as it was eighteen months ago. Both statements are being made in the same meeting, about different things, to a person who has to sign.

For the record, so you can weight the rest accordingly: we are an OpenAI Select Partner and we build on the platform. We also build on Claude, we resell neither, and we take no margin on your usage. That matters mainly because it means we have no financial reason to talk you up a rung, and a good deal of what businesses ask us for turns out to need no engineering at all.

What follows sorts you into the right half of OpenAI, then into the right level of commitment inside it, then points you at the detail for whichever one you landed on.

OpenAI is a product company and a platform company, and you are only buying one of them

The split is clean once you see it.

ChatGPT is the product. People log in, ask for things and read what comes back. It is sold as seats. The consumer plans, Free, Go, Plus and Pro, belong to individuals. The two paid organisation tiers are ChatGPT Business and ChatGPT Enterprise, which give you a shared workspace, an admin console and single sign-on. Business is the plan formerly called ChatGPT Team, renamed on 29 Aug 2025, which is worth knowing when you read any comparison written before then.

One naming trap while we are here, because suppliers get it wrong and it tells you something when they do. "ChatGPT Work" is a mode inside the ChatGPT app, not a tier you can upgrade to. If a proposal offers to move you onto it, the author is writing from memory rather than from the documentation.

The OpenAI platform is the other company. It is an API and a set of developer services that your own software calls. Nobody logs into it. It has no interface your staff will ever see. What you get is the ability to put a model inside a process you already run, and what you take on is a system that has to be specified, built, tested, monitored and owned.

The useful test is not technical. It is this: is a person going to read the output and decide what to do with it? If yes, you are buying the product. If the output has to land in a system and something downstream has to act on it without anybody looking, you are buying the platform, whatever anyone calls it in the meeting.

Between those two there is now a third thing, and it is the part most buyers do not know exists.

There are three rungs of commitment, and the discipline is to climb them in order

The old version of this decision had two answers, seats or a build. It now has three, and the middle one has absorbed a large amount of work that used to justify a project.

Climbing in order is not caution for its own sake. The lower two rungs are reversible and cheap, and running one shows you exactly where it stops working. That is worth more than a specification written from assumptions. Here is the shape of the three, in brief.

Rung one: seats. A ChatGPT seat is a tool for an individual: drafting, summarising, interrogating a document. Custom GPTs extend it into a reusable version a team can share. Nothing happens without somebody starting it, and that person absorbs all of the error handling. Most businesses have not exhausted this rung. If Custom GPTs are in use and somebody says they are not enough, the practical difference between a Custom GPT and a built agent is the comparison.

Rung two: workspace agents. On 22 Apr 2026 OpenAI introduced workspace agents, describing them as an evolution of GPTs. Somebody in your business publishes one without an engineer, and it runs on a schedule or on a trigger from another system, keeps going while nobody is logged in, works in Slack, reaches connected applications, and asks for approval before it writes anything. Scheduled reporting, inbox triage, chasing a weekly process and drafting for a human to approve are rung-two jobs: publish one and give it a month. Runs are credit-metered rather than included flat, availability is by plan, and on Enterprise an administrator has to switch agents on.

Rung three: a built system. One sentence in OpenAI's own documentation, checked 08 Aug 2026, marks the boundary: the agent's response cannot currently be retrieved through the API. You can trigger a workspace agent from another system. You cannot collect what it produced, so nothing downstream can act on it unattended. The same applies where output has to carry enforced field values, be the same on Tuesday as it was on Monday, leave an audit trail on your own retention schedule rather than a vendor's thirty days, or reach a system no connector covers, a gap a custom MCP server closes (Anthropic's protocol, adopted by OpenAI) at the price of building, hosting and securing that server.

The one client example we can point to sits squarely on rung three: an AI order-entry agent for a UK builders' merchant that reads orders arriving in whatever shape the customer sent them and writes them into the system of record, with nobody in the middle transcribing. That is not a subscription feature.

What actually breaks on the way from a working demonstration to something in production is a longer list than most people expect, and it is mostly not the model: taking a ChatGPT prototype into production covers it properly. What each of the three commits you to, compared row by row, and the three-question test that settles which one a given job needs, are set out in what the OpenAI API does that ChatGPT cannot.

What each rung costs you is time, obligation and ownership before it is money

Money is the question everyone asks first and it is rarely the one that decides. What separates these three is what you are still carrying in a year: a monthly bill, a configuration somebody has to own, or a system with an engineering owner and a tested release process. Two of those obligations deserve more than a line.

Who owns it afterwards is the one that quietly decides whether any of this survives. A workspace agent with no named owner degrades the first time a connected system changes, and nobody notices until somebody asks why the Monday report stopped being right. A built system with no owner is worse, because it keeps running and keeps being trusted. Before you approve anything above rung one, put a name to it.

Lock-in is not the binary people treat it as. Rung two configuration lives inside the vendor's product, and no export of an agent's configuration is documented, so what you can hold outside the platform is the instruction text, if you wrote it somewhere else first. Rung three is, counter-intuitively, the more portable of the two, because the expensive part is your integration layer and the model is one call inside it. That is only true if you insisted on it at the start, which is the entire point of planning your exit from OpenAI before you need one.

If the question you actually need answered is what a build costs in pounds and how the number is arrived at, that is a separate piece: what an OpenAI integration costs in the UK.

Four governance facts apply whichever rung you land on

These come up in every procurement conversation, every DPIA and every client security questionnaire, and they are all independent of whether you build anything. Three of the four are more often stated backwards than correctly.

ChatGPT Business and ChatGPT Enterprise are two governance postures, not one product at two price points. Business has SOC 2 Type 2, SAML single sign-on, a shared workspace and an admin console. It does not have ISO 27001, SCIM directory sync, role-based access control, audit log export, enterprise key management, IP allowlisting or data residency. All of those are Enterprise. The one that cannot be fixed by upgrading later is residency, because OpenAI provisions it when a workspace or an API project is created rather than as a setting you switch on afterwards. If UK storage is anywhere on your roadmap, that decision has to be made before a workspace exists. The full list, and which four items stop deals rather than merely annoying an IT manager, is in the ChatGPT Business and Enterprise governance gap.

The training default is the opposite of the way most people state it. OpenAI does not train on inputs or outputs from ChatGPT Business, ChatGPT Enterprise or the API by default. Business customers are opted out unless they explicitly opt in. Consumer ChatGPT is the other way round: content from the individual plans may be used to train models unless the user goes into the privacy portal and switches it off, and almost nobody does, because nothing prompts them to.

Which means your real exposure is probably the accounts you never bought. The corporate tier your IT function argued about is the one behaving itself. The risk sits with the person who set up a personal account, pays for it themselves or reclaims it as a small monthly expense, and has been pasting contract text, customer lists and pricing into it ever since. That account is outside your single sign-on, outside your admin console, outside your retention controls and outside your leaver process, so when they resign it leaves with them, along with a year of work. Finding those accounts is cheap, largely non-technical, and consistently more valuable than the tier decision: how to audit the shadow AI already happening in your business sets out the week.

Exit is a design decision, not an exit decision. Whatever you configure inside the vendor's interface belongs to the vendor's interface. Prompts kept in a dashboard, evaluation sets built in the vendor's tooling and agent configuration all stay behind. Prompts kept in your repository, evaluation sets held as files and an integration layer you own all come with you. There is also an unresolved point that matters at contract stage rather than at exit: OpenAI's enterprise privacy page describes ChatGPT Business admins as able to export end-user conversations, while its help centre states plainly that data export is not available in a Business workspace. We cannot reconcile those from published sources. If your plan depends on being able to export, get the answer in writing before you sign.

Two contract details for whoever writes your DPIA, because both are commonly got wrong. A UK customer's counterparty under OpenAI's Data Processing Addendum is OpenAI OpCo, LLC, the US entity, not OpenAI UK Ltd. And the transfer mechanism that DPA names is the EU standard contractual clauses as amended by the ICO's UK Addendum. Write "UK Addendum" in your paperwork.

Whether any of that creates a legal obligation for your business is a question for your own advisers, and UK law firms answer it better than any engineering firm. What we answer is the engineering version: which tier, which controls, what to configure, and what breaks if you do not.

The platform moves under you on a published schedule, and that is a maintenance line, not a surprise

Anyone considering rung three should price this in before the first invoice rather than after.

OpenAI retires and replaces parts of its platform on a regular cadence, and it publishes the dates in advance. The Assistants API retires on 26 Aug 2026. AgentKit's Evals become read-only on 31 Oct 2026, and both Evals and Agent Builder shut down on 30 Nov 2026. Reusable prompt objects close on 30 Nov 2026. The Videos API ends on 24 Sep 2026 with no announced successor.

None of that is unreasonable behaviour by a vendor, and every capable platform does it. The failure mode is not the deprecation, it is that the notice arrives by email to a developer who left, and nobody in the business knows which systems are affected. Establishing what you are running on, and what has a published end date, takes an afternoon rather than a project: how to audit your OpenAI dependency risk is that exercise.

The practical consequence for a buyer is one line in the budget. A built system needs a small standing maintenance allowance, and any supplier who has not mentioned that has either not run one in production or is hoping you will notice later.

Choosing a supplier is mostly a question about what you own at the end

Two things worth saying briefly, because the detail belongs elsewhere.

The first is about credentials, including ours. A vendor badge proves enrolment in a vendor's programme at a named tier. It does not mean the vendor reviewed the supplier's code, endorsed their delivery or verified anything about the engineer who will be assigned to you. OpenAI has stated a target of training and enabling 300,000 certified consultants by the end of 2026, which tells you where this credential is heading: towards table stakes, quickly. Use it to sort the pile and nothing else. We have written the honest version, applied to ourselves, in what "OpenAI Select Partner" actually means and how to vet any AI supplier.

The second is about the shape of the deal. The failure that costs real money is not choosing the wrong firm, it is finishing the project owning a login instead of a system: the code in the supplier's repository, the model contract in the supplier's name, and the documentation in somebody's head. Ask who owns the code, whose name is on the vendor contract, whether the supplier takes a margin on your usage, and what would make them tell you not to build this at all. How to choose an OpenAI implementation partner in the UK works through scoping, pricing models and what a finished system should include.

What to do next

It is not "should we use AI". It is which of three things you are agreeing to. Start at rung one, and take a job up a rung only when something about that job forces you to: work that has to happen on a schedule or on an event with nobody present belongs on rung two, and work another system has to receive and act on belongs on rung three. Sort out the personal accounts while you are at it, because that is the exposure nobody signed off.

If you landed on rung three, the next step is a specification rather than a project. Four things belong in it: the trigger, the write, the behaviour when the model is not confident, and the evidence you will need six months later. If you are not sure which rung you are on, that is a scoping question and a short piece of work.

That is how we start OpenAI implementation engagements, and we run the same assessment independently of any one model vendor, because the answer is sometimes a different platform and is quite often the AI already sitting inside software you pay for. To get the decision documented before you commit to anything, request a quote.