Does Your AI Vendor Train on Your Data? Tier-by-Tier, 2026

For the four assistants most European companies actually use, the answer splits on one line: consumer accounts may be trained on, organisational accounts are not. A personal ChatGPT subscription, a personal Microsoft account in Copilot and a personal Google account in the Gemini app all sit on the training side of that line by default. ChatGPT Business and Enterprise, Claude Team and Enterprise, Copilot signed in with a work Entra ID, and Gemini inside a Google Workspace tenant all sit on the other side, and each vendor says so in its own documentation.

The nuance is where the money and the risk are. Not training is not the same as not storing. Not storing in the US is not the same as offering EU residency. And EU residency, where it exists, is never total, is sometimes impossible to apply retroactively, and in at least two documented cases does not extend to a product the same vendor sells you in the same subscription.

Every claim below comes from the vendor's own documentation, read on 6 September 2026. Nothing here comes from a competitor summary, a secondary article, or a vendor's description of a rival. One qualification, because it matters for how much weight to put on a row: OpenAI's help centre and marketing pages return HTTP 403 to automated retrieval, so the OpenAI rows were read from archived copies of those same OpenAI pages rather than live. Every other vendor page here was read live.

Does Your AI Vendor Train on Your Data?

“Trains on your data” is four separate questions that get collapsed into one, and collapsing them is what produces bad decisions. The four are: does the vendor use your content to improve its models; who inside the vendor can read it; where does it sit at rest; and how long does it stay there. A vendor can answer “no” to the first and still store your content indefinitely in a US data centre, which is exactly what one of the four does on its business tier.

This page answers all four, per product and per account type, with the vendor's own wording attached to each row. It is a reference sheet, not an argument. If a claim is not in a vendor doc, it is not here.

Why Account Type, Not Price Tier, Decides It

The single most expensive misconception in a small or mid-sized company is that paying more buys privacy. It does not. A personal ChatGPT Plus subscription bought on a company card is still a consumer account, and OpenAI is clear that content from “services for individuals such as ChatGPT and Codex” may be used to train its models unless the individual opts out in the privacy portal. The same subscription bought as a ChatGPT Business seat is a different legal product with the opposite default.

Microsoft draws the same line by identity rather than by price. Its consumer FAQ lists who is excluded from model training, and the first entry is “Users signed into Copilot with an organizational Entra ID account.” The account you sign in with, not the licence you bought, decides which side of the line you are on. One consequence worth knowing: Microsoft also excludes “Users of Copilot within Microsoft 365 apps with Personal or Family subscriptions” from training, so a household subscription behaves differently from the free consumer Copilot on the same device.

Training Defaults, Tier by Tier

Read this by account type, not by brand. Each row carries the vendor document the wording came from.

Two rows deserve a note. The Claude consumer row is deliberately not an answer. Anthropic's help article frames model improvement as something you “choose to allow,” and does not state whether the toggle ships on or off for a new account. Rather than repeat a guess, the honest instruction is: open Privacy Settings and look. Anthropic separately confirms that commercial products are excluded by default, and that a Primary Owner or Owner can switch off the thumbs-up and thumbs-down button organisation-wide using the “Rate chats” setting under Organization settings, Data and Privacy.

The Gemini consumer row is not phrased as training because Google does not phrase it that way. What Google publishes is human review: a subset of chats are read by reviewers, including trained service providers, to improve Google services. Google then gives the clearest single warning any of the four vendors offers, and it belongs on a slide in every induction deck: “Please don't enter confidential information that you wouldn't want a reviewer to see or Google to use to improve our services.”

Where Does the Data Physically Live?

This is the section that changes procurement decisions, and it contains the two facts that almost nobody publishes.

First: Anthropic's first-party Claude does not store data in Europe. Anthropic can route traffic to selected countries, including in Europe, but its privacy article ends the paragraph with six words that settle the question: “Note that data is stored in the US.” Its developer platform documentation is blunter still. Workspace geo, the setting that governs where data is stored at rest, “is set when you create a workspace and can't be changed afterward,” and “currently, us is the only available workspace geo.” Anthropic's own compliance page tells you where to go instead: “For Europe, you can select country-specific deployment options through AWS Bedrock, GCP Vertex, and Microsoft Foundry.” If a proposal tells you Claude is EU-hosted, ask which of those three it runs on.

Second: Microsoft excludes Anthropic models from the EU Data Boundary. Microsoft states that for EU customers Copilot is an EU Data Boundary service, and then adds, in a note on the same page: “Models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary.” Admins choose whether third-party models power their Copilot experiences. That choice quietly moves some traffic outside a boundary the organisation believes it has.

Two more traps sit in that table. OpenAI's European residency cannot be applied retroactively: “European residency can only be configured for new Projects, existing Projects cannot be updated to have European data residency after creation,” and on the ChatGPT side the feature is offered to new Enterprise and Edu workspaces. A pilot that spins up projects in week one and asks about residency in week six has to be rebuilt, not reconfigured. And Google's own Workspace documentation records that Gemini Notebook ignores the organisation's data-region and file-sharing settings, which means the one Gemini surface most likely to be fed a folder of internal documents is the one your data-region policy does not reach.

Even where residency works, it is partial by design. OpenAI publishes what stays outside the chosen region: workspace metadata, workspace name, billing information, user logins, transient processing steps, and data handled through external integrations such as connected apps and web search. That is the useful teaching point. A residency badge is a statement about customer content, not about everything the service touches. The same instinct applies when you assess any vendor, which is why a written vendor security assessment beats a sales call, and why EU data residency claims are worth reading in the vendor's own words rather than in a comparison grid.

How Long Is It Kept, and Does Deleting Delete?

Retention is where the defaults are least intuitive. The headline: Claude for Work retains indefinitely unless an owner configures otherwise, and the most-used consumer assistants keep 18 months by default on both Microsoft and Google.

The Gemini figure is the one to put in front of staff, because it answers the sentence people say after an incident: “but I deleted it.” Google records that human-reviewed chats and related data “are not deleted when you delete your activity.” Anthropic has an equivalent asymmetry on safety-flagged content, keeping inputs and outputs for two years and classification scores for seven, on both consumer and commercial products. Deletion controls are real, and they are not symmetrical with the vendor's own retention exceptions.

What Can an Administrator Actually Set?

On business tiers, all four vendors give an administrator a genuine surface. The differences are less about how many switches exist and more about which risk each vendor thinks the switches are for.

Microsoft's documentation contains the most useful sentence for a rollout plan, and it is not about the model at all: Copilot “only surfaces organizational data to which individual users have at least view permissions,” and Microsoft follows it with a warning that you must be using the permission models in SharePoint and elsewhere properly. Translated: for a Microsoft shop the real risk is not the assistant, it is the over-shared SharePoint the assistant can now search instantly. That is a permissions-hygiene project, not an AI project, and it is the highest-value thing to fix before a Copilot rollout.

What Happens When Nobody Decides

The alternative to choosing is not neutrality. It is staff choosing for you, on personal accounts, on the training side of the line.

Those four figures come from IBM's Cost of a Data Breach Report 2025. Read together they describe one failure, not four: the tools arrived before the decisions did. The 97% figure is the sharpest of them, because access control is precisely what an organisational account gives you and a personal account does not. The fix is not a ban. Bans push usage further into personal accounts, which is the expensive side of the table above. The fix is to sanction a tool, buy it on organisational identity, set the admin controls, and tell people which surface is for which kind of content.

How to Decide What to Hand Your Staff

Four questions, in this order, answer it for most European companies.

1. Which identity will people sign in with? This decides the training default on every vendor in the table, so decide it first and enforce it with SSO. Everything downstream is easier once nobody is signing in with a personal account.

2. Do you have a genuine EU storage requirement, or a preference? If it is a requirement, the table narrows fast. OpenAI on new Enterprise or Edu workspaces, Microsoft inside the EU Data Boundary with the Anthropic-model exclusion understood, or Google Workspace with a data-regions policy will all meet it. Anthropic's first-party products will not, and you will be looking at Bedrock, Vertex or Foundry. Decide before you provision, because on the OpenAI API side you cannot change it afterwards.

3. What is the retention posture you want to be able to defend? If you are in a sector where a regulator may one day ask how long prompts containing client data were kept, “indefinite by default” is not the answer you want to give. Set a custom period on day one.

4. What are people allowed to paste? This is the only one of the four that is a training question rather than a procurement question, and it is where an AI literacy programme under Article 4 of the EU AI Act earns its place. The regulation does not require you to certify anyone or to guarantee a level. It does expect you to take measures appropriate to the systems you deploy and the people using them, and a documented rule about which surface takes which class of content is exactly that kind of measure.

The EU AI Act touches AI systems in other ways that are worth separating from data handling, because they are different duties with different deadlines. The Article 50 transparency obligations, for instance, govern whether a person must be told they are dealing with an AI system, which is a disclosure question rather than a data-residency one. We have covered those separately: what the AI Act means for voice agents, whether an AI caller must identify itself, when a system counts as high-risk, a practical compliance checklist, and the sector-specific case of debt collection. If you deploy someone else's system under your own brand, who is responsible for what is the first thing to settle.

For the everyday side of this, our guide to practical business uses of ChatGPT covers what teams tend to do first, and the GDPR guide and security checklist cover the controls you should expect from any AI vendor you bring inside your processes.

How This Page Is Kept Honest

Two cells in the tables above are deliberately not answers. The Claude consumer training default is a setting whose shipped state Anthropic's article does not publish, so the table says that rather than guessing. And the widely repeated EEA carve-out on consumer Copilot training is absent from Microsoft's own exclusion list, so it does not appear here at all. A table that is right about eleven rows and confidently wrong about one is worse than useless for the decision it is meant to support.

If you find a row that no longer matches the vendor doc it links to, the link is there so you can check it before we do.