OpenAI Enterprise + AI Governance: A CISO's Guide (2026)

OpenAI maintains SOC 2 Type 2 for the ChatGPT Enterprise and API platforms. The report covers security, availability, and confidentiality criteria. ISO/IEC 27001 and ISO/IEC 27018 certifications are also documented on the Trust portal. CSA STAR Level 1 attestation is published. For a CISO running the standard vendor security questionnaire, these attestations cover the bulk of the security domain questions out of the box.

ChatGPT Enterprise and the API on Enterprise terms default to not using customer inputs or outputs for model training. This is the single most important policy decision for most CISOs, because it neutralises the largest perceived risk in pasting work content into the chat interface. The default is enforced for all Enterprise tenants and is contractually backed via the DPA. For free and Plus tiers the default is different, which is why personal-tier shadow use is the primary risk vector even in organisations with a deployed Enterprise tenant.

OpenAI uses TLS 1.2 or higher for transit and AES-256 for data at rest. Customer data in the Enterprise tenant is logically isolated, and OpenAI exposes a workspace-level data residency option for Europe-stored data (see EU data residency below). For most CISOs, this is sufficient cryptographic posture; the residual questions are usually about key management and bring-your-own-key, which OpenAI has not generally exposed for ChatGPT Enterprise.

ChatGPT Enterprise supports SAML 2.0 SSO with major identity providers (Okta, Microsoft Entra ID, Google Workspace) and SCIM 2.0 for user provisioning and deprovisioning. This satisfies the baseline identity requirement and integrates the tenant into the standard joiner-mover-leaver workflow. Group-based access control is available via IDP group claims.

OpenAI offers a Business Associate Agreement (BAA) on request for ChatGPT Enterprise and the API on Enterprise terms. The BAA is signed only after a HIPAA readiness review and applies only to designated covered workloads. The BAA is the gating contract for any health system or covered entity using ChatGPT Enterprise as a sanctioned tool; without it, PHI cannot be processed even if all other technical controls are in place.

OpenAI launched an EU data residency option for ChatGPT Enterprise in early 2024, with conversation data stored in EU-based infrastructure. Customers with EU GDPR processing obligations can opt in to the residency commitment for new workspaces. The commitment covers conversation content and certain related metadata; some operational data and model serving may still touch US infrastructure depending on the request type, and CISOs should review the current Trust portal documentation for the exact scope.

ChatGPT Enterprise has limited native DLP - it can block file uploads beyond a size threshold and supports SSO group-based access, but it does not provide content-aware policy enforcement at the prompt layer. If an employee pastes a 12,000-word document containing customer PII, source code, or regulated data into the chat interface, the request reaches the model with no policy interception.

An external control plane sits between user and OpenAI, inspects each prompt against policy rules (PII patterns, source code signatures, regulated data classifiers, custom allow and block lists), and either redacts, blocks, or warns before the request reaches OpenAI. This is the most common reason Enterprise customers add Areebi or an equivalent: the OpenAI tenant is the model layer, the control plane is the enforcement layer.

SAML and SCIM let OpenAI know who the user is, but policy decisions remain coarse-grained (workspace-level, group-level). Most CISOs want finer-grained rules: a customer success rep can paste internal documents but not source code, an engineer can paste source code but not customer PII, a compliance officer can read both but not retain conversation history beyond seven days.

This level of identity-aware policy is typically implemented in the control plane, with rules expressed against IDP group membership and claims, and enforced at the prompt layer before requests reach OpenAI. The model never sees content the user was not authorised to send.

ChatGPT Enterprise provides admin audit logs via the workspace console, but exposing those logs to a SIEM (Splunk, Sentinel, Chronicle) for centralised security operations requires custom work. The audit log is also at the workspace level and does not provide the prompt and response payload metadata most CISOs want for incident investigation.

An external control plane sits in the prompt path and captures audit-grade telemetry per interaction: who, what (with appropriate redaction or hashing), when, what policy fired, and what the response was. The telemetry is forwarded to the SIEM in standard formats and retained per the customer's retention policy.

The OpenAI Enterprise tenant is vendor-locked by definition. If OpenAI is degraded, breached, or simply unavailable for an extended window, the workloads dependent on it fail. Many regulated workloads also benefit from multi-model verification (run the same prompt against OpenAI and Anthropic, compare outputs, escalate disagreements).

An external control plane abstracts the provider behind a stable internal interface, supports failover between providers, and can route workloads to the appropriate model per policy (sensitive workloads to BAA-covered providers, code workloads to specialised code models, multilingual workloads to a regional provider). This is increasingly a procurement requirement for federal, healthcare, and financial workloads.

Even organisations that standardise on OpenAI Enterprise as the default will use other providers: Anthropic Claude for long-context analysis, Google Gemini for Google Workspace integration, embedded AI in CRM and productivity tools. A single-vendor governance posture leaves these workloads unmanaged.

An external control plane provides one policy, one audit log, one inventory, and one DLP rule set across all providers, so that the AI Acceptable Use Policy means the same thing whether the employee is using ChatGPT Enterprise, the Anthropic console, or a Slack AI feature. This is the unified posture NIST AI RMF GOVERN 1 and 6 expect.