Rolling out ChatGPT or Claude in a UK SME: the first decisions

Migration note. Checked 14 October 2026: OpenAI schedules custom GPT retirement for 11 December 2026. Only Enterprise workspaces with a qualified, approved deferral have the 11 February 2027 date. Migration and plugin access depend on the account or workspace; custom actions do not transfer automatically. Check OpenAI's migration guidance.

Most UK SMEs roll out ChatGPT or Claude badly the first time. They buy the cheapest tier, hand it to staff, write a one-paragraph "use it responsibly" email, and find six months later that personal data has been pasted into consumer accounts, no Data Processing Addendum exists, leadership has no usage view, and the bill is rising without a measurement framework attached. The fix is not more sophisticated AI; it is four decisions made up-front. This guide sets out the tier choice, the data residency choice, the governance choice, and the exit plan, with a UK GDPR baseline, a worked cost example for a 25-person London professional services firm, the rollout failure modes that recur in our advisory work, and a 30/60/90-day plan to deploy AI properly the first time.

The four decisions to make before buying any seats

Four decisions sit upstream of every other ChatGPT or Claude rollout step in a UK SME. Most failed deployments trace back to one of them being skipped or made implicitly.

The tier decision. Claude Pro and ChatGPT Plus are individual consumer tiers with no Data Processing Addendum and no admin controls; they are categorically wrong for any business workflow involving personal data, regardless of how convenient they are. Team and Business tiers add a DPA, basic admin controls, and explicit non-training defaults on business inputs. Claude Team and ChatGPT Business already include SSO. Enterprise comparisons should focus on the additional provisioning, audit, retention and contractual controls actually required. The right tier is decided by whether the firm processes personal data, whether SSO is mandatory, and whether audit logs are required by sector regulation, not by the seat price.

The data residency decision. Separate storage from inference. As at 14 October 2026, AWS lists London (eu-west-2) in-region availability for Claude Sonnet 4.6 on bedrock-runtime, but the same model card gives its in-region endpoint as N/A. Confirm the endpoint and account access with AWS before relying on UK inference. AWS separately lists Claude Haiku 4.5 on bedrock-mantle for in-region inference in Ireland (eu-west-1) and Stockholm (eu-north-1). Storage, retention and transfers need separate assessment. Consult the dated Claude residency matrix and check the terms for the actual product, rather than assuming a subscription and an API have the same controls.

The governance decision. Every UK SME deploying ChatGPT or Claude needs a written AI acceptable use policy, a defined data classification scheme, a vendor approval list, and a measurement framework before the first seat is provisioned. Without these, the rollout becomes a shadow IT problem within months. With them, the rollout becomes a managed change programme.

The exit decision. Vendor lock-in is real; both providers create switching costs through reusable assistant configurations, Claude Projects, and bespoke connector configurations. The exit plan is not a contract appendix to be written at end of life. It is the documented policy the firm follows during the rollout: keep prompts in source control, keep retrieval layers on owned infrastructure, document the model behind every workflow, and review the platform annually rather than at end of contract.

Tier choice grid

The grid below maps tier to typical fit and UK GDPR posture across both providers. The decision rule that follows surfaces straight from the rows.

Tier	Best fit	UK GDPR posture	Notes
Claude Pro	Individual researcher, evaluation only	No DPA on consumer tier	Wrong tier for any business workflow involving personal data
Claude Team	2 to 150 person teams, knowledge work, light agents	DPA, non-training default	£18 per Standard seat per month billed annually, including 20% VAT; minimum 2 seats (read 14 October 2026)
Claude Enterprise	50+, regulated sectors, agentic workloads	DPA, SSO, audit logs	20 US dollars per seat plus usage at API rates; usage projection required
ChatGPT Plus	Individual researcher, evaluation only	No DPA on consumer tier	Wrong tier for any business workflow involving personal data
ChatGPT Business	2 to 200 paid seats for current workspaces; legacy limits can differ	DPA, non-training default	Standard or Premium seats include ChatGPT, ChatGPT Work and Codex; confirm current local pricing and tax
ChatGPT Enterprise	Needs requiring negotiated enterprise controls and terms	DPA, SSO, SCIM, UK residency at rest, audit logs	Contact OpenAI for a quote and contractual minimum; no universal public seat price or minimum verified
API via AWS Bedrock	Automation-heavy workloads, residency-strict	DPA via AWS; model and endpoint determine the inference region	Different unit economics; engineering ownership required
API via Google Cloud Agent Platform EU	Automation-heavy workloads, residency-strict	DPA via Google; EU multi-region endpoint	Different unit economics; engineering ownership required

Choose the plan against the actual control requirements. Claude Team and ChatGPT Business already include SSO, so SSO alone does not require Enterprise. As checked on 14 October 2026, Claude Team supports 2 to 150 seats and current ChatGPT Business workspaces support 2 to 200 paid seats, with legacy exceptions. Enterprise pricing and contractual minimums must be checked with the vendor. Compare an API application separately where the workflow requires custom integration.

UK GDPR essentials

UK GDPR applies in full to any AI deployment that touches personal data, with no exception for "AI is just a tool". Five rules carry most of the weight.

Article 28 DPA. A signed Data Processing Addendum compliant with Article 28 must be in place before the firm sends personal data to the AI vendor. Both Anthropic and OpenAI publish standard DPAs on business and enterprise tiers; consumer tiers do not have a DPA, which is why consumer-tier use for any business workflow involving personal data is an Article 28 violation in itself, regardless of any other controls.

Lawful basis. A lawful basis under Article 6 (and where applicable Article 9 for special category data) must be established for the processing. For internal employee use cases, this is usually legitimate interest with a documented Legitimate Interests Assessment. For client-facing workflows, the lawful basis is normally either contract necessity or legitimate interest, with explicit privacy notice updates.

The consumer-tier prohibition. Even one instance of an employee pasting client data into Claude Pro or ChatGPT Plus is a notifiable breach in the wrong circumstances. Most UK SMEs choose to ban consumer-tier accounts on the corporate device estate rather than try to police use case by use case.

Residency and transfers. ChatGPT Enterprise added native UK data residency at rest from 24 October 2025. As at 14 October 2026, AWS lists London (eu-west-2) in-region availability for Claude Sonnet 4.6 on bedrock-runtime, but the same model card gives its in-region endpoint as N/A. Confirm the endpoint and account access with AWS before relying on UK inference. AWS separately lists Claude Haiku 4.5 on bedrock-mantle for in-region inference in Ireland (eu-west-1) and Stockholm (eu-north-1). Storage, retention and transfers need separate assessment. International data transfers under the UK GDPR adequacy framework with the United States are permitted under the UK-US Data Bridge, in force from 12 October 2023, but the firm's risk appetite still drives the residency choice. ZDR (zero data retention) clauses are available on enterprise contracts and are the cleanest backstop for sensitive workflows.

ICO guidance and DPIA. ICO guidance on AI and data protection continues to set the regulatory bar, including the requirement to complete a Data Protection Impact Assessment for higher-risk processing. The DPIA threshold is reached for most customer-facing AI use cases and many HR ones, regardless of platform. For a wider 2026 compliance picture, see our 2026 UK AI compliance checklist.

Internal AI policy: a one-page checklist

A workable AI acceptable use policy fits on a single page and answers six questions. UK SMEs routinely fail at AI rollout because the policy either does not exist or runs to twenty pages and is therefore unread.

Data classification. Data must be classified into at least three tiers before AI is used on it: green (already public), amber (internal but not personal), and red (personal data, client data, regulated data). Each tier has a defined permitted-use scope. Red data may go only to the approved enterprise platform with a DPA in place; amber to the same plus approved internal tools; green anywhere.

Approved tool list. The policy names the specific platforms approved for business use, the tier on each, and the SSO and admin controls in force. New tools require security review and approval before staff can sign up. The list is reviewed quarterly.

Prompt logging. Whether prompts are logged, where, for how long, and who can access them. Most UK SMEs choose to log prompts and outputs for at least 90 days for audit, governance, and quality purposes, with explicit notice to staff.

Prohibited use cases. The policy lists what AI must not be used for: making hiring or termination decisions without human review, generating final legal advice or medical advice without practitioner review, processing health data outside the approved tier, and any output that is shared externally without verification. Prohibitions are specific, not aspirational.

Vendor approval list. The list of approved vendors and the renewal cadence. Out-of-list tools require security review before use.

Escalation route. The named person to contact for AI-related security concerns, suspected breach, or a use case the policy does not cover. The escalation route is mandatory; an AI policy without a named owner is a document, not a control.

Cost worked example: a 25-person London professional services firm

A worked example helps anchor the cost framing. Consider a 25-person professional services firm in London (a small accountancy practice, mid-sized law firm, or boutique consultancy) buying ChatGPT Business or Claude Team for the first time.

Year-one all-in cost has five components: seats, training, admin overhead, integrations, and a contingency. Twenty-five Claude Team Standard seats on annual billing cost £5,400 a year, including 20% VAT (UK pricing page read 14 October 2026). ChatGPT Business requires a separate price and tax check. Training cost for an SME first-time rollout is typically 2,000 to 4,000 GBP for a one-day all-staff session plus follow-up clinics, depending on whether the work is internal or commissioned. Admin overhead, including the time of the IT lead or operations manager owning the rollout, is typically 1,500 to 3,000 GBP at small-firm internal cost, recognising that someone has to write the policy, run the security checks, and stand up SSO. Integrations, including SSO, the connector layer to the firm's document management system, and any RAG retrieval setup, can run anywhere from 1,000 GBP for a configuration-only deployment to 10,000+ GBP for a custom retrieval layer; for a 25-person firm, 3,000 to 6,000 GBP is typical. A 10 to 15 per cent contingency on the year-one total covers measurement gaps and unforeseen platform changes.

Using the figures above gives £11,900 to £18,400 before contingency, or £13,090 to £21,160 after adding 10% to the low end and 15% to the high end. This is illustrative arithmetic: the licence includes VAT, but the other inputs do not specify a tax basis. Put every quoted component on the same VAT basis before treating the result as a budget. This is several times the seat cost alone, which is the figure most CFOs initially anchor on. Year-two cost falls materially, because the rollout overhead is one-off; ongoing cost is dominated by seats and a smaller training and governance budget. The cost discipline is to model the total, not the seat price. For sectoral context, see our professional services industry page.

Common rollout failure modes

Five failure modes recur across UK SME AI rollouts in our advisory work. Each is preventable with up-front decisions.

Shadow IT. Staff sign up for personal Claude Pro or ChatGPT Plus accounts because the corporate rollout is too slow, too restrictive, or unclear. The firm ends up paying twice (corporate seats plus reimbursed personal subscriptions) while losing visibility into which client data is being pasted into which consumer surface. Mitigation: a clear approved tool list, an active block on consumer-tier sign-up from corporate email domains, and a fast track to provision new seats.

Prompt logging gaps. The firm enables AI but does not log prompts or outputs, so when a complaint or suspected breach arises there is no evidence trail. Mitigation: enable prompt logging at the platform level, define retention, and document the staff notice.

Lack of data minimisation. Staff paste entire documents (engagement letters, client files, payroll exports) into AI tools when they need the answer to a single question. The data exposure is dramatically larger than the question requires. Mitigation: train staff on the principle of minimum necessary input, and where possible use a RAG layer that retrieves only relevant passages.

No measurement framework. The firm cannot answer whether AI has produced any measurable benefit at the end of year one. The contract auto-renews on inertia or is cancelled on a vibe. Mitigation: define three to five outcome metrics on day one (time-saved per task, error rate, client response time) and instrument them at rollout, not at renewal.

No exit plan. The firm builds reusable assistant configurations, Claude Projects, and connectors against one platform without recording the prompts, retrieval logic, or workflow definitions outside the platform. Migration cost at year three is therefore disproportionate. Mitigation: keep prompts in source control, document workflows in writing outside the platform, and treat the platform as one component of an architecture rather than the architecture itself.

30/60/90-day rollout plan

A 30/60/90-day plan compresses a UK SME ChatGPT or Claude rollout into the time it would otherwise drift across. Each phase has a specific deliverable.

Days 1 to 30. Decide tier, residency, governance, and exit. Sign the DPA. Stand up SSO and SCIM where the tier supports them. Write the AI acceptable use policy and circulate for review. Provision seats for an initial pilot group of 5 to 15 users covering finance, operations, and a client-facing function. Define three to five outcome metrics. Run a one-day all-staff training session for the pilot group. Block consumer-tier sign-up at the email domain level. End of phase: a documented baseline ready for measurement.

Days 31 to 60. Roll out to the rest of the firm in a controlled wave. Hold weekly office hours for staff questions. Review prompt logs weekly for policy violations and use-case patterns. Capture the first round of measurement against the baseline. Tighten the AUP based on what staff are actually doing. Stand up the integrations that the pilot identified as load-bearing (typically a document management connector and a CRM connector). End of phase: firm-wide deployment with a measurement signal.

Days 61 to 90. Capture the formal year-one outcome metrics. Run a structured review of the rollout: which use cases delivered measured value, which did not, what governance gaps surfaced, and what the next-quarter priorities are. Decide whether to expand seats, add a second platform for specific functions, or move automation-heavy workloads to the API. Document the decision. End of phase: a written one-page review covering measured outcomes, governance lessons, and next-quarter priorities.

For implementation support across this rollout, see our ChatGPT implementation consultants service page, our broader services index, and our financial services industry page. For a deeper financial baseline on AI ROI, see our 90-day AI ROI framework.