ChatGPT for businesses is, first and foremost, a decision about data and responsibility. The tool generates text, summarises long documents and answers questions in seconds. To turn this into a benefit, three things are needed: the right contract, an understanding of the system’s weaknesses and binding rules within the team.
There is a measurable need to catch up. According to a survey by the Federal Statistical Office, 26 per cent of businesses in Germany were using artificial intelligence technologies in 2025. The figure stood at 57 per cent for companies with 250 or more employees, and 23 per cent for those with 10 to 49 employees. We have compiled an overview of AI in German businesses to show how this distribution is evolving.
Where ChatGPT saves time in day-to-day work
It is most useful for tasks involving large amounts of text and little need for decision-making. Summarising minutes, standardising quotation texts, drafting an English customer email, or producing a summary from ten pages of documentation: These tasks take hours and rarely require specialist knowledge that only a particular person possesses. Anyone who starts using it in this way will notice the difference within a few days. Having ChatGPT in the team therefore saves time, particularly on tasks that nobody previously wanted to take on.
Things become more challenging as soon as specialist knowledge comes into play. A Large Language Model (LLM) doesn’t know your price list, your delivery times or a customer’s history. It fills these gaps with phrases that sound plausible. That’s why it works best in situations where a human checks the result anyway before it leaves the company.
Data protection starts with choosing the right plan
The most important decision comes when you sign the contract. In OpenAI’s business plans, inputs and outputs are not used to train the models by default. Regarding the programming interface, the provider explicitly states in its developer documentation that submitted data will only improve the models if you actively consent to this. In the free access plans, this setting is configured differently and must be changed manually.
Then there is the contractual side. Anyone processing personal data requires a data processing agreement with the provider, and this forms part of the scope of services covered by the business plans. By default, logs are generated for the purpose of detecting misuse and are retained for up to 30 days; for approved customers, there are options to restrict these logs or to refrain from storing content altogether. Before implementation, check which of these components you require, record the result in your processing register and specify who manages access.
The difference lies in how your inputs are handled: in a personal account, they are used by default to train the models, and there is no data processing agreement. With the business plan, they are subject to a contractual restriction — no model training takes place, the data processing agreement is included in the scope of services, and the logs for detecting misuse can be restricted.
Where ChatGPT reaches its limits for businesses
The best-known weakness is hallucinations. The Fraunhofer Institute for Experimental Software Engineering describes these as content that appears realistic but deviates from the specified sources or is factually incorrect. The causes lie in the training data, the training process and the way in which responses are generated word for word. Even when factual evidence is scarce, a model will still produce a fluent sentence and rarely signals its own uncertainty of its own accord. These points need to be addressed before the rollout:
- Fictitious details: figures, names, legal provisions and source references may appear accurate but are occasionally incorrect. Any information released externally must be cross-checked against the original source.
- Lack of operational context: Without linked documents, your products, prices and internal processes remain invisible to the system. Responses on these topics are then based on general patterns from the training data.
- Data accuracy: Statements on current events are only reliable if the tool has demonstrably carried out online research. Without such research, the model falls back on older data.
- Confidentiality: Content entered into a private account is completely beyond your control. For customer data, contracts and personnel records, this is a deal-breaker.
- Uniform tone: Without guidelines on style and word choice, all results tend to sound similar, which is noticeable in customer communications. A brief style guide for each type of text reliably resolves this.
How to introduce ChatGPT to your team
Rolling it out without rules leads to chaos: some colleagues use personal accounts, others don’t use it at all, and nobody knows where the data has ended up. A controlled launch with two or three use cases, a business plan for all involved and a brief written guideline leads more quickly to reliable results. Furthermore, the EU AI Act has required providers and operators, with effect from 2 February 2025, to ensure their own staff have an adequate level of AI competence. These steps have proven their worth:
- Define use cases: Select two or three tasks involving a high volume of text and start with measurable objectives for those. If you try to tackle everything at once, you won’t be able to evaluate anything in the end.
- Centralised access management: A business plan for the whole team ensures that work-related content remains within a single account governed by a data processing agreement. Management of this should be assigned to a designated person.
- Draw up a list: set out what must never be entered, such as health data, job application documents, third-party contracts or login details. One page is enough; it just needs to be known to everyone.
- Establish the dual-control principle: everything sent to customers, partners or public authorities must be reviewed by a human and approved before dispatch. Responsibility for the content remains with the person sending it.
- Arrange training: a half-day session on prompt engineering, data protection and common pitfalls covers the basics whilst also fulfilling the requirement for competence. Document participants and content for future reference.
- Review after eight weeks: gather feedback, adjust the guidelines and approve further use cases. Anything that hasn’t proved effective is discontinued.
Where internal resources fall short, an external AI consultancy can help define use cases and framework conditions within a few weeks.
FAQs on ChatGPT for businesses
Can ChatGPT be used by businesses in a way that complies with the GDPR?
Yes, subject to certain conditions. You’ll need a business plan that includes a data processing agreement, you must document the processing in your records, and you may only enter the data necessary for the task at hand. A private account used for business purposes does not meet these requirements.
Are our inputs used to train the models?
Not included as standard in business plans. Regarding the API, OpenAI states that submitted data will only be used to improve the models if you actively consent to this. In the free plans, the default setting is different and must be changed manually in the data controls.
Which tasks are best suited for getting started?
Tasks involving large amounts of text and low risk: summaries, translations, first drafts of standard correspondence and standardising existing texts. Tasks with legal or financial implications should be left until a later stage, once approval processes and responsibilities are in place. As a rule of thumb, anything that would undergo a second review anyway is suitable.
How do we prevent incorrect information in customer texts?
Through a rigorous cross-check before sending. Every figure, every name and every source reference is checked, and no text leaves the organisation without human approval. Where operational knowledge is required, include the relevant documents directly in the query rather than relying on the model’s general knowledge.
Do we need to train our staff?
Yes. Since 2 February 2025, the EU AI Act has required providers and operators to ensure that the people operating these systems on their behalf have a sufficient level of AI competence. A brief, documented training session fulfils this requirement whilst also reducing the error rate in day-to-day operations.
