Most comparisons lead with features and pricing. This one leads with data sensitivity, existing tech stack and regulatory exposure instead.
This page compares nine AI platforms covered elsewhere in this series: Claude, Microsoft Copilot, ChatGPT / OpenAI, Google Gemini, Meta Llama and other open-weight models, Perplexity, Amazon Bedrock, IBM watsonx, and Nvidia's infrastructure layer. It does not declare a winner. Every organisation reading this page has a different data profile, a different existing technology stack, and a different regulatory position, and those three factors, not a benchmark score, determine which platform makes sense.
INTAI does not sell, resell or receive commission on any of the platforms below, and the order they appear in this comparison is not a ranking. Use the two-column list below to jump straight to the section you need, or read through in order: the sections build on each other, starting with the data question every other decision depends on.
Before comparing any feature, work out what category of data the intended use case would actually touch. This one question rules out more platforms, and more quickly, than any capability comparison will.
Drafting, research, internal brainstorming and other work that would cause no real harm if it were somehow disclosed. For this category, any managed platform's standard business tier is generally an acceptable starting point, and the decision comes down to the stack and cost factors covered later on this page rather than data risk.
Any managed platform's business or enterprise tier, compared in the table below.
Client files, personal data, regulated records and other material an organisation has a contractual or legal duty to protect. This is where a zero-retention or enterprise API tier, with contractual no-training terms and a defined data processing agreement, generally becomes the minimum requirement rather than an optional upgrade.
The zero-retention and enterprise tier rows in the comparison table below, or the Meta Llama page where even that is not enough.
A narrower category than most organisations assume: data that a specific contractual, regulatory or privilege undertaking prohibits sending to any external service at all, regardless of that provider's retention or training terms. For this category, only an open-weight model run on infrastructure the organisation controls, or an equivalent on-premises deployment, actually meets the requirement.
The Meta Llama and open-weight page, and the Nvidia infrastructure page for what runs underneath it.
Once the data sensitivity question has narrowed the field, the organisation's existing technology environment usually narrows it further. Adopting the platform that already sits inside your existing licensing and identity setup is normally the lowest-friction route, since it inherits controls you have already paid for and configured rather than requiring a new set built from nothing.
Organisations already standardised on Microsoft 365, Entra ID and Purview generally find Copilot the lowest-friction option, since it inherits the tenant's existing identity, permissions and compliance configuration rather than introducing a separate one.
Organisations already standardised on Google Workspace generally find Gemini the lowest-friction option, for the same reason: it inherits existing Drive, Gmail and Workspace admin console configuration rather than requiring a parallel one.
Organisations already running production workloads on AWS generally find Bedrock the lowest-friction option, since it sits inside existing IAM, CloudTrail and account controls and gives access to several model providers, including Claude and Llama, behind one governance boundary.
Organisations without a dominant existing cloud or productivity platform have an open field, and should decide on the data sensitivity axis above rather than on stack fit, since there is no incumbent advantage to inherit either way.
Section 3, Start With Data Sensitivity, Not Features.
Presented factually, not as a ranking. Enterprise tiers, data residency options and admin tooling change frequently across every vendor in this list, so treat this as a structural guide to what to check rather than a permanently fixed snapshot, and confirm current terms directly with each vendor before finalising a decision.
| Platform | Data Residency Options | Enterprise / Zero-Retention Tier | Admin & Audit Controls | Typical UK Adoption Stage |
|---|---|---|---|---|
| Claude (Anthropic) | US-based hosting by default; regional handling varies by access route, including cloud marketplaces such as Bedrock and Vertex AI. | Team and Enterprise plans available; the API offers configurable retention, including zero-retention options for eligible use. | Enterprise plan adds centralised user management, SSO and usage visibility; strongest audit depth sits at Enterprise and API tiers. | Widely piloted by individual teams; organisation-wide rollout with formal governance still maturing at most UK businesses. |
| Microsoft Copilot | Inherits the Microsoft 365 tenant's existing data residency commitments, including UK and EU regions for eligible tenants. | Licensed per user on top of an existing Microsoft 365 E3 or E5 agreement; commercial data protection terms apply by default. | Extensive Microsoft 365 admin centre and Purview integration; the most mature audit and compliance tooling of any platform here for existing Microsoft 365 tenants. | The most widely licensed platform in this comparison among UK organisations already on Microsoft 365, though usage often runs ahead of configured governance. |
| ChatGPT / OpenAI | US-based hosting by default; Team, Enterprise and API tiers offer contractual data-use protections rather than a regional hosting choice for most customers. | ChatGPT Enterprise and the API offer no-training-by-default terms; zero data retention available for qualifying API use cases. | Enterprise tier adds a central admin console, SSO and usage analytics; audit depth is thinner on individual or Plus accounts. | Very high informal individual use across UK businesses; formal Enterprise or API rollout with governance attached is more variable. |
| Google Gemini | UK and EU data residency available for eligible Google Workspace editions; the free consumer Gemini app follows different terms. | Gemini for Workspace inherits the tenant's existing Workspace data processing terms, separate from the free consumer product. | Google Workspace admin console and Vault provide established audit tooling; permissions are inherited from existing Drive and Workspace sharing settings. | Growing quickly among UK organisations already on Google Workspace; Drive and sharing configuration is the most common blocker to safe rollout. |
| Meta Llama / open-weight | Entirely within infrastructure the organisation chooses and controls, since nothing is sent to an external vendor at inference time. | Not applicable in the vendor-tier sense; there is no vendor retention because there is no vendor processing the data. | No vendor-provided admin console; access control, logging and audit tooling must be built or bought separately by the deploying organisation. | Limited to organisations with a specific data constraint and the infrastructure capability to self-host; the earliest-stage adoption of any platform here. |
| Perplexity | US-based hosting; enterprise tier data-use terms differ from the free consumer product. | Perplexity Enterprise offers data-use protections separate from consumer terms, rather than being built primarily around a zero-retention API model. | Enterprise tier adds centralised billing and user management; governance tooling is lighter than platforms built for broader workflow use. | Adopted mainly by research, marketing and analyst functions rather than organisation-wide; governance focus is citation verification more than data leakage. |
| Amazon Bedrock | Determined by the AWS region the organisation already operates in, consistent with existing AWS data residency commitments. | Gateway access to multiple model providers, including Claude, Llama and Amazon's own Titan and Nova models; retention terms vary by the model selected. | Inherits AWS IAM, CloudTrail and existing account controls; governance is partly inherited from AWS and partly dependent on the model chosen within Bedrock. | Adopted mainly by UK organisations already running production workloads on AWS, often to consolidate several models behind one governance boundary. |
| IBM watsonx | Available across IBM Cloud regions, including UK and EU; on-premises and hybrid deployment options exist for the most sensitive workloads. | Built for enterprise and regulated-sector use from the outset, with contractual and technical data protection as standard rather than an add-on. | Ships its own governance tooling, watsonx.governance, for model risk tracking; strong technical audit trail, but does not itself cover organisational accountability or board reporting. | Concentrated in financial services, insurance and other heavily regulated UK sectors already using IBM infrastructure. |
| Nvidia | Not applicable in the vendor-hosting sense; Nvidia supplies the infrastructure and software layer beneath a self-hosted or open-weight deployment. | Not applicable; there is no Nvidia-hosted data tier, since the organisation runs its own instance of whichever model sits on Nvidia's stack. | No vendor-provided chat-platform admin console; access control and audit tooling are built at the deployment layer above Nvidia's infrastructure. | Relevant mainly to UK organisations already committed to owning their own AI infrastructure, most often alongside an open-weight model such as Llama. |
Rows are ordered to match the order this comparison series was published in. This is not a ranking, and no platform in this table is presented as superior to another.
The data sensitivity and stack factors above apply generally. Some sectors carry an additional layer of regulatory or professional obligation that changes what a safe default actually looks like.
Legal professional privilege and client confidentiality undertakings mean the "genuinely un-shareable" category from Section 3 applies to a meaningfully wider slice of everyday work than in most sectors. For privileged material specifically, a zero-retention API tier is often not sufficient on its own; some firms conclude they need a private or open-weight deployment for that category of work.
Zero-retention API tiers for general matter work; the Meta Llama page for privileged material specifically.
FCA and PRA expectations around model risk management mean firms need to evidence how an AI system's outputs are reviewed, tested and monitored, not just where the underlying data sits. This tends to favour platforms with built-in model risk tooling or an existing cloud governance boundary the firm can extend, over platforms with none.
IBM watsonx where model risk tooling is the priority; Amazon Bedrock for firms already governed on AWS.
Health data is special category data under UK GDPR, and patient safety adds a further dimension: an AI output feeding into a clinical or care decision needs human oversight built in regardless of which platform produced it. Direct patient data generally sits in the client-confidential or regulated tier from Section 3, with the most sensitive identifiable records sometimes falling into the un-shareable tier depending on the specific undertaking in place.
Whichever managed platform already sits inside the organisation's existing clinical governance, configured to the regulated tier; private deployment for the most sensitive identifiable records.
Whichever platform an organisation lands on, the same governance work follows it. Platform selection narrows the field; it does not replace the work below, and skipping it is the most common reason a well-chosen platform still ends up poorly governed.
A short, neutral description of each platform covered in this series, and where to read the full detail.
Anthropic's family of models, reached through Claude.ai, Team and Enterprise plans, the API, or a cloud marketplace, each with different governance implications.
Embedded across Microsoft 365, Copilot inherits much of an organisation's existing governance, making current permissions the main factor to get right.
OpenAI's products span individual ChatGPT accounts through to ChatGPT Enterprise and the developer API, each with a very different governance profile.
Google's models, available through Gemini for Workspace, the consumer app and Vertex AI, where existing Drive sharing settings are the main governance factor.
Openly published model weights run on infrastructure you control, removing external data sharing at the cost of taking on a vendor's usual governance role.
A research and citation assistant rather than a general chat platform, where governance is chiefly about verifying citations rather than data leakage.
An AWS-native gateway to several model providers, including Claude, Llama and Amazon's own models, with governance partly inherited from AWS and partly not.
IBM's platform for regulated industries, shipping its own governance tooling for model risk, though it does not itself cover accountability or board reporting.
The infrastructure layer beneath a self-hosted deployment rather than a chat platform itself, relevant mainly to organisations that own their own AI stack.
Assessment, implementation and training are delivered as one continuous service, not separate products bought one at a time. A recommendation with nobody to build the governance framework around it is not much use, and a governance framework built before the data and stack assessment is done is usually built on the wrong assumptions.
Classify the data each intended use case would actually touch, and identify the regulatory, contractual and confidentiality constraints that apply to it.
A data sensitivity classification and a regulatory constraint summary for the use cases in scope.
Review the organisation's existing Microsoft, Google, AWS or other cloud environment to identify the lowest-friction platform options genuinely available.
A technology stack compatibility summary against the realistic platform shortlist.
Match the data sensitivity and stack findings against the realistic platform options, and validate the selection with the business functions that will actually use it.
A platform recommendation with a documented rationale, ready for sign-off.
Put in place the acceptable-use policy, access controls, monitoring, staff training and incident response the chosen platform needs, then support rollout.
A governance framework, implementation plan and training programme, delivered through AI Implementation Services and Training.
This entire comparison only works if it stays genuinely neutral, so it is worth being explicit about how. INTAI does not start with a preferred AI vendor, and this page has not named a single "best" platform anywhere in it, because there isn't one: the right answer changes with every organisation's data, stack and regulatory position, as the sections above set out.
We help organisations assess and govern all nine platforms covered in this series: Claude, Microsoft Copilot, ChatGPT / OpenAI, Google Gemini, Meta Llama and other open-weight models, Perplexity, Amazon Bedrock, IBM watsonx, and Nvidia's infrastructure layer, alongside private and self-hosted deployments generally.
Recommendations are shaped by an organisation's requirements, risk profile and regulatory exposure, not by which platform or infrastructure we sell. Where a client has already committed to a platform, we work within that constraint and focus on making its use appropriately governed, effective and aligned with organisational requirements.
INTAI does not display or imply partnership, endorsement or certification badges from any of the technology providers referenced on this page unless genuinely held and explicitly stated. Prices, service names and specific figures referenced elsewhere on this page are indicative and subject to confirmation.
No. Compliance is a property of how a platform is configured, contracted and governed within a specific organisation, not a fixed attribute of the platform itself. A platform with a strong enterprise tier can still be poorly governed, and a platform with a thinner enterprise offering can still be used safely within a tightly controlled deployment.
Yes, and most established users of AI end up doing so. It is common for an organisation to run Microsoft Copilot for day-to-day Office-embedded work, a separate managed platform such as Claude or ChatGPT for specific teams, and a self-hosted model for a narrow category of genuinely un-shareable data, each governed under the same overall policy.
A structured platform selection typically takes between two and four weeks, depending on how many business units and use cases are in scope and how much of the data sensitivity and stack assessment already exists. It runs faster where a data classification exercise has already been done.
That is a common and entirely workable starting point. Where a platform decision has already been made, INTAI works within that constraint and focuses on the governance, access control and monitoring work needed to use it appropriately, rather than reopening a decision that has already been taken.
No. A higher-priced enterprise tier usually adds administrative controls, audit logging and stronger contractual terms, but those controls only govern anything once an organisation actually configures and monitors them. Paying for an enterprise tier and leaving it on default settings delivers very little of the governance the price implies.
This comparison is organised around the criteria a governance-first buyer needs, data sensitivity, existing stack and regulatory exposure, rather than around features or benchmark scores where vendors are more directly competing. INTAI does not hold or disclose paid vendor partnerships that would bias this comparison, and does not declare a single winning platform anywhere on this page.
No, deliberately not. The right platform depends on an individual organisation's data sensitivity, existing technology stack and regulatory position, and a generic best-platform answer would ignore all three. This page sets out the decision framework instead of a ranking.
Yes, the same decision order applies regardless of organisation size. A smaller business without a dedicated IT or procurement function usually benefits most from starting with whichever managed platform matches its existing email and office software, since that lowers the governance burden it has to build from scratch.
Generally no. Every platform covered in this series is adding capability quickly, and waiting for a specific feature to ship rarely changes the underlying data sensitivity or regulatory answer, which is what should drive the decision first. A missing feature today is a reason to revisit the choice later, not a reason to delay a governed decision now.
No, it is only the safest choice for the narrow category of data that genuinely cannot be sent to any external service. Self-hosting removes a vendor's safety tooling and support along with the vendor's data access, so it introduces its own governance burden and is generally a worse default for organisations whose data sensitivity does not require it.
No, not if the governance framework was built around principles rather than around one platform's specific settings. An acceptable-use policy, access control approach, monitoring process and training programme designed properly should transfer to a new platform with adjustment, not replacement.
Platform selection works best with input from IT or infrastructure, whoever holds data protection and compliance responsibility, and the business functions that will actually use the platform day to day, not IT or procurement alone. Leaving out the compliance or end-user perspective is one of the most common reasons a rollout stalls after launch.
Yes. Platform selection is one part of a wider service, not a precondition for the rest of it, so an organisation that has already picked a platform can go straight to the governance framework, implementation and training work described on this page.
AI platforms change their enterprise tiers, data handling terms and admin controls frequently, so treat the comparison table on this page as a structural guide to what to check rather than a permanently fixed snapshot, and confirm current terms directly with each vendor and with INTAI before finalising a decision.
No. INTAI is an independent AI governance consultancy and does not sell, resell or receive commission on any of the platforms compared on this page, which is why the comparison can be organised around an organisation's requirements rather than around a preferred vendor.
Whichever of the nine platforms above ends up being the right fit, the same governance work follows it. INTAI can help you work through the data sensitivity, stack and regulatory questions above and arrive at a platform recommendation matched to your organisation, then build the governance framework it needs.