ChatGPT for Word Is On by Default and IT Has Some Homework

As of Oct. 1, ChatGPT for Word is switched on by default in ChatGPT Business, Enterprise and Edu workspaces, the company-managed versions of ChatGPT. The add-in, a tool that plugs into Word, lets employees draft, edit, summarize and format documents from a sidebar in Microsoft Word.

Some companies already give certain staff Microsoft 365 Copilot and are considering cheaper AI tools for everyone else. ChatGPT for Word could fill that role, but it brings its own questions about access, cost and data. Experts say companies that haven't yet decided should do so now.

Who Gets ChatGPT for Word by Default

The default applies at the workspace level. "Workspace admins can turn ChatGPT for Word on or off in the ChatGPT admin console,” according to OpenAI's Word documentation. The admin console is where IT staff manage the company's ChatGPT settings, and admins can change the setting at any time. Microsoft 365 admins must also allow the add-in before it appears in Word.

Individual plans work differently. Users on free and personal paid plans install the add-in themselves through Microsoft Marketplace. That means employees may be able to use it with personal accounts unless their company restricts add-ins.

The Rollout Started Without You

Companies that didn't act before Oct. 1 have accepted OpenAI's default plus whatever their Microsoft 365 add-in settings already allowed, said Jose Lejin P J, a principal member of technical staff at Salesforce who designs AI and security platforms. "If you have not decided, you have not paused the rollout," he said.

Lejin P J recommends putting three decisions in writing: whether the tool is allowed, who may use it and with which ChatGPT account they must sign in. The next step is to name an owner and make sure the ChatGPT and Microsoft 365 settings match.

IT teams should also settle on what kinds of documents the tool can be used and the budget, said Dmitry Zarembo, head of AI business at Innowise. Someone should own the rollout, added Rich Pleeth, CEO and co-founder of Finmile. Otherwise, access follows unreviewed settings, he warned.

A useful first step is to check which types of ChatGPT accounts employees already have, added Omair Manzoor, founder and CEO of security firm ioSENTRIX.

ChatGPT Isn't a Cheaper Copilot

Treating ChatGPT for Word as a lower-cost version of Copilot is a mistake, according to Lejin P J and Pleeth. Copilot is a Microsoft 365 feature priced per user, and paid versions have access to company data within Microsoft's security controls. ChatGPT for Word is a separate OpenAI add-in for drafting, editing and summarizing.

Budgeting the two as substitutes can leave a company with two AI assistants, two sets of admin controls and no way of knowing which one worked on a given contract, Lejin P J said.

What each tool can see also matters. ChatGPT for Word works mainly on the open document, while Copilot can pull in email, SharePoint files and Teams chats, Lejin P J said. For regulated work, that narrower reach can be an advantage because less company data is exposed, as long as the document is allowed to leave the company under its OpenAI contract. It becomes a problem if employees paste in extra files to make up for the missing context.

How much the add-in can reach depends on setup, Pleeth cautioned. Depending on permissions and settings, OpenAI says supported apps can bring in information from services such as SharePoint and Google Workspace, so buyers should test what their own configuration can retrieve.

Pleeth also suggests comparing the tools on real tasks and counting the time staff spend checking the results. "A lower software bill isn't much of a saving if the team has to rebuild the context every time," he said.

The Personal ChatGPT Account Problem

Personal accounts are the main security concern. "A company document being open in Word doesn't tell you which ChatGPT account is processing it," Pleeth said.

The add-in runs inside Word but signs in to ChatGPT, a separate login system from the company's Microsoft 365 setup, Manzoor explained. "Every document opened with a personal account is corporate data flowing to a consumer AI service outside your data protection agreements," he said.

In the security reviews Manzoor’s firm runs, employees using AI tools through personal accounts is one of the most common findings, and it is rarely deliberate. The usual Microsoft 365 app controls won't stop an add-in that signs in to an outside service, he said, so companies should block the add-in for anyone without an approved company ChatGPT account.

Several layers of control work best, Lejin P J said. Companies should require employees to sign in with their work login, turn off personal sign-in where possible and stop users from installing Office add-ins themselves. Blocking the personal route works better than relying on training, he said.

Controls also need testing. OpenAI offers ChatGPT Enterprise customers a workspace blocking feature that shuts off access to personal ChatGPT workspaces. Companies should confirm with OpenAI that it covers the Word add-in and test it on a company device, Zarembo advised. If a company can't enforce which account is used, it should limit the rollout until it can, Pleeth said.

One Owner, Two Consoles

Because OpenAI and Microsoft each control part of the setup, responsibility can fall between teams. "Give it one owner, two operators,” advised Lejin P J.

Under that model, the security or IT architecture team owns the decision, the ChatGPT admin runs the OpenAI settings and the Microsoft 365 admin decides whether the add-in appears in Word. A one-page chart setting out who does what stops either side from making changes alone.

Without it, one team may switch the tool off while someone installs it anyway, or each side may blame the other when it doesn't work, Lejin P J warned.

Budgeting for Tokens

ChatGPT is enabled by default, but it isn’t free, and cost is harder to predict than a per-user fee. OpenAI bills Word use by tokens at its standard developer rates. Word also draws from the same shared allowance as Codex, OpenAI's coding tool, and other premium features.

To control costs, Lejin P J recommends setting a monthly token budget, limiting which models employees can use and setting alerts on the shared allowance. Estimates should come from a short pilot on real documents, not from the number of users.

The budget also has to cover more than Word. "Since the token quota is shared between Word and Codex, using ChatGPT for Word reduces the resources available for Codex; the budget should account for usage across both areas," Zarembo said.

Usage should be reviewed across both, agreed Pleeth. "Otherwise, one team's new writing habit can eat into another team's capacity," he said.

When Defaults Keep Changing

OpenAI isn’t alone. Box made its ChatGPT and Claude integrations added by default on Sept. 8, and Google's notebooks in Gemini are on by default for organizations.

The usual process, where employees request a tool and IT reviews it, doesn't work when vendors add AI to tools a company has already approved, Manzoor said. "Your approved tool on Monday may have capabilities on Tuesday that you'd never have sanctioned independently," he said.

Manzoor recommends keeping a list of every software service in use, watching vendor release notes for AI features that switch on by default and having a standing policy to turn new AI features off until they are reviewed.

"Default on means silence is consent," Lejin P J said. New AI features in office apps should get the same review as a new software purchase: where the text goes, whether it is used for training, who can sign in and what it will cost.

Someone should also be responsible for vendor changes, not just new purchases, Pleeth said. Each change should be tested on a small group first, with a way to turn it off. "A supplier changing a default shouldn't quietly become your company's decision about how staff use customer information," he said.