ChatGPT Enterprise vs Microsoft 365 Copilot vs Custom RAG: Which Should a DACH Company Buy?

Short version for a company in Austria, Germany, or Switzerland: buy Microsoft 365 Copilot if you already live in Microsoft 365 and the value is in your Exchange, SharePoint, and Teams data. Buy ChatGPT Enterprise if you want the strongest general assistant and your data is spread across many tools, not just Microsoft. Build a custom RAG system only when you need control none of them give you: residency on your terms, permission-aware retrieval over a proprietary corpus, or model portability, and you have the engineering to maintain it. None of the three is "GDPR compliant" on its own. You stay the controller, and the contract, not the marketing page, decides whether you are covered.

This is a procurement and engineering view, not a vendor pitch. We build and roll out all three for clients, so the comparison below is about fit and trade-offs, not about which logo we like. Prices and data terms are current as of mid-2026 and move often; verify the linked vendor pages before you sign.

The comparison at a glance

The dimensions that actually decide this, side by side. Treat every figure as mid-2026 and re-check it.

One caveat that matters for a DACH audience and is easy to miss: Microsoft now uses some Anthropic models inside Copilot, and those are out of scope for the EU Data Boundary and in-country processing commitments. If a strict data-location story is the reason you chose Copilot, confirm which features route to which models.

ChatGPT Enterprise

The strongest general-purpose assistant of the three, and the most flexible about where your data lives across tools. OpenAI does not train on business data by default, you own your inputs and outputs, and retention is admin-controlled. It carries SOC 2 Type 2, ISO 27001, a data processing agreement for GDPR, and a BAA for health data. EU data residency arrived for storage at rest in February 2025 and expanded to in-region inference in Europe in January 2026, though the granularity is "Europe," not a named Austrian or Swiss data center. The honest gap: OpenAI does not publish ChatGPT Enterprise pricing. The figures you will see quoted around 60 dollars per seat with a 150-seat minimum are third-party estimates, not official, so treat them as a starting point for a sales conversation rather than a fact.

Microsoft 365 Copilot

If your work already happens in Microsoft 365, this is the path of least resistance, because the value is grounding answers in your own Exchange, SharePoint, and Teams data, trimmed to what each user is already allowed to see. The Enterprise add-on is 30 dollars per user per month paid yearly and requires a qualifying base license such as E3 or E5; the Business tier is cheaper but capped at 300 users; and Copilot Chat is included at no extra cost with eligible subscriptions. Prompts, responses, and the data Copilot reaches through Microsoft Graph are not used to train foundation models and stay within the Microsoft 365 service boundary, which runs on Azure OpenAI rather than the public ChatGPT service. The real risk here is not the model, it is oversharing: Copilot will happily surface anything a user technically has access to, so if your SharePoint permissions are a mess, Copilot makes that visible fast. Clean up permissions and sensitivity labels before rollout, not after.

Custom RAG

Building your own retrieval system is the right call when none of the products give you the control you need: full residency on your terms, permission-aware retrieval over a corpus that is not in Microsoft 365, or the freedom to swap models and avoid lock-in. It is also the most work. As a rough guide from real projects, a proof of concept lands somewhere around 6,000 to 25,000 euros, a production MVP around 17,000 to 80,000, and a self-hosted enterprise setup with SSO and compliance from 80,000 upward; treat these as directional, not quotes. The cost driver is almost never the model. It is data cleaning, access control, and integration, which routinely eat 30 to 50 percent of the budget. The single hardest part is permissions: enforce them at the retrieval layer with metadata filters before the search runs, not bolted on in the app afterwards. We go deep on that in our RAG production-readiness checklist for the EU.

There is also a middle ground worth naming: tools like Microsoft Copilot Studio and Azure AI Foundry, or OpenAI's agent tooling, let you customize and ground a managed product without building retrieval from scratch. That is often the pragmatic answer when "buy" is too rigid and "build" is too much.

How to choose

Pick by the constraint that actually binds you, not by which demo was shiniest.

1. Choose Microsoft 365 Copilot when you are already on M365 E3 or E5, the value is grounding in Exchange, SharePoint, and Teams, and EU Data Boundary plus Purview governance covers your data-protection bar. Accept the Multi-Geo, web-query, and Anthropic-model exclusions, and clean your permissions first.
2. Choose ChatGPT Enterprise when you want the strongest general assistant and frontier models, your data lives across many SaaS tools rather than just Microsoft, and "Europe region" residency plus a signed DPA satisfies your requirements.
3. Build custom RAG when you need residency or sovereignty on your own terms, permission-aware retrieval over a proprietary corpus, or model portability, and you have or will hire the engineering and MLOps to carry the maintenance.
4. Start smaller than you think. For most teams the right first move is Copilot or ChatGPT Enterprise plus a focused enablement push, and a custom build only once a specific high-volume workflow clearly justifies it. We describe that order in how to roll out AI internally in 2026.

"None of these tools is GDPR compliant by itself. You are the controller. The product gives you the building blocks, a DPA, a data boundary, admin controls, and your job is to assemble them into something defensible. The buying decision is the easy half."

The DACH data-protection part you cannot skip

Whichever you pick, you remain the data controller, and that means a few things are not optional. You need a lawful basis under Article 6, a signed data processing agreement under Article 28 (an AVV) before any personal data flows, a valid transfer mechanism, and a data protection impact assessment for higher-risk uses. The EU-US Data Privacy Framework has provided adequacy since 2023, but a challenge is working through the EU courts, so treat it as provisional and keep standard contractual clauses as a fallback. Switzerland needs a framework-certified recipient, SCCs, consent, or EU and Swiss hosting. And a hard line for staff: the free and Plus consumer tiers of ChatGPT have no DPA and are not suitable for company personal data. If people are pasting customer data into a personal account, that is the first thing to fix, before any of this comparison matters. Residency itself is a deep topic we cover in EU data residency for AI apps in 2026.