Ask most small business owners why they added Microsoft Copilot and you'll hear some version of the same answer: "It's the GPT thing, built into Office." That mental model — Copilot equals ChatGPT inside Word and Excel — was accurate in 2024. In the middle of 2026, it quietly stopped being true, and almost nobody got the memo.
On January 7, 2026, Microsoft enabled Anthropic's Claude models by default for most commercial Microsoft 365 Copilot tenants in the public cloud. Not as an option you turn on — as the default. And starting August 2026, GitHub Copilot's default engine switches from OpenAI's GPT-4 Turbo to Project Polaris, Microsoft's own in-house coding model. The word on the box still says "Copilot." What's actually behind the curtain, reading your documents and your data, increasingly is not OpenAI at all.
This is not a hit piece on Claude, which is an excellent model, or on multi-model choice, which is genuinely a good thing. It's about a simpler question that every business signed a contract without asking: do you know which AI company is processing your data when you type a prompt into Copilot — and did you agree to that?
What Actually Changed — and When
Microsoft spent 2025 turning Copilot from an OpenAI reseller into a multi-model platform. That strategy came to a head this year with three concrete shifts most SMBs never saw:
- Microsoft 365 Copilot (Jan 7, 2026): Anthropic was onboarded as an official Microsoft subprocessor, and Claude models were enabled by default for most commercial tenants in the public cloud. The default was left off in the EU, EFTA, and the UK — a regional split that itself tells you Microsoft's lawyers saw a data-governance question here.
- Copilot Studio: OpenAI remains the default for newly built agents, but Claude Sonnet 4 and Opus 4.1 sit right next to it in the model picker. Which model your custom agent uses now depends on who configured it and what they clicked.
- GitHub Copilot (August 2026): Project Polaris, Microsoft's own mixture-of-experts model, replaces GPT-4 Turbo as the default engine. If your developers use Copilot, their default assistant is about to become Microsoft's model, not OpenAI's.
Put those together and the picture is clear. "Copilot" is no longer a product with a single brain. It's a brand layer sitting on top of OpenAI, Anthropic, and Microsoft's own models — with the default varying by product, by region, and by month. That is a legitimate engineering strategy. It is also a transparency problem for the business paying the bill.
Why "Which Model" Isn't a Nerd Detail
It's tempting to file this under "who cares, they're all good AI." For a hobbyist, fair enough. For a business that runs contracts, patient notes, financials, or client files through the tool, three things make the model identity matter a great deal.
1. Every model provider is a company that touches your data
When Claude became a default in Copilot, Anthropic became a subprocessor in your data supply chain — a new third-party company your prompts and the business content around them can flow to. Compliance teams exist to know exactly who those subprocessors are, because your own customer contracts, your DPA, and regulations like HIPAA and GDPR often require you to disclose and control them. A default that adds a vendor you didn't evaluate is precisely the kind of change a governance review is supposed to catch — and a default is designed to slip past that review.
2. Different models behave differently — on the same task
Think of it like swapping the engine in your delivery van without telling the driver. The van still drives, but the acceleration, the fuel economy, and the quirks all change. Models differ in tone, refusal behavior, formatting habits, and how they handle edge cases. If your team built prompts, templates, and expectations around one model and the default silently becomes another, your outputs drift — and you'll spend time debugging "why does Copilot write differently this week?" without realizing the engine was replaced underneath you.
3. "I'm buying OpenAI" may no longer be what you're buying
Plenty of businesses specifically chose Copilot because they wanted GPT-grade AI with Office integration. If the default has moved to Claude or Microsoft's own model, the original reason for the purchase may not hold anymore — and nobody sent a renewal notice explaining that. You can still select OpenAI in many places, but a default most users never change is, functionally, the product.
Give Microsoft Credit: Multi-Model Is Genuinely Smart
Balance matters here, so let's be fair. Microsoft's multi-model strategy is, on the merits, a good idea. Different models are better at different jobs — Claude is strong at long-document reasoning, OpenAI's newest models excel at agentic and coding tasks, and Microsoft's own models can be cheaper and faster for high-volume work. Routing each task to the best-fit model is exactly what a mature AI platform should do, and giving customers a choice beats locking them to one vendor.
Google is doing its own version of this, and even OpenAI offers different model tiers. The direction of travel across the whole industry is more models, more routing, more optionality. That's a win for capability.
The problem isn't choice. The problem is choice without visibility. Optionality is a benefit when you make the choice and can see the consequence. It becomes a risk when the platform makes the choice for you, changes it by default, region, and update, and the person whose data is being processed has no idea a switch even happened. Microsoft added the choice; what it didn't add was a clear, in-your-face answer to "who is reading this right now, and did we approve them?"
How ChatGPT Business Handles This Differently
This is where the architecture of ChatGPT Business is worth understanding, because it's the mirror image of the Copilot approach. It's not "better AI" in the abstract — it's a different, more transparent supply chain.
| Question | Microsoft Copilot (2026) | ChatGPT Business |
|---|---|---|
| Who makes the AI? | OpenAI, Anthropic, or Microsoft — depending on product, region, and default | OpenAI. One named provider, always. |
| Can the default change under you? | Yes — it already has, by region and by product update | No silent provider swap. You're on OpenAI models by design. |
| Subprocessors touching your data | Now includes Anthropic as a default in most regions | OpenAI's published subprocessor list — one AI vendor to review |
| Is your data used to train models? | Governed by Microsoft + each model vendor's terms | No. Business data is not used to train OpenAI's models by default. |
| Do you know which model answered? | Often not, unless someone checked the picker | Yes — you select the OpenAI model and see it |
| Newest OpenAI models | On Microsoft's integration schedule, behind a grounding layer | Day one, direct from OpenAI |
The point isn't that Anthropic or Microsoft models are unsafe — they aren't. The point is knowability. With ChatGPT Business, "which AI company is processing our data?" has one answer, it doesn't change without you knowing, and your compliance review has exactly one AI vendor to evaluate instead of a rotating panel. For a regulated business — a law firm, a healthcare practice, or a financial advisory — that single-answer clarity is not a nice-to-have. It's the difference between a defensible AI policy and a shrug.
What To Actually Do This Week
You don't need to rip anything out. You need to know what you have. Fifteen minutes gets you most of the way:
1. Find out your Copilot default
If you run Microsoft 365 Copilot, have whoever manages your tenant check whether Anthropic models are enabled by default and which model your users actually hit. If you're on GitHub Copilot, note that the default moves to Project Polaris in August. You can't govern what you haven't looked at.
2. Update your subprocessor list
If Claude is now a default in your Copilot, Anthropic belongs on your approved-AI-vendor list — and possibly in the disclosures you owe your own customers. Ask your compliance lead or attorney whether your existing contracts and DPAs cover it. This is the step almost everyone skips.
3. Decide on purpose, per workload
For general Office productivity where the model brand doesn't much matter, the Copilot default may be perfectly fine — take it knowingly. For workflows where you need a known, single, day-one-OpenAI stack — client-facing work, sensitive data, anything you'd have to defend in an audit — that's exactly where ChatGPT Business earns its place alongside or instead of Copilot.
4. Tell your team which tool to use for what
The worst outcome is silent, unmanaged AI use across three different model vendors nobody chose. A one-page "use this tool for this kind of work" policy beats a 40-page one nobody reads. Our breakdown of why ChatGPT Business is winning the SMB race is a good starting frame.
The Bigger Pattern: The Brand Is Not the Model
Zoom out and this is the real lesson of mid-2026: the name on the AI product no longer tells you which AI is inside it. "Copilot" is a wrapper. So is "Gemini for Workspace," increasingly. As every platform becomes a multi-model router, the questions that matter shift from "does it have AI?" to "which AI, chosen by whom, touching my data under what agreement?"
Businesses that treat AI as a checkbox — "yes, we have Copilot" — are going to get surprised by which vendor ends up in their data chain. Businesses that treat it as a supply-chain decision — naming the provider, controlling the subprocessors, deciding on purpose — are the ones who'll pass the audit and sleep at night. That's not an argument for one tool over another in every case. It's an argument for knowing. And when knowing is the goal, a single-provider, no-silent-swap tool like ChatGPT Business is the easiest thing in your stack to defend.
Microsoft's multi-model move is clever engineering. Just make sure you're the one deciding which engine is under your hood — not finding out during an incident.
Frequently Asked Questions
Partly. OpenAI models are still available in Copilot, but they are no longer the only — or, in many cases, the default — engine. As of January 7, 2026, Microsoft enabled Anthropic's Claude models by default in Microsoft 365 Copilot for most commercial tenants in the public cloud (the default is off in the EU, EFTA, and UK). Copilot Studio still defaults to OpenAI for new agents but offers Claude as an option, and GitHub Copilot's default engine switches to Microsoft's own Project Polaris model in August 2026. In short, "Copilot" is now a multi-model brand, and which AI actually answers depends on the product, your region, and the default in effect.
Three reasons. First, each model provider is a separate company that processes your data — when Claude became a default, Anthropic became a new subprocessor in your data chain, which may need to be disclosed or approved under your own contracts, DPA, HIPAA, or GDPR obligations. Second, different models behave differently on the same task, so a silent default change can shift the tone and quality of your outputs. Third, if you originally chose Copilot specifically to get OpenAI's models, a default that has moved to Claude or Microsoft's own model means you may no longer be buying what you thought. It's less about model quality and more about knowing and controlling who touches your data.
Yes. ChatGPT Business runs on OpenAI's models — one named provider, with no silent swap to a different AI company's model behind a brand layer. You select the OpenAI model you want and can see which one is answering. Business data is not used to train OpenAI's models by default, and OpenAI publishes its subprocessor list, so your compliance review has a single, stable AI vendor to evaluate rather than a rotating set of defaults. For businesses that need a defensible, knowable AI supply chain, that transparency is the core advantage.
No — Claude is a high-quality, widely trusted model, and this isn't a warning against using it. The issue is transparency and governance, not safety. The concern is that a capable model was made a default in a product many businesses bought for a different vendor's AI, which quietly added a new company to their data supply chain without an explicit decision. If you choose Claude deliberately and account for it in your compliance program, that's a perfectly sound choice. The risk is only when the choice is made for you and never surfaced.
Have whoever administers your Microsoft 365 tenant check the Copilot admin settings for whether Anthropic models are enabled by default, and look at the model picker inside the Copilot apps and Copilot Studio to see the active default. For GitHub Copilot, note the default engine moves to Microsoft's Project Polaris in August 2026. Then add any new AI vendors (like Anthropic) to your approved-subprocessor list and confirm with your compliance lead or attorney that your existing contracts cover them. If you'd rather not manage a moving target, an authorized OpenAI SMB Channel Partner like Sayfe.ai can help you stand up a single-provider ChatGPT Business workspace where the model is always known.
Key Takeaways
- Microsoft 365 Copilot has defaulted to Anthropic's Claude for most commercial tenants since January 7, 2026 — with OpenAI still available but no longer automatically in front.
- GitHub Copilot's default engine switches to Microsoft's own Project Polaris model in August 2026.
- "Copilot" is now a multi-model brand: the AI vendor processing your data can vary by product, region, and update — often without the user knowing.
- A default model change quietly adds new subprocessors (like Anthropic) to your data chain, which your contracts, DPA, HIPAA, or GDPR obligations may require you to disclose or approve.
- Multi-model choice is genuinely good — the problem is choice without visibility, where the platform decides and you can't see it.
- ChatGPT Business takes the opposite approach: one named provider (OpenAI), no silent swaps, data not used for training by default, and a single AI vendor for compliance to review.
- This week: check your Copilot default, update your subprocessor list, and decide per workload — on purpose, not by default.
Know Exactly Which AI Is Reading Your Business Data
Sayfe.ai is an authorized OpenAI SMB Channel Partner. We help small businesses stand up ChatGPT Business with a single, known model provider, SSO, admin controls, and a clean data agreement — live in 2–5 business days, with setup, training, and ongoing optimization included at no extra cost.
Get Started TodayAbout Sayfe.ai: Sayfe.ai is an authorized OpenAI SMB Channel Partner. We help small and medium-sized businesses implement and optimize ChatGPT Business, ChatGPT Enterprise, and the OpenAI API across 15+ industries. We're here to make enterprise AI accessible — and the data governance behind it clear — for teams of any size.