Copilot vs ChatGPT vs Gemini: a rollout checklist

At some point you'll be asked which AI assistant the organisation should use, or whether the one it already has is the right one. The usual candidates are Microsoft Copilot, ChatGPT and Gemini, and there are others worth a look. Plenty of articles will tell you which is best. Ignore them. Plans, prices, features, data terms and certifications change often, and an article's verdict reflects whoever wrote it, for whatever organisation they had in mind.

This playbook deliberately doesn't tell you what any vendor offers. It tells you what to ask, how to check the answers against your own needs, and how to roll out whatever you choose. Fill in the facts yourself from each vendor's current documentation and from your account team, and date them.

Step 1: start from your situation, not the tools

Before looking at any vendor, write down the things that will actually decide this. Most organisations find it comes down to a handful:

• Where your work lives. Which email, documents, chat and file storage you use. An assistant that sits inside the tools people already have open behaves very differently from one in a separate window.
• Your first three workflows. What people will actually do with it first. If you haven't chosen them yet, do that first (see Picking your first three workflows).
• Your data constraints. What your usage policy, contracts and regulators require. Get this from legal and security, not from a vendor.
• Your identity and admin set-up. How you manage accounts, single sign-on and device policies today.
• What's already in use. Licences already bought, pilots already running, and what people are using unofficially.
• Budget and who holds it. Not the number, but who decides and on what cycle.

You'll often find this narrows things before you've compared a single feature.

Step 2: questions to ask every vendor

Ask each vendor the same questions, in writing, and ask them to point you to the documentation that supports each answer.

Data and privacy

- Is our content (prompts, files, outputs) used to train or improve your models? Under which plan, and is that the default or a setting?
- Where is our data processed and stored? Can we choose the region?
- How long is content retained, and can we change that?
- Who at the vendor can access our content, and under what circumstances?
- Which sub-processors are involved?
- What does your data processing agreement cover, and how do we get it?

Security and compliance

- Which independent certifications or audit reports do you hold for the plan we'd buy, and can we see them under NDA?
- How do you handle a security incident affecting our data, and what will you tell us, when?
- What logging is available to our admins, and for how long?

Identity and administration

- Does it work with our identity provider and single sign-on?
- Can we provision and remove users automatically?
- What can admins control: which features are on, which integrations are allowed, file uploads, sharing?
- Can we restrict use to managed devices or accounts?

Integrations and access

- What can the assistant connect to in our environment: email, documents, chat, internal systems?
- When it connects, whose permissions does it use? If a user can technically see a file, can the assistant surface it?
- Can we turn integrations on selectively, per team?

Commercial

- What plans are available for an organisation our size, and what's in each? Get this in writing, dated.
- What's the minimum commitment, and how do we add or remove seats?
- What changes have you made to plans or terms in the last year, and how much notice do you give?

Support and roadmap

- What support do we get, and what's the response time?
- What admin and user training is included?
- How do you tell customers about changes to features, defaults or terms?

Step 3: fill in the comparison template

Put the answers side by side. Copy this into a spreadsheet and fill it in from each vendor's current documentation and written answers. Add a source and date to every cell.

Then ask security and legal to review the data and compliance rows. They're better placed than you to say whether an answer is good enough.

Step 4: run a short pilot on real work

Feature lists don't tell you how a tool performs on your work. A short pilot does. A workable shape:

• Two to four weeks, depending on how often the workflows happen.
• Your first three workflows, so you're testing what you'll actually roll out.
• Five to ten people per tool, ideally doing the same workflows, so you can compare.
• Real material, within your usage policy.
• A baseline for each workflow before the pilot starts (see Measuring time saved honestly).

For each tool and workflow, record:

• Time to a usable output, including checking
• How much editing was needed, on a simple three-point scale: little, some, a lot
• Anything that went wrong: invented content, missed context, formatting problems
• What people preferred and why, in their words

Ask security to run their own checks during the pilot: admin controls, logging, how permissions behave in your environment. Their findings go in the template too.

Step 5: decide, and write down why

Make the decision with your sponsor, IT and security in the room. Write a one-page decision note:

Decision: [tool, plan]
Why: [three or four reasons, linked to your situation and the pilot]
What we gave up: [what the other options did better]
Conditions: [settings, restrictions, things security require]
Review date: [when we'll check this is still right]

Step 6: roll out in stages

Once you've chosen:

1. 1

   Step 1: Configure before you invite.

   Admin settings, integrations, retention and logging, agreed with security.

2. 2

   Step 2: Update the usage policy

   to name the tool and the account people should use.

3. 3

   Step 3: Start with the pilot teams

   , then the teams behind your three workflows. Don't open it to everyone on day one.

4. 4

   Step 4: Run live sessions on real work

   for each team as they join, and give them a one-page guide for their workflow.

5. 5

   Step 5: Set up a help channel

   and champions in each team before you widen access.

6. 6

   Step 6: Widen access in waves

   , each one a few weeks apart, adjusting the guides as you go.

7. 7

   Step 7: Measure the first three workflows

   against their baselines and report.

8. 8

   Step 8: Review the decision

   on the date you set, against the same template.

Mistakes to skip

• Choosing from a demo. Demos use the vendor's material. Pilots use yours.
• Copying an online comparison. It's out of date and written for someone else.
• Trusting verbal answers on data handling. Get them in writing with a link.
• Rolling out to everyone at once. You'll be answering the same basic questions for weeks.
• Running two tools indefinitely "to keep options open". It doubles your training, guides and support. Pick one per job.
• Never reviewing. Terms and features change. Put the review in the calendar.

At the end you should have

• A short statement of what matters for your organisation
• Written answers from each vendor, with documentation links
• A completed comparison template, every cell sourced and dated
• Pilot results on your three real workflows
• A one-page decision note, including what you gave up
• A staged rollout plan with configuration agreed with security

The Role Book picks up after the decision, with the rollout sessions, workflow guides and champions network that turn a licence into a habit.