Is Copilot the same as ChatGPT?

Same category, named together by a Canadian source

Canada’s Canadian Centre for Cyber Security describes large language models as “a subset of generative AI that has seen significant improvement in recent years,” and names examples directly: “several LLMs (for example, Microsoft’s Copilot, OpenAI’s ChatGPT and Google’s LaMDA)… have gained the world’s attention.” (Canadian Centre for Cyber Security, ITSAP.00.041)

Both products, in other words, are built on the same underlying kind of technology, described by the same federal source in the same sentence — the brand name on the interface does not put them in different technical categories.

What actually differs: what each one can see

Microsoft’s own documentation describes Copilot as a system that “uses content in Microsoft Graph to personalize the responses with a user’s work emails, chats, and documents,” and that it “only shows the data that users have permission to access.” (Microsoft Learn, What is Microsoft Copilot?)

A standalone ChatGPT account is not wired into a company’s Outlook, Teams or SharePoint the same way unless someone deliberately connects it. So the same category of underlying model can give very different, and differently risky, answers depending on what it has been given permission to read.

Why that difference is the one that matters legally

Whichever tool ends up grounded in a Canadian business’s own customer or employee records becomes a processor question under PIPEDA, regardless of brand. Schedule 1, clause 4.1.3 of the Act is explicit: “an organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing.” (Personal Information Protection and Electronic Documents Act)

That obligation attaches to whichever tool your data actually flows into, under whatever contract governs it — not to the tool’s name or how well-known it is.