Claude Cowork for Business: What to Set Up First

Claude Cowork is the option next to Chat in Claude’s message box that does more than answer: Claude opens the files you choose, completes a task in several steps and returns the finished result. On Team and Enterprise plans, everyone with a seat already has it, unless an owner changed the setting.

The name will not stay: on 16 September 2026 Anthropic announced that it is merging this option into Claude itself. Team and Enterprise plans keep it for now. Most guides are written for one person at one desk. This one is for the company: what an admin controls, what the agent may touch, and what to decide before two hundred people use it.

PromptPartner deploys AI in mid-sized and larger companies in Europe. We roll out Claude Enterprise and ChatGPT Enterprise. Every product fact below comes from Anthropic’s own pages, checked on 7 October 2026. The product changes fast, so follow the links before you decide.

Key takeaways

The name is going away. Anthropic is merging Claude Cowork and chat into one Claude.^[6] On 7 October 2026, Team and Enterprise plans still had both.^[1]
The agent is on by default on Team and Enterprise plans. An owner can switch it off.^[1]
It has no price of its own.^[2] On Enterprise you pay for what it uses,^[9] and a task for the agent uses more than a chat question.^[2]
Anthropic says the chances of an attack are “non-zero”, and that you stay responsible for what the agent does.^[3]
Anthropic’s Privacy Center says the data of its commercial products is stored in the US.^[14] For sessions in its cloud, its security guide of 17 September 2026 says there is no EU data-residency option today.^[4]
Set up three things first: the rules, the connected systems with reading before writing, and one department.

What is Claude Cowork, and what happened to the name?

Claude Cowork is the part of the Claude app that completes a task for you, where chat only answers. In Anthropic’s words: “Claude works in the files and tools you choose and completes multi-step tasks from start to finish.”^[2] Since April 2026 it has been generally available on all paid plans.^[5] It runs in the Claude desktop app for Mac and Windows. There is also a beta in the browser, which on Enterprise an admin has to allow.^[1]

The name will disappear. In its announcement of 16 September 2026, Anthropic wrote: “Starting today, Claude Cowork and chat are merging into one Claude.”^[6]

For a company, the timing matters. The change goes to the personal plans first. On 7 October 2026 the help centre still said: “Team and Enterprise organizations keep chat and Claude Cowork as they are today”.^[1] There is no date for the business plans. Anthropic says that Team plans “will follow soon”, and that Enterprise admins will hear from it before anything changes.^[6] After the change, an account cannot return to two separate options.^[7]

So your people may see the old name for some time. In the rest of this guide we call it the agent: the part of Claude that completes a task in several steps, inside your files and tools.

The plans, the terms to know and the five steps of a rollout are in our guide to Claude for business.

What the agent does that chat does not

Chat answers a question. Claude’s agent finishes a task. Anthropic puts the difference in two sentences: “In regular chat, Claude responds to your messages but can’t access your files directly. In Cowork, Claude has permission to read, edit, and create files in folders you specify—so it can actually complete tasks rather than just describe how to do them.”^[2]

Chat compared with the agent on the same task: chat answers each prompt and you do the steps, the agent reads the folder, plans the work and delivers the finished memo

The task in the figure is an example from Anthropic’s product page: “Point Claude at a quarter of call notes and come back to a memo on where every open deal stands”.^[2]

Four things are different:

The agent works in folders on the computer. In the desktop app, “Claude can read from and write to your local files without manual uploads or downloads”.^[8]
It plans, and it takes several steps. Anthropic lists them: “Analyzes your request and creates a plan”, “Breaks complex work into subtasks when needed” and “Delivers finished outputs to your session”.^[8]
It works in the background. Anthropic’s Enterprise page says the mode is “for delegating complex tasks that run in the background”.^[9]
It can run on a schedule. “Scheduled tasks run in the cloud, so they don’t need your computer to be awake or the desktop app open.”^[8] Such a task is a session in Anthropic’s cloud, so the points on cloud sessions below apply to it.

One thing is not different. Chat can reach your company tools too: connectors, the links to your other systems, “work across Claude, Claude Desktop, Claude Code, and the API”.^[10]

Anthropic reports that “the vast majority of Claude Cowork usage comes from outside engineering teams”.^[5] It gives no figure.

Can a company trust Claude’s agent? What an admin controls

A company can trust Claude’s agent within limits that it sets itself. An owner of the organisation decides who has the agent, what it may do without asking and which systems it can reach. Anthropic also says plainly what is not solved.

The agent is on by default

Anthropic’s help centre says: “Claude Cowork is on by default, but organization owners can manually disable it.”^[1] Only an Owner or a Primary Owner can change this, in the organisation settings.^[1] So the question is not whether to switch the agent on. It is on, and somebody should decide what that means. The defaults differ by plan:

Source: Anthropic help centre, checked on 7 October 2026. Defaults can change. On Enterprise the built-in browser is on unless an owner switched it off. Organisations with the US health-data set-up (HIPAA) start with the agent off.
Setting	Team	Enterprise
The agent itself	On	On
Access for some teams only	Not offered	Yes, by group and role
Sessions in Anthropic’s cloud	On	Off
The built-in browser	On	On, since 10 Sep 2026
“Automatically approve” mode	Open to members	Open to members

What an owner can set

Who has the agent. On Enterprise, an owner can give it to certain teams only, with groups and custom roles. On Team there is one switch for everyone.^[1]
Which systems it reaches. No connector works until an owner switches it on, and then each person’s own rights apply. An owner can also allow reading and block writing, for the whole organisation.^[10]
What it may do without asking. Each person picks a mode. In “Manually approve”, “Claude pauses and asks for approval for actions.”^[8] In the loosest mode, “Claude doesn’t pause to ask and nothing checks its actions automatically.”^[8] The owner sets two limits: the mode “Automatically approve” can be removed for all members, and nobody can skip the approval for connector tools that write unless the owner allows it.^[1]
What Security can see. On Enterprise, sessions “are captured in the Compliance API”.^[1] On both plans, owners can send the agent’s events to their own monitoring tools. Anthropic adds a limit: “It doesn’t replace audit logging for compliance purposes.”^[1]

On both plans, the agent’s conversation data “isn’t used to train Claude”.^[11]

What Anthropic says is not solved

Hidden instructions in what the agent reads. Anthropic calls this a prompt injection attack. It “occurs when malicious instructions are embedded in external content that Claude reads as part of a legitimate task”.^[3] Think of a web page or an email with a hidden order in it. A hacked website shows you spam. A hijacked agent shows your mailbox and your CRM, the customer database. Anthropic is direct about the limit of its safety measures: “the chances of an attack are still non-zero”.^[3]
The responsibility stays with you. “You remain responsible for all actions taken by Claude performed on your behalf.”^[3]
For Europe: sessions in Anthropic’s cloud. A session can run in Anthropic’s cloud. Then even the local files it opens are “processed on Anthropic’s servers rather than staying on your computer”.^[3] For these sessions, Anthropic’s security guide of 17 September 2026 says: “Data is stored in US regions. There is no EU data-residency option today.”^[4] Cloud sessions are on by default on Team and off on Enterprise.^[1]
For Europe: sessions on the computer. With cloud sessions off, the work runs on the computer. The content still leaves it. The same guide says of a session on the device: “Every model request, including the contents of files Claude reads and screenshots it takes, is sent to Anthropic’s API.”^[4] And Anthropic’s Privacy Center says of its commercial products, such as Claude Enterprise: “Note that data is stored in the US.”^[14]
What an admin cannot manage today. The history of local sessions is stored on each person’s computer, and “admins cannot centrally manage or delete it”.^[1] On Enterprise, admins can retrieve it through the Compliance API. They cannot delete it yet.^[1] The security software on the laptop cannot see into a session. Anthropic tells companies that depend on such software to plan for this before the rollout.^[11]

This section summarises Anthropic’s public pages. It is not legal advice, and your own contract decides what applies to you. If storage in the EU is a fixed rule for you, our comparison of ChatGPT Enterprise vs Claude Enterprise shows what each vendor says about data location.

What the agent costs on Team and Enterprise

Claude’s agent costs nothing extra per seat on a Team or Enterprise plan. A seat is one person’s access. Anthropic’s product page says: “Claude Cowork is included in your Enterprise plan.”^[2] On Team it is “included in your Team plan standard and premium seats”.^[2]

These were the prices on 7 October 2026, in US dollars and before tax. A standard Team seat costs US$20 per month on annual billing, for teams of 2 to 150 people.^[12] Enterprise costs US$20 per seat per month, billed annually.^[12] It has a minimum of 20 seats. Usage is billed on top at API rates, which means by the amount of text Claude reads and writes.^[9]

What changes with the agent is the usage. Anthropic says: “Yes, agentic tasks consume more capacity than regular chat.”^[2] Our reading: on Enterprise, a task for the agent costs more than a chat question, and the bill follows use, not seats. On Team, the same task uses the seat’s allowance faster. Enterprise admins can set a budget for each team.^[5]

The plans side by side, and five steps to keep the bill under control, are in our guide to Claude Enterprise pricing.

What to set up first: rules, connected systems, one department

Before the whole company uses Claude’s agent, set up three things: the rules, the connected systems and one department. Anthropic publishes its own recommended settings in a security guide, version 1.3 of 17 September 2026. The guide says: “This is the configuration we recommend you review and start from. Deviations should be deliberate and written down.”^[4] It is stricter than the defaults in several places. Two matter here: who has the agent, and automatic approval.

Three things to set up first for Claude's agent in a company: the rules, the connected systems and one department, each with the default and Anthropic's recommended starting point

1. The rules

Legal, IT and your brand team set the rules once, at the start. That is how we build it: every later use case follows the same rules, without a new fight. For the agent, the rules answer three questions. Which data may go in? Which steps must a person approve? May sessions run in Anthropic’s cloud?

By default, automatic approval is available to every member. Anthropic’s guide recommends it off for most people, above all for those who mostly read content from outside the company.^[4] For cloud sessions, the guide’s starting point is “Decide explicitly”.^[4] The same guide also says: “Anthropic recommends cloud execution for the best results.”^[4] So the vendor prefers the cloud. Make this decision yourselves, and write it down. For a company in Europe, it changes where the work runs. It does not change where Anthropic stores data.

When should the agent ask every time? Anthropic’s answer: when “Mistakes would be hard to undo, like sending messages or making purchases.”^[3] The rules beyond the agent are in our guide to an AI governance framework for mid-sized companies.

2. The connected systems

Our rule for connected systems is: access and personal data under your control, read-only first. Read-only is more than advice. It is a setting, as shown above. Anthropic’s starting point says the same in four words: “Reads allowed, writes reviewed”. On which connectors to switch on, it says: “Only what the work needs.”^[4]

Start with the systems where the weekly work happens: the CRM, email, the calendar and the shared documents. A connector is a link to one of your tools. A skill is a saved instruction for a task that comes back every week. Both are explained in Claude for business.

3. One department

We start with one department, often go-to-market. It already holds two or three teams, which is the pilot size that Anthropic’s rollout guide recommends.^[13] How to pick the first teams is in Claude for business. On Enterprise, Anthropic’s starting point for access is: “Turn the org default off and grant by role.”^[4] On Team there is no switch per department. There, this department gets the seats and its connectors first. That last point is our reading, not Anthropic’s.

While we build, we train your people in weekly office hours. Then more teams, on the same rules: Legal, Finance, HR, R&D, Manufacturing.

An example from PromptPartner’s own work: at a European software company above €100 million ARR, we shipped five working tools into the systems the team already used. One of the tools turns a week of work on customer collateral into minutes: a rep asks for on-brand material for a deal, and it is ready. The speed doesn’t come from a chat window; it comes from governed access to the systems. That rollout took longer than four weeks. Read the case study.

If you do not yet know which tasks to give to the agent, measure first. PromptPartner’s AI assessment takes four weeks and has a fixed price, set by the size of your company and by whether it covers one department or several. You can stop there. After the assessment, the standard programme rolls out Claude Enterprise on a governed foundation, with use cases for one department and training for your team. See what a Claude Enterprise rollout includes, or how the assessment works.

Frequently asked questions

What does Claude Cowork actually do?

It completes a task of several steps in the files and tools you choose, and returns the finished work. In chat, Claude answers and you do the steps. Here Claude makes a plan, does the steps and delivers the result for you to check.

Is Claude Cowork free?

No, not on 7 October 2026. It is available on paid plans only: Pro, Max, Team and Enterprise. In a company it is part of the Team or Enterprise seat, with no extra fee per seat.

How do I get Claude Cowork?

On a Team or Enterprise plan it is on by default, unless an owner switched it off. People select it in the message box of the Claude app. Work in folders on the computer needs the desktop app for Mac or Windows.

Can I trust Claude Cowork?

Within limits that you set. An owner decides who has it, what it may do without asking and which systems it reaches. Anthropic says the chance of an attack is not zero, and that you stay responsible for what the agent does.

How much does Claude Cowork cost for Enterprise?

It has no price of its own. On 7 October 2026 an Enterprise seat cost US$20 per month, billed annually, with a minimum of 20 seats. Usage is billed on top at API rates, and a task for the agent uses more than a chat question. Prices are before tax and can change.

Is Claude Cowork worth paying for?

In a company there is nothing extra to pay per seat. On Enterprise you pay for what the agent uses. Our view: it is worth it when a team has tasks that come back every week and the agent can reach the systems those tasks need.

Which is better, Claude or Claude Cowork?

Neither. They are one app. Chat answers a question, and the agent completes a task. Anthropic announced in September 2026 that it is merging the two, so the choice disappears.