ChatGPT Deep Research: Source Control for SMEs

Deep research in ChatGPT is a research workflow, not an automatic truth engine. Choose the sources it may use, inspect every citation and keep the decision with a person.

What deep research actually does

Deep research is a mode inside ChatGPT that runs a multi-step task rather than answering a single prompt. You describe the question, it may ask a few clarifying questions, then it searches the web, opens pages, reads them and writes a report with citations. At the time of writing the number of runs per month depends on your plan, so check the OpenAI help pages before you promise the output to a client.

For a UK small business this is useful for supplier comparisons, market summaries, regulatory background and competitor research. It is not a substitute for reading the primary source on anything you will act on, sign or publish.

The important point for source control is that the model chooses where to look. If you do not tell it which sources count, it will treat a forum post and a government page as roughly equal evidence and cite whichever supported the sentence it was writing.

Set the source boundary in the prompt

You cannot fully lock deep research to a list of domains, but you can steer it strongly. Put the boundary at the top of the prompt, not at the end.

1. Name the sources that count. For a compliance question: gov.uk, ico.org.uk, ncsc.gov.uk and the regulator's own site. For a product question: the vendor's documentation and release notes.
2. Name the sources that do not count. Say plainly that Reddit threads, content-farm blogs, affiliate review sites and anything undated must be excluded or flagged separately.
3. Ask for dates. Require the publication date next to every citation, and ask it to say when a page has no visible date.
4. Ask for quotations. Where a claim matters, ask for the exact sentence from the source, so you can search for it when you open the page.
5. Ask for a gaps section. Tell it to list every claim it could not support with a named source. That section is often the most useful part of the report.

Protect what you put in

Deep research reads what you give it. Attached files and pasted text become part of the run, and the report may quote them. Before you attach a customer contract, a payroll export or a supplier's confidential proposal, ask whether the question really needs that document.

Use a business workspace (ChatGPT Team or Enterprise) rather than a personal account for anything involving customer or staff data. Business workspaces do not use your content to train OpenAI models by default. Check the current data controls page for your plan rather than relying on a colleague's memory of the setting.

If the research question itself is sensitive, for example a possible acquisition or a redundancy plan, treat the prompt as confidential as well. A prompt written for one person's account is not visible to admins in the same way as a shared file.

Review the report before anyone acts on it

Set a rule: a deep research report is a draft until a named person has checked it. The check does not need to be long, but it must be real.

• Open every citation that supports a number, a date, a legal duty or a price. Confirm the page says what the report says it says.
• Look for citations that support a weaker claim than the sentence they are attached to. This is the most common failure: the source is real, the inference is not.
• Check the date. A correct 2023 fact about a product may be wrong in 2026.
• Delete or mark anything you could not verify. Do not leave it in the document with a smaller font.
• Record who checked it and when, in the document itself.

For research that feeds a board paper, a bid or a regulated decision, keep the final report next to the prompt and the list of sources that were checked. That is the audit trail if the decision is later questioned.

Decide who owns the final call

Deep research shortens the reading. It does not carry responsibility. Put the approver in writing before the first run: who signs off a supplier shortlist, who approves a compliance statement and who may publish research externally.

If your team is starting to depend on AI research for decisions, an AI governance review can turn these habits into a short policy with owners and a review date. If you want to test how ready the workflow is first, use the AI workflow readiness assessment.

A practical pattern for a small team

1. One person writes the question and the source boundary.
2. Run deep research once. Do not re-run until you have reviewed the first result.
3. Reviewer opens the citations that matter and marks each one confirmed, weaker than claimed or not found.
4. Fix or remove the failed claims. Re-run only the specific gap, not the whole report.
5. Approver signs off. Store prompt, report and review notes together.

The whole loop usually takes less time than the old research did. The difference is that you can show your working.

Source basis

• OpenAI: deep research (developer documentation)
• OpenAI: web search tool documentation
• Government generative AI framework