Google Chrome Enterprise: Costs and Core vs Premium

Ask your IT team how many browsers run across your company and they probably won't know for sure. Some people use Chrome, some stuck with Edge, and someone installed Firefox years ago.

Yet that one window holds your CRM, email, documents and an AI assistant. Here's what Google Chrome Enterprise does about it, what it costs and which tier you need:

• What Core (free) and Premium ($6 per user a month) each do
• Five questions to test whether Premium is worth it
• What Gemini in Chrome changes, and what to check today
• Our rollout order, with two example projects

Why Is the Browser Where Your Data Leaks?

Picture a sales rep planning a campaign. They open the CRM, copy last year's client list and paste it into a public AI tool to draft an email. It takes fifteen seconds, and they aren't doing anything wrong, they're just doing their job.

Now count how many of your security tools saw those names leave. The antivirus missed it because nothing was downloaded, the spam filter because no email was sent, and the firewall because it only saw a connection to a legitimate website. The backup noticed nothing because nothing was deleted.

It all happened inside the browser window, and none of those tools look inside it. Ten years ago that list would have left on a USB drive, an email attachment or a printed page, and each of those leaves a trace. A copy and paste leaves nothing.

The same goes for a contract uploaded to an online translation tool, a price list exported to a personal spreadsheet or a project document shared from a private account. People do these things to work faster, and your current security setup can't see any of them.

So once most of your work happens on the web, the browser becomes a management layer in its own right, sitting right where people meet data. Chrome Enterprise brings policies, reporting and protection into that layer.

What Is Google Chrome Enterprise?

Google Chrome Enterprise is the set of management and security features that lets IT run the Chrome browser centrally. It works by applying company policies and reporting from the Google Admin console. SMBs use it to see what runs on company machines and to stop data leaving through the browser.

It isn't a different browser. It's the same Chrome your team already uses, with two tiers on top: Chrome Enterprise Core for managing and monitoring, and Chrome Enterprise Premium for advanced control over data, threats and access.

What Does Chrome Enterprise Core Do, and What Does Premium Add?

Core is free. You switch it on by registering company browsers in the Google Admin console, the same one you use for Gmail if you run Workspace.

From there you decide which extensions people can install, when updates are forced and which profiles can sync company data. You also see what's really running on your machines, which IT managers tend to underrate. The first full list of installed extensions is usually a nasty surprise.

Premium works on a different level. It doesn't manage the browser, it protects what passes through it:

• Data rules read content as someone moves it and stop the single action, whether that's a copy, paste, upload, download or print
• Threat protection scans sites and files in real time, including newly created ones that no blocklist knows about yet
• Context-aware access decides whether that person, on that computer, can open that application
  

One mix-up is worth clearing up. BeyondCorp Enterprise isn't something you add to Premium, because Premium is built on the BeyondCorp security model and its capabilities now sit under the Chrome Enterprise name. If a supplier quotes the two as separate lines, ask why before you sign.

You can also try Premium free for 60 days with up to 5,000 users. It isn't a guided demo, it's your real domain with your real data in it. Google explains the steps on its Try or buy Chrome Enterprise Premium page.

Do You Need Premium? Five Questions to Ask

There's no universal threshold. Two companies of the same size can need very different things, depending on their apps, the data they hold and how people work. You don't need a formal risk assessment, just five honest answers.

Does your most important data pass through a browser tab?

If your core system is still installed software and your files sit on a server in the office, Core is enough and Premium would solve a problem you don't have. If client records, quotes, price lists and contracts live in web apps, the browser is exactly where that data can leave, and Premium guards that exit.

How many people handle your data on computers you don't manage?

This one tips the scales most often. Consultants, agencies, professional firms and temporary staff open your systems from their own laptops, so you can't install anything or enforce antivirus on them. Premium's protection lives in the browser and follows the work account, so it still works on a machine you don't manage, which makes it the case where you spend least and cover most.

Do you know which AI tools your team uses?

If the answer is no, you have a Shadow AI problem: people using AI tools the company doesn't know about. With Premium you can first see who uses what, and only then stop specific information reaching those platforms. The most common mistake is doing it in the wrong order, because blocking in the dark leaves you with no answer for the people who complain.

Are you running a VPN just so people can reach three web apps?

A VPN for reaching servers in the office will keep earning its place. If it only exists to get people into apps that already live on the internet, you're paying for complexity you don't need. Context-aware access looks at who the user is, how healthy their computer is and where they're connecting from, then decides case by case, with no tunnel and nothing to install.

Do you have rules about where your data ends up?

Healthcare, financial services, legal firms and public bodies all know this one. The question isn't whether Premium is good value, it's whether you can prove the control you claim to have when an inspector asks. The same applies to AI, and the next section has some uncomfortable news on that.

If you want to know which tier fits your risk profile, let's start from the data you handle.

What Does Gemini in Chrome Change, and What Should You Decide Now?

In 2026 Gemini became a permanent part of Chrome, as a side panel built on the Gemini 3 and 3.1 models. It reads the page you have open, reasons across several tabs and connects to Gmail, Google Calendar and Google Drive. You get summaries, comparisons and drafts without switching apps.

Two features on top of that are worth knowing as they really are, not as they're marketed.

Auto Browse is the part that acts on its own. Gemini navigates, clicks, fills in forms and finishes multi-step tasks, shows you the plan first and stops to ask before sensitive steps like logins and payments. It's impressive, but it currently needs a Google AI Pro or Ultra subscription, started in the US and has a daily cap, so check it's available to your people, in your language and country before you build a process on it.

Skills (which arrived in April 2026) matter more in a business precisely because they're less flashy. You save a prompt that works and reuse it in one click on any page or across several tabs, and there's a library of ready-made ones to adapt. A recurring contract review, a supplier comparison or a candidate summary becomes a repeatable procedure instead of a different request from each person with a different result.

Now the part to check today, not next month. Gemini in Chrome runs on two settings that both have to be on: the Gemini app service in the Admin console and the GeminiSettings policy in Chrome. Both are on by default, so on your domain it's probably already available and nobody ever decided that it should be. Google's Gemini in Chrome admin guide shows how to set it per group.

If you're in a regulated sector, there's an uncomfortable detail. At launch, Gemini in Chrome wasn't covered by the HIPAA, SOC and ISO certifications that apply to Gemini as a core Workspace service. Put that on the table before you switch it on, not after the first inspection.

The power2Cloud Playbook: Rolling Out Chrome Enterprise in Seven Steps

You can find the technical settings in Google's documentation. What it doesn't tell you is the order to do them in, and the order decides whether the project holds or gets switched off after three weeks of complaints. This is the sequence we use.

Step 1. Standardise first. With three browsers running, any control you switch on covers part of the traffic and leaves the rest open. Declare which browser is the company one, manage it properly and treat the others as logged exceptions.

Step 2. Take inventory before writing any rules. Register the browsers with Core, wait two or three weeks and read the reports before you block anything. Finding out that eighty people use a PDF converter extension that reads every page they visit changes your priorities, and you won't find that by writing policies in a meeting room.

Step 3. Start data rules in observation mode. For the first month they watch and log but don't block, so you learn the real volumes and fix false alarms. A block that fires on an internal project number because it looks like a tax code destroys trust faster than any incident, and from then on people spend their time working around it.

Step 4. Design your groups before you buy. Premium is paid per person and almost nobody needs it for everyone. If your organisational units match your real risk profiles, buying becomes a precise choice instead of headcount times six dollars.

Step 5. Check the prerequisites on day one. This is where most projects lose calendar days. Activating Premium takes four things:

• A verified domain
• A Google Cloud organisation linked to the account
• The Cloud BeyondCorp Administrator role at organisation level, for whoever makes the purchase
• A Workspace edition other than Google Workspace for Education, which doesn't qualify

Being a Workspace super admin isn't enough and doesn't grant that role automatically.

Step 6. Decide your AI position before your users do. Banning everything doesn't work, because people reach for their personal phones and the problem becomes invisible instead of solved. Declare which tools are approved, watch what really happens and stop specific information leaving. Category filters set the boundary, but they don't replace talking to each department.

Step 7. Run the 60-day trial on one department. A team that touches sensitive data every day produces solid numbers in two months to back a buying decision. A company-wide trial only produces noise.

What Do 25 Desks and 300 Desks Look Like in Practice?

Company size changes everything, but not the way you'd expect. A small business doesn't need less control, it needs to buy far fewer licences. These are two typical projects, not named clients.

Twenty-five people and no IT department

Picture a professional firm or agency with 25 desks and an outside consultant who looks after IT once a month. Nobody has ever chosen a standard browser, and plenty of people work in their personal Chrome profile. That puts work passwords, history and bookmarks into private accounts the company doesn't control, and they stay with the person when they leave.

Core is enough here, and setup is an afternoon's work. You register the browsers, close off free installation of extensions, force updates and require the work profile instead of the personal one. That last step alone fixes a data ownership problem almost nobody this size knows they have.

Premium usually isn't needed. It's worth a look if those 25 people handle other people's health, legal or financial data, and even then you buy three or four licences for the people who touch it. Not 25.

Three hundred people and a network of outside firms

Now picture a manufacturer moving to Google Workspace, with a network of external firms that log into the management system from their own computers. Nobody can see what's installed on those machines.

You still start with Core for everyone at no licence cost. The reports usually show unauthorised extensions with very broad permissions and a share of computers months behind on Chrome versions, with security holes that were fixed upstream long ago.

In phase two, data rules run in observation mode across engineering, finance and sales. Four weeks shows where information really moves, and the direction usually surprises the people who wrote the procedures.

Only then does Premium arrive, for the profiles that justify it, typically 40 to 60 users out of 300. Context-aware access for the outside firms replaces the VPN, and everyone else stays on free Core.

What actually changes between the two?

The threshold isn't headcount, it's how many people reach your data from outside. Below it, the value is almost all visibility, which costs nothing. Above it, who's logging in from a computer you don't manage starts to matter, and that's where Premium pays for itself.

In both cases the number of licences comes last, from data, instead of being guessed in a meeting. You can read about other adoption paths in our success stories.

How Does Chrome Enterprise Work with Google Workspace?

If you already use Google Workspace, the integration is practical, not just commercial. The same groups that govern Gmail and Google Drive also govern Chrome's rules, there's one admin console, all the security reports land in one place, and Gemini in Chrome is the same AI people already use in Gmail, Docs and Meet.

Let's be precise about what's free, because enthusiasm costs money here. Switching Core on over Workspace adds no cost, and it's one of the few things we'd recommend doing anyway, just to see what's on your machines. Premium is a separate purchase with Google Cloud prerequisites and its own admin role.

Chrome Enterprise also works without Workspace, and plenty of companies on Microsoft email use it to manage their browsers. You lose the link between identity, rules and reporting, though, and that's about half the value.

If you're weighing up Google's whole AI ecosystem, our guide on which version of Gemini Enterprise to choose covers the editions. For automating document processes, see Google Workspace Studio.

Core, Premium or Both?

The setup that lasts is almost always a mix. Core for everyone, because managing your fleet for free has no downside and every later decision is a guess without an inventory. Premium for roles that touch regulated data, teams that work with outside people and anyone coming in from a computer you don't manage.

At $6 a person the maths is quick. Forty licences cost under $3,000 a year, which you can compare with what a single data breach notification to the regulator would cost you, plus the weeks of work that come with it.

Know the limits before you buy. Premium protects inside Chrome, so if Edge, Safari or Firefox are still running, your control has a hole the size of those browsers, which is why standardising comes before purchasing. And it doesn't replace antivirus, backups or the tools that watch your operating system, because it works on a different layer. Anyone selling it as a replacement for everything else is simplifying your quote, not your risk.

How Do We Run Chrome Enterprise Projects at power2Cloud?

power2Cloud is a Google Cloud Premier Partner, and we take companies through Chrome Enterprise from browser registration to writing the data rules and training the departments.

The browser rarely arrives alone, so we also run Google Workspace projects, from email migration to group design, and it pays to plan the two together. The groups you design for Workspace are the same ones that govern your Chrome rules, so doing them once saves you rebuilding six months later.

We start from your real Core reports and actual browsing habits, not a questionnaire. We tune the rules on the documents you genuinely produce, roll out in stages and watch closely, because a rule that fails in month one needs fixing, not defending.

You now know what Core and Premium do, what they cost and how to decide. Bring your org chart to a 30-minute call and we'll work out how many Premium licences you actually need.