PIPELINEGuide
Data protection and AI compliance: ongoing costs and operations
The project price is only part of the calculation. What actually arises in effort and costs after going live — and which item is most often forgotten.
After going live, data protection and AI compliance typically requires a few hours of maintenance per quarter, plus hosting, licenses, and third-party usage fees. The most commonly forgotten item isn't the money, but accountability: systems become outdated because no one is assigned responsibility, not because maintenance is demanding.
01 — Operation
What ongoing operation means
After the initial settling period, the effort is low but not zero. For data protection and AI compliance, this typically means a few hours per quarter: additions when something changes in your offering, a review of the logs, occasional corrections.
More important than the scope is the responsibility. Systems don't become outdated because maintenance is demanding, but because no one is assigned. One person with a recurring calendar appointment solves this problem completely.
What additionally arises on an ongoing basis depends on the setup — hosting, licenses and third-party usage-based fees belong in the same calculation as the implementation. We show this separately in the quote instead of hiding it in the project price.
02 — Factors
What drives the price
- Scope and number of integrations. Every additional system that needs to participate costs effort — regardless of how simple the core is.
- State of your starting point. Clean data, existing content and documented processes significantly reduce effort. Chaos is the most expensive cost factor.
- How much new material needs to be created. What you can contribute doesn't need to be invented by anyone. This is the biggest lever you have in your own hands.
- Requirements for design and customization. A solid standard system costs a fraction of a custom solution — and is sufficient more often than vendors admit.
- Operating model. One-time project costs or ongoing support: calculated over three years, this often gives a different picture than the quote comparison.
03 — Contract
What needs to be clarified in writing
- Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
- Handover upon termination. In what format, within what timeframe, at what cost.
- No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
- What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
- Documentation as a deliverable. Not as a promise, but as a line item in the proposal.
04 — Questions
Frequently asked questions
Does this also apply to sole proprietorships?
Yes. The AI Act doesn't distinguish by company size, but by purpose and risk. Anyone with a chatbot on their website is affected — regardless of whether one or a hundred people work in the business.
Is a verbal agreement within the team sufficient instead of a written policy?
No, in case of dispute or audit, only what is documented counts. A brief written policy also protects new team members who never heard the verbal agreement.
Do AI-generated texts need to be labeled?
For content that is published and synthetically generated or substantially modified, yes. Purely internal use — research, drafts, summaries — typically does not trigger this obligation.
What if we use multiple AI tools from different providers?
Each tool is assessed individually — provider, data processing, and risk class differ. The usage policy summarizes the results so no one has to look up each tool separately.
May we enter customer data into ChatGPT?
In the free version without contractual safeguards: no. With a business account, data processing agreement, and training excluded, it may be permissible — depending on what data is involved. Precisely this distinction belongs in the usage policy, because it's constantly relevant in daily operations.
Do we need a data protection impact assessment?
Not generally. It becomes necessary when the processing is likely to pose a high risk to data subjects — such as extensive profiling. For an FAQ chatbot on a website, it's usually not required. We review this case by case and document the result in writing.
How often does the inventory need to be updated?
Whenever a new tool is introduced or the purpose of an existing one changes. An annual review as a minimum interval makes sense, even without a specific trigger.
05 — Next
Related pages
- Data protection and AI compliance — Overview
- Data protection and AI compliance — duration
- Data protection and AI compliance — practical examples
- Data protection and AI compliance — cost-effectiveness
- Data protection and AI compliance — provider comparison
- Data Protection and AI Compliance — Pros and Cons
- Data protection and AI compliance — Funding
- Data protection and AI compliance — alternatives
- AI Consulting
- AI training
- AI chatbot
- All guides
Data protection and AI compliance by region
Next step
Initial assessment, no obligation.
Briefly describe what you need. You'll get an honest answer about what's realistic and what it will roughly cost.