Guide
What does AI compliance cost? Factors, process and funding options
There's no credible flat rate for data protection and AI compliance — the projects behind them vary too widely. What actually drives the effort, how you get a concrete quote, and which subsidies are available in Austria.
A flat rate for AI compliance cannot credibly be quoted — it depends on the scope of the project, not the provider. For assessment, classification, and policy. The actual proposal comes only after a short, non-binding initial conversation.
01 — Price
What it costs
- Price
- Individual based on effort
- Typical duration
- 3 to 5 weeks
For assessment, classification, and guideline. A fixed price can only be quoted responsibly after the initial meeting — send us a brief description of your project, and we'll send you a proposal that matches the scope and effort.
02 — Factors
What drives the price
- Scope and number of integrations. Every additional system that needs to participate costs effort — regardless of how simple the core is.
- State of your starting point. Clean data, existing content and documented processes significantly reduce effort. Chaos is the most expensive cost factor.
- How much new material needs to be created. What you can contribute doesn't need to be invented by anyone. This is the biggest lever you have in your own hands.
- Requirements for design and customization. A solid standard system costs a fraction of a custom solution — and is sufficient more often than vendors admit.
- Operating model. One-time project costs or ongoing support: calculated over three years, this often gives a different picture than the quote comparison.
03 — Funding
Subsidies in Austria
For digitalization projects, there are several funding programs in Austria, such as KMU.DIGITAL or the aws digitalization funding. Whether and to what extent one of these is currently relevant for your project, we'll review with you individually. Current conditions: kmudigital.at, aws.at.
Which program is relevant, how high the subsidy currently is, and whether the budget for the current funding period is still open changes regularly — plus there are regional funding programs that vary by federal state. Only the information from the funding agencies themselves is reliable, not a fixed percentage stated here.
The most common mistake is always the same: commission first, then want funding. That doesn't work. Allow several weeks of lead time for application and approval.
04 — Scope
What's included
- Inventory: which AI tools are actually being used in the business
- Classification under the EU AI Act — risk class and resulting obligations
- Review of the data protection situation for each tool, including data processing agreements
- Usage policy that's practical in everyday work rather than just formally correct
- Implement labeling requirements for chatbots and AI-generated content
- Proof of AI competence through documented training
05 — Questions
Frequently asked questions
What does the EU AI Act specifically require of us?
For most businesses, it comes down to two things: transparency and competence. Transparency means people must recognize when they're speaking with an AI system or seeing AI-generated content — this has been in effect since August 2026. Competence means the people deploying such systems are adequately trained to do so. Both are documentable and achievable with manageable effort.
Is a verbal agreement within the team sufficient instead of a written policy?
No, in case of dispute or audit, only what is documented counts. A brief written policy also protects new team members who never heard the verbal agreement.
Do we need a data protection impact assessment?
Not generally. It becomes necessary when the processing is likely to pose a high risk to data subjects — such as extensive profiling. For an FAQ chatbot on a website, it's usually not required. We review this case by case and document the result in writing.
Does this also apply to sole proprietorships?
Yes. The AI Act doesn't distinguish by company size, but by purpose and risk. Anyone with a chatbot on their website is affected — regardless of whether one or a hundred people work in the business.
May we enter customer data into ChatGPT?
In the free version without contractual safeguards: no. With a business account, data processing agreement, and training excluded, it may be permissible — depending on what data is involved. Precisely this distinction belongs in the usage policy, because it's constantly relevant in daily operations.
What if we use multiple AI tools from different providers?
Each tool is assessed individually — provider, data processing, and risk class differ. The usage policy summarizes the results so no one has to look up each tool separately.
Do AI-generated texts need to be labeled?
For content that is published and synthetically generated or substantially modified, yes. Purely internal use — research, drafts, summaries — typically does not trigger this obligation.
06 — Error
The most common mistakes
- Starting too big. Projects where nobody can use anything for months fail more often than average. A small, usable first step is almost always the better way.
- Not involving the people who work with it. Requirements that only come from management rarely match the actual work.
- Not defining a success measure. Without a metric defined in advance, you can't say afterwards whether it delivered anything — and the next decision will be made on gut feeling again.
- Overlooking operating costs. The project price is only part of it. What operation costs over three years belongs in the same calculation.
- Creating dependency. If you don't get access, documentation and source code, you're locked in. That needs to be clarified before commissioning, not after.
07 — Next
Related pages
- Data protection and AI compliance — Overview
- Data Protection and AI Compliance — Small Businesses
- Data protection and AI compliance — Funding
- Data protection and AI compliance — common mistakes
- Data protection and AI compliance — contract and ownership
- Data protection and AI compliance — team and acceptance
- Data protection and AI compliance — practical examples
- Data protection and AI compliance — DIY
- AI Consulting
- AI training
- AI chatbot
- All guides
Data protection and AI compliance by region
Next step
We'll look at your starting position.
Tell us what's eating up time today. That becomes an assessment with effort and benefit — and only then an offer.