What does a GDPR-compliant AI chatbot cost? 6 cost factors for small businesses

What a GDPR-compliant AI chatbot costs is decided in six places: whether you rent an off-the-shelf tool or have one built, how large the knowledge base is, which systems it connects to, how strict the data protection requirements are, how many channels it runs on and how heavily it is used day to day. The biggest lever is in your own hands: scope. A chatbot that reliably answers ten common questions and hands over cleanly to your team costs a fraction of one that is meant to do "everything".

My view: most small businesses do not need a chatbot that knows everything. They need one that does little, but does it reliably. Start small and you pay less, learn faster and only expand what customers actually use.

In this guide I go through the six cost factors one by one and show you how to influence each of them.

Off-the-shelf builder or custom build: what fits your business?

The first and biggest cost factor is the basic decision. There are two routes, and both have their place.

Off-the-shelf SaaS builder: You rent a ready-made chatbot service, upload your content and embed a widget on your website. It is quick and needs hardly any development. In return you pay licence fees for as long as you use it, you are tied to the provider's features, and you often have little say in where data is processed and which AI model runs behind it.

Custom development: The chatbot is built for your business, for example with Next.js for the widget on your website, Supabase as the database and a language model of your choice. It takes more effort up front, but you decide where data lives, which systems are connected and how the bot behaves.

	Off-the-shelf builder	Custom development
Upfront effort	low	higher
Running costs	licence plus usage	hosting plus usage
Control over data and model	limited	full
Connecting your own systems	only what the provider supports	as needed
A good fit when …	you only want to answer standard questions	the bot needs to act within your processes

What else drives the price?

Factor 2: The knowledge base

An AI chatbot is only as good as the knowledge it can draw on. Technically this usually works via RAG (retrieval-augmented generation): your documents are split into small chunks and stored so they can be searched. For each question the bot pulls out the relevant chunks and phrases an answer from them. We like to use Supabase with the pgvector extension for this, because the database and vector search sit in one place and Supabase offers data centres in the EU. No separate vector service needed.

The effort depends less on the technology than on your content. A tidy FAQ page and a service overview are quick to add. Scattered PDFs, contradictory price lists and outdated website copy take time, because they need sorting first. The same principle, making documents searchable via vector search, also powers our AI assistant for law firms, there for case files rather than website questions.

Factor 3: Integrations

A bot that only answers questions is manageable. Effort grows as soon as it has to do something: put appointments into your calendar, pass enquiries to your CRM or hand a conversation over to a colleague with the full history. Every connection has to be built, tested and maintained.

For many of these connections we use n8n. It can run on your own servers in the EU and links chatbot, calendar, email and CRM without custom code for every little thing. Compared with services like Zapier, you keep more control over where the data flows. More on that distinction in Workflow vs. AI automation.

Factor 4: Channels

Website chat is the easiest way in. Every additional channel brings its own rules. WhatsApp runs via Meta's WhatsApp Business Platform, with its own approval process, its own fees and data protection questions, because Meta becomes another provider in the chain. A phone or voice assistant, for example built with Vapi or ElevenLabs, also needs speech recognition, speech output and a phone number, and has to cope with interruptions and dialect.

What does GDPR compliance cost, and what is mandatory?

Factor 5: Data protection

GDPR compliance is not an add-on you switch on at the end. It comes from decisions that directly affect the price:

• Model choice and hosting: A model from Mistral, a French provider, or a model like Claude that cloud providers also offer in EU data centres fits strict requirements better than a service with no clear information on where data is processed. Which model makes sense depends on answer quality, language and the data involved.
• Data processing agreement (DPA): You need a DPA under Art. 28 GDPR with every provider that handles chat data. With a builder that is one contract; with a custom solution it is often several: hosting, database, model provider.
• Storing chat logs: How long are conversations kept, who can see them, are they deleted automatically? Each of these rules has to be implemented.
• Sensitive data: In medical practices or law firms, users quickly type health or case details into the chat. That calls for stricter rules, or a bot that actively asks people not to enter such data.

Mandatory since 2 August 2026: AI labelling

Since 2 August 2026, Art. 50 of the EU AI Act applies: users must be able to clearly recognise that they are talking to an AI and not a human. This also covers small businesses. Technically it is not a big item, but it belongs in every quote as a fixed component. What exactly is required and what a notice can look like is explained in our guide to the chatbot labelling obligation under Art. 50. Whether your existing chatbot shows such a notice can be checked with our free AI Act check.

What running costs should you expect?

Factor 6: Usage and maintenance

After launch there are two kinds of running costs.

Usage-based API costs: Language models such as the Claude API or Mistral are billed by the amount of text processed. More conversations, longer conversations and more knowledge-base content per answer mean higher costs. Model choice matters too: smaller models are cheaper and often good enough for simple questions, larger ones pay off for more complex advice. Add hosting and, for builders, the monthly licence.

Maintenance: New services, changed opening hours, questions the bot got wrong. Someone has to review this regularly and update the knowledge base. The most expensive chatbot is the one nobody maintains after three months, because it then gives wrong answers and annoys customers.

Is it worth it for my business?

To be honest, an AI chatbot is not always worth it:

• Too few enquiries: If only a handful of recurring questions come in each week, a good FAQ page is cheaper and just as helpful.
• Advice rather than information: If almost every enquiry needs a professional judgement, such as a legal assessment at a law firm, the bot can at most pre-sort. The actual answer has to come from a person.
• Nobody maintains it: Without someone keeping the content current, the bot quickly becomes a source of errors.

Whether a chatbot or a full AI agent makes sense also depends on how much it should do on its own. What an agent costs is covered in What does an AI agent cost?. If you are not sure where automation pays off in your business at all, a process analysis helps before any tool decision.

My take

A GDPR-compliant AI chatbot does not have to be a big project. Six factors set the price, and for almost all of them you decide how much you need. My advice: one channel, one integration, a clean knowledge base built from your most common questions, and AI labelling from day one. Once that works and customers use it, expand.

Your next step: write down the 15 most common questions your team answered this week. With that list you can work out in a free initial consultation whether a chatbot makes sense for you, and at what scope. What we build in practice is on our AI chatbots page.

Note: This guide is a technical overview, not legal advice. For a binding assessment of data protection and AI Act questions in your specific case, please consult a lawyer.