AI in business — where to start, what it costs and what the law says

AI in business today means four different things: an assistant in your office suite, automation with a language model inside, a chat on your website and an agent that chooses its own next steps. Each has a different cost, a different risk and different legal duties, and under one name it is easy to buy something other than what the company needs.

About one EU company in five uses AI. According to Eurostat, 19.95% of enterprises with at least 10 employees used AI in 2025, up from 13.48% a year earlier, and the member states range from about 5% to 42%. Companies that considered AI but do not use it most often name lack of expertise, unclear legal consequences and data protection.

This guide helps you make three decisions: which kind of AI fits your problem, what it really costs, including outside the invoice, and what the law requires after the July 2026 amendment of the AI Act. Where a topic has its own article, we link to it. We checked the data, prices and rules on 8 October 2026.

How many EU companies use AI — and for what

AI in business is still mostly a large-company affair: 55.03% of large EU enterprises use it, against 30.36% of medium-sized and 17.00% of small ones. That is Eurostat's 2025 data for enterprises with 10 or more employees and self-employed persons, excluding the financial sector (small means 10–49 people, medium-sized 50–249, large 250 or more). Across all sizes the share is 19.95%, up 6.47 percentage points from 13.48% in 2024. The member states differ widely: by our calculation from Eurostat's data the total runs from 5.21% to 42.03%, so the figure for your country can be far from the EU average.

Most of it is about text. No single technology dominates, but Eurostat's table shows analysing written language (text mining) at 11.75% of all enterprises, generating images, video or sound at 9.55%, and generating written or spoken language or programming code at 8.76%. Among the companies that use AI, 34.70% used it for marketing or sales and 31.05% for organising business administration processes or management (Eurostat Statistics Explained).

We found no data on AI agents in European companies. Eurostat measures AI technologies in general, and surveys about agents, such as Gartner's or McKinsey's, are global and say nothing about European SMEs.

Four kinds of AI in a business

One question decides which kind of AI you are looking at: who chooses the next step — a person, a pre-written workflow or the model. The answer determines the cost, the risk and the amount of work before launch.

Assistant in an office suite. ChatGPT on a business plan, Copilot in Microsoft 365 or Gemini in Google Workspace help you write, summarise and search, but an employee decides every step. Gartner describes assistants (26 August 2025) as tools that "depend on human input and do not operate independently", and calls referring to them as agents the most common misconception. You pay a subscription per user. What the Google and Microsoft plans include, and what Copilot costs as an add-on, we compare in Google Workspace vs Microsoft 365; how a business plan differs from a private one, and what ChatGPT Business, Claude Team, Copilot and Gemini cost per user, is in ChatGPT Business, Copilot or Gemini for business.

Automation with a model inside. The workflow is written in advance and the model performs single steps in it, for example reading the content of a document. Anthropic, the maker of the Claude models, calls this a workflow: the model and tools are orchestrated "through predefined code paths" (Building effective agents, 19 December 2024). How automation differs from RPA and integration is covered in our article on business process automation, and the tools in which you can assemble such a workflow without a programmer in the piece on low code and no code.

Chat on your website. It answers customers from the company's knowledge and hands the conversation to a person when it does not know the answer. It usually works as RAG (retrieval-augmented generation): before answering, it searches the company's documents for matching passages. It has two risks an internal assistant does not: the model can make up an answer that the customer takes for fact, and from 2 August 2026 the person on the other end must know they are writing to an AI (Art. 50 of the AI Act, explained below). Where a chatbot fits in an online shop's support is covered in our article on ecommerce customer service.

Agent. The model chooses the next steps and tools itself. Anthropic writes that agents are systems where models "dynamically direct their own processes and tool usage". OpenAI, in its guide to building agents (2025), states that a simple chatbot is not an agent. Gartner estimates (25 June 2025) that of the thousands of "agentic AI" vendors only about 130 are real, and that many rebrand existing products such as assistants, RPA and chatbots. Anthropic warns that an agent's autonomy means higher costs and the potential for compounding errors. What separates an agent from a chatbot and from ordinary automation, and when it really makes sense, we explain in the article on the AI agent in business.

Gartner gives a simple rule of thumb in the same press release: agents where decisions are needed, automation for routine workflows, assistants for simple retrieval.

Where to start — the order that saves money

Start with what blocks most companies: knowledge, rules and data, and choose the tool last. The barriers show in Eurostat's data. Among EU companies that had considered AI but did not use it, 70.89% named a lack of relevant expertise, 52.52% a lack of clarity about the legal consequences and 48.83% concerns about data protection and privacy. Measured against all enterprises rather than only those that considered AI, the same reasons are smaller (7.76%, 5.92% and 5.82%; costs too high 4.24%, our calculation from Eurostat's data), but the order is the same: knowledge first, price later. Because the two sets of figures use different bases, we name the base each time.

That gives four steps.

1. Rules for using AI. Decide which data may be typed into which tool and from which account. The terms differ by vendor and plan, so read them for the plan you actually use; the business plans we compare are in ChatGPT Business, Copilot or Gemini for business. How to list where company data lives and who can reach it is covered in company data security.
2. The assistant in the suite you already have or can add. It is the cheapest way for the team to learn to work with a model. Before switching it on, tidy file permissions (below, in the section on costs).
3. One process to automate. Pick a process that repeats and has a clear, checkable result. Anthropic advises "finding the simplest solution possible", which may mean not building agentic systems at all, and adds that for many applications a single model call with retrieval and in-context examples "is usually enough".
4. An agent only when the workflow does not fit. OpenAI lists three conditions: complex decisions with exceptions, rules that are hard to maintain, and heavy reliance on unstructured data. If your process meets none of them, then in OpenAI's words "a deterministic solution may suffice", that is, ordinary automation. Once you do build an agent, the same guide says actions that are sensitive, irreversible or high-stakes should trigger human oversight until confidence in the agent grows. OpenAI's examples: cancelling an order, authorising a large refund, making a payment.

A test before step four: can you write down the rule an employee uses today to make the decision? If so, you need automation, not an agent. In our view the rule OpenAI states for agents holds at every stage: start small, validate with real users and grow capabilities over time.

What AI costs a business — three kinds of cost and one hidden one

The cost of AI in a business is a subscription, token charges and implementation work, and before all of them comes tidying up your data, which appears on no price list. Each grows by a different rule.

Subscription per user. Assistants in office suites cost a fixed amount per person per month. The bill grows with headcount, not with how heavily the tool is used. Current Google and Microsoft plans with AI are compared in Google Workspace vs Microsoft 365.

Tokens. When a model works in an automation, a chat or an agent, you pay for the amount of text processed, counted in tokens (pieces of words). That is how Anthropic and OpenAI bill. We calculated an example ourselves on the Claude Sonnet 5.5 price list ($2 per million input tokens, $10 per million output tokens, read 8 October 2026). Anthropic publishes prices in US dollars; we leave them in dollars rather than convert. One chat reply, with 3,000 input and 300 output tokens, costs $0.009. An agent task with ten model calls, averaging 8,000 input and 500 output tokens per step, costs $0.21, about 23 times more. A thousand such tasks a month come to $210. These are assumptions of the example, not a market average, and they ignore discounts for caching and batch processing. Gartner estimates (17 August 2026) that routing a task to an agentic reasoning model raises the model provider's inference cost at least fivefold compared with a basic chatbot interaction. The full token calculation for an agent, with a chart comparing a chat reply and a multi-step task, is in the article on the cost of an AI agent.

Implementation and maintenance. Integration with your systems, preparing a knowledge base, testing and later model changes are work whose price depends on scope. We found no independent study of AI implementation prices in Europe, so we quote no market figure.

The hidden cost: data and permissions. Buying a licence does not finish the preparation. Microsoft's Copilot documentation (read 8 October 2026) says the assistant only shows organisational data that individual users have at least view permission for, and tells you to make sure the right people have access to the right content. The same page states that prompts, responses and data accessed through Microsoft Graph are not used to train the foundation models. It cuts both ways (our example): if personnel files sit in a folder shared with the whole company, the assistant will find them for anyone who asks. That is why the first step in Microsoft's deployment guide (read 8 October 2026) is to fix oversharing: find sites and files shared too broadly, ownerless, unused or holding sensitive data, and then correct access. Gartner writes (11 May 2026) that without a clear understanding of the relationships and rules in an organisation's data, AI agents "cannot operate accurately and are far more likely to hallucinate". Those hours of tidying are an implementation cost even if nobody invoices them. The same principle applies to an AI chat built on company documents: permissions must be enforced by the retrieval itself. It is also true of an assistant or agent connected to company systems through MCP (Model Context Protocol): it sees and does whatever the account it uses allows.

Money also limits those who have already deployed AI. In McKinsey's global survey (25 August 2026, 1,719 respondents from 97 countries, self-reported) about 20% said AI operating costs, including tokens, constrained their use of AI, and 37% attribute at least some EBIT impact to AI. A third of respondents (36%) work for organisations with revenue above $1 billion, and the survey says nothing about European small companies.

The law: the AI Act and GDPR in one calendar

The AI Act applies in stages, and the July 2026 amendment pushed the heaviest duties to December 2027 — but the duty to tell people they are talking to an AI has applied since 2 August 2026. The dates come from Regulation 2024/1689 and the amending Regulation 2026/1744, in force since 27 July 2026. Duties by company role, fines for SMEs and a checklist are in the article EU AI Act for business.

The key dates in order:

• 1.08.2024 — the AI Act enters into force.
• 2.02.2025 — Chapters I and II apply, including Art. 4 on AI literacy and the prohibited practices.
• 2.08.2025 — the rules on general-purpose AI models and the chapter on penalties.
• 27.07.2026 — the amending Regulation 2026/1744 enters into force.
• 2.08.2026 — general date of application, including Art. 50 on transparency. According to the European Commission, from that day the AI Office and the authorities of the member states are responsible for implementing, supervising and enforcing the rules. Which authority inspects you and how penalties are set differs by member state (Art. 70 and 99(1)); the Commission publishes a list of national contact points, updated 7 September 2026.
• 2.12.2026 — providers of content-generating systems placed on the market before 2.08.2026 must mark their output (Art. 50(2)). Two new prohibitions also start that day, on generating intimate material without consent and on material depicting the sexual abuse of children.
• 2.12.2027 — obligations for high-risk systems in Annex III, including AI in recruitment.
• 2.08.2028 — obligations for high-risk systems in Annex I (products covered by other EU legislation).

Chat and agent talking to people. Art. 50(1) obliges the provider of a system to make sure the person on the other end knows they are interacting with an AI, unless that is obvious. The information has to appear at the latest at the first interaction (Art. 50(5)). A breach can bring a fine of up to EUR 15 million or up to 3% of total worldwide annual turnover, whichever is higher, and for SMEs under Art. 99(6) the lower of the two. Whether a company that orders a chat from a contractor and runs it under its own brand is the provider in this arrangement depends on the case; if in doubt, ask a lawyer.

Training your staff. Art. 4 in the wording given by Regulation 2026/1744 says that providers and deployers of AI systems "shall take measures to support the development of AI literacy" of their staff, and that the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". In its questions and answers on AI literacy the Commission adds that Article 4 does not entail an obligation to measure the AI knowledge of employees, and that from 2 December 2027 those who deploy high-risk systems from Annex III will have to put people with the necessary competence and training in charge of oversight.

Is your AI an "AI system" at all. In its guidelines on the definition of an AI system the Commission writes that it is not possible to determine automatically which systems fall within the definition, and that only some AI systems are subject to regulatory obligations. High risk depends on the use, not on the technology.

GDPR. The European Data Protection Board says in its Opinion 28/2024 (17 December 2024) that supervisory authorities should take into account whether the controller deploying a model carried out an appropriate assessment that the model was not developed by unlawfully processing personal data. A company deploying a model should therefore check this. In its ChatGPT taskforce report (23 May 2024) the Board notes that, in any case, "the principle of data accuracy must be complied with", even though a model can produce made-up output. Several national data-protection authorities publish their own AI guidance; check yours.

Articles in this section

Below are the articles in this section, followed by articles from other sections that cover AI as part of their own topic.

• AI agent in business: how an agent differs from a chatbot and from automation, the three conditions that justify one, token cost and the AI Act.
• EU AI Act for business: who is a provider and who a deployer, deadlines to 2028, fines for SMEs and a ten-point checklist.
• ChatGPT Business, Copilot or Gemini for business: what a business plan changes compared with a private one, and what each assistant costs per user.
• Business process automation: how automation differs from RPA and AI, Eurostat data on EU companies, e-invoicing by law and examples of automation in a small company.
• Low code and no code: when a platform without programming is enough, which limits you cannot see at the start and what you lose if you want to leave.
• Google Workspace vs Microsoft 365: plans and prices of both suites, including their AI features.
• Ecommerce customer service: support tickets in an online shop and the chatbot-disclosure duty under the AI Act.
• Ecommerce automation: what to automate first, what Zapier, Make and n8n cost, and how to calculate the return on automation in hours worked, not in promises.

How we work with AI at Digital Vantage

We use OpenAI and Anthropic models through their APIs and advise starting with the simplest solution that solves the problem. We build automations in n8n and Node.js on servers in Warsaw (EU); the scope of that service is described on our process automation page.

We are preparing an AI chat for our own website that answers from company knowledge and hands the conversation to a person. The first message tells the visitor that an AI is answering. A person takes over, among other cases, when the visitor asks for it, when the bot does not know the answer, for a complaint and for legal or financial topics, and when the monthly token budget is exceeded. The CRM receives a summary, not the full transcript. Where the model itself processes the data depends on the provider and platform, and we have not yet decided that. The chat is not live, so we publish no results. After launch we will watch it for at least four weeks before proposing a similar solution to clients.