Low-cost DeepSeek AI: global trends and risks for SMEs

The data that surprised the market: DeepSeek at the top of the Ramp ranking

In June 2026, DeepSeek has claimed the top spot among the fastest-growing software vendors according to data from Ramp, an American corporate expense management platform . This matters because Ramp pools actual transactions from thousands of businesses. So, we're talking about real purchases, not just surveys or what people say they'll do.

Ara Kharazian, chief economist at Ramp, pointed out the growing awareness of costs as the main driver of this adoption. In fact, high-end AI models — GPT-4o, Claude 3.5, Gemini Ultra — entail significant operating costs for intensive use. Consequently, companies look for alternatives capable of offering acceptable performance at a fraction of the price.

However, Kharazian also issued an explicit warning about security risks tied to using Chinese models. This mixed signal — financial upside on one hand, structural risk on the other — is precisely the kind of tension Italian SMEs need to figure out before jumping into adoption.

The numbers that matter: how much the cost factor really weighs in enterprise AI

The cost of generative AI has become a strategic variable in 2025-2026. According to Gartner , over 60% of organizations that have experimented with generative AI reported costs higher than initial expectations. Therefore, the pressure towards cheaper solutions is structural, not cyclical.

DeepSeek, developed by the Chinese company High-Flyer, has shown competitive performance on standard benchmarks at significantly lower inference costs. In particular, the DeepSeek-V3 model has shown results comparable to GPT-4 on many reasoning and text generation tasks. On top of this, the model is available as both an API and a self-hosted version, which further broadens deployment options.

For an Italian SME with a limited budget, the cost difference can be substantial. For example, average AI API usage for document automation or customer support can cost up to 70-80% less with DeepSeek compared to top American competitors. Therefore, the economic appeal is real and understandable.

Strategic reading: why cost savings aren’t the only variable

The race for low-cost AI hides traps that a superficial analysis misses. First of all, we need to distinguish between two ways of using DeepSeek: the self-hosted model — installed on your own infrastructure — and the cloud API service, where data is sent to DeepSeek's servers. This distinction is crucial from a compliance standpoint.

In the case of the cloud API, data flows to infrastructures located in China. Therefore, the issue of international transfer of personal data immediately arises, regulated by Article 44 et seq. of the GDPR . China is not considered a country with an adequate level of protection by the European Commission. Consequently, sending customer or employee data to these servers exposes the company to concrete risks of sanctions.

Plus, there is a geopolitical side to all this that you just cannot ignore. The tech tug-of-war between the US and China has already led to regulatory clamps in certain arenas. In the same way, the European AI rulebook — with the EU AI Act now in effect — introduces transparency and traceability rules that also affect non-European suppliers. So, jumping into DeepSeek via cloud without a preliminary legal check is a risk many SMEs underestimate.

On the other hand, a self-hosted deployment of DeepSeek on your own infrastructure or a certified European cloud totally changes the risk game. Here, your data stays strictly inside company walls and GDPR compliance is totally doable. That said, you'll need some serious tech chops and server power that not every small-to-medium business has in-house.

The still open construction site: EU AI Act and non-European models

The EU AI Act , fully operational in 2026, introduces a classification of AI systems by risk level. General-purpose models like DeepSeek fall under the GPAI (General Purpose AI) category and are subject to specific technical documentation and transparency obligations. However, the practical application of these obligations to non-European providers is still subject to interpretation by national authorities.

According to an analysis by Harvard Business Review , companies jumping on third-party AI without a solid internal playbook are asking for trouble, both legally and reputationally. Specifically, not having an audit trail for your models comes back to bite you when regulators start asking for proof of how automated calls affecting real people are actually being made.

Therefore, the issue is not simply «DeepSeek yes or no». The issue is equipping oneself with a framework of AI governance to evaluate any model — Chinese, American or European — with objective criteria for risk, cost and compliance. We at At SHM Studio we work precisely on this type of assessment for Italian SMEs looking to adopt AI in a structured way.

Operational implications for Italian SMEs: four concrete scenarios

Turning global trends into action means sorting out different use cases. Here are four quick scenarios that sum up everyday situations for Italian small and medium-sized businesses.

• Automation of non-sensitive internal content: drafting documents, summarizing texts, brainstorming. In this case, using DeepSeek via API might be fine as long as the prompts don't include personal data. Still, you need to make this policy official in an internal document.
• Customer support and CRM: any integration that processes customer data needs a GDPR check beforehand. In this case, setting it up yourself on your own servers is the only safe bet for non-European models.
• Business data analysis and reporting: if datasets contain confidential financial or commercial information, the risk of data leakage to foreign servers is unacceptable. Therefore, it is recommended to evaluate European models or on-premise solutions.
• Experimentation and R&D: using it in isolated sandboxes, with synthetic or anonymized data, lets you test DeepSeek's capabilities without exposing the company to compliance risks. Lastly, the results of these tests can guide smarter adoption choices.

In addition to this, it is crucial that SMEs update their Records of Processing Activities whenever they bring a new AI tool into their daily routine. People often forget this GDPR rule, but it's the first thing privacy inspectors look for.

What no one is telling you: the hidden competitive advantage in knowing how to choose

The real competitive edge right now, in this time of exploding AI models, isn't about grabbing the cheapest or most powerful tool. It's about knowing how to build a structured decision-making process to evaluate every new solution. Small and medium businesses that build this muscle today will have a huge leg up by 2027-2028, when the AI market is even more crowded and compliance rules get much tighter.

Similarly, the choice of the AI model cannot be delegated solely to IT or the marketing manager. It requires coordination between the legal, operations, and communications functions. In particular, the evaluation of reputational risk — what happens if it turns out that the company has sent customer data to Chinese servers — is a dimension that must be considered independently of the formal legality of the operation.

The digital marketing strategies and the SEO activities of an SME can benefit massively from AI, but only if adoption is managed methodically. So, investing in structured consulting before picking a model to plug into your workflows is one of the highest-ROI moves an Italian business can make today.

To learn more about how to structure a secure and measurable AI strategy, the team at SHM Studio is available for an initial assessment. It is possible contact us directly or explore our dedicated services for Italian SMEs .

In short: what to do now

The DeepSeek trend is real and the economic driver is understandable. However, adopting Chinese AI models in the cloud without prior evaluation exposes Italian SMEs to concrete GDPR and reputational risks. Therefore, the answer is not to ignore these solutions, but to evaluate them with rigorous criteria.

In particular, three immediate actions are recommended. First, map the data flows that would be involved in using the model. Next, involve the DPO or a privacy consultant in the assessment. Finally, explore self-hosted deployment options on a European cloud as an alternative to the direct cloud API.

For those who want to explore the opportunities of AI applied to Copywriting , at google ads campaigns or at LinkedIn campaigns , the SHM Studio blog we share fresh guides and breakdowns. Plus, our team keeps an eye on new rules and tech to turn them into practical tips for Italian companies.