DeepSeek AI low-cost: global trend and risks for SMEs

The data that surprised the market: DeepSeek tops the Ramp leaderboard

In June 2026, DeepSeek it conquered the first position among the fastest-growing software vendors according to data from Ramp, an American corporate expense management platform. The data is relevant because Ramp aggregates real transactions from thousands of businesses. Therefore, these are not surveys or statements of intent, but actual purchases.

Ara Kharazian, chief economist at Ramp, indicated the growing cost awareness as the main driver of this adoption. In fact, high-end AI models—GPT-4o, Claude 3.5, Gemini Ultra—come with significant operational costs for intensive use. Consequently, companies are seeking alternatives capable of offering acceptable performance at a fraction of the price.

However, Kharazian also issued a stark warning about security risks linked to the use of Chinese models. This dual signal—economic opportunity on one hand, structural risk on the other—is exactly the kind of tension that Italian SMEs need to be able to read before making adoption decisions.

The Numbers That Count: How Much Does Cost Really Weigh in Enterprise AI

The cost of generative AI has become a strategic variable in 2025-2026. According to Gartner, more than 60% of organizations that have experimented with generative AI reported costs higher than initially expected. Therefore, the push toward more cost-effective solutions is structural, not cyclical.

DeepSeek, developed by the Chinese company High-Flyer, has demonstrated competitive performance on standard benchmarks at significantly lower inference costs. Specifically, the DeepSeek-V3 model has shown results comparable to GPT-4 on many reasoning and text generation tasks. In addition, the model is available both as an API and as a self-hosted version, further expanding deployment options.

For an Italian SME with a limited budget, the cost difference can be substantial. For example, average use of AI APIs for document automation or customer support can cost up to 70–80% less with DeepSeek compared to leading American competitors. Therefore, the economic appeal is real and understandable.

Strategic Reading: Why Saving Isn't the Only Variable

The race for low-cost AI hides pitfalls that a superficial analysis does not reveal. First of all, it is necessary to distinguish between two modes of using DeepSeek: the self-hosted model – installed on one's own infrastructure – and the cloud API service, where data is sent to DeepSeek's servers. This distinction is crucial from a compliance perspective.

In the case of the cloud API, data is transferred to infrastructure located in China. Therefore, the issue of international transfer of personal data immediately arises, regulated by Article 44 et seq. of the General Data Protection Regulation. China is not considered a country with an adequate level of protection by the European Commission. Consequently, sending customer or employee data to these servers exposes the company to real sanctioning risks.

Furthermore, there is a geopolitical dimension that cannot be ignored. Tensions between the United States and China in the technology sector have already led to regulatory restrictions in some contexts. Similarly, the European regulatory framework on AI — with the’EU AI Act having come into effect, introduces transparency and traceability obligations that also impact non-European suppliers. Therefore, adopting DeepSeek in cloud mode without prior legal assessment is a risk that many SMEs underestimate.

On the contrary, a self-hosted deployment of DeepSeek on private infrastructure or on certified European cloud radically changes the risk profile. In this scenario, data does not leave the company's perimeter, and GDPR compliance is manageable. However, this option requires technical skills and infrastructure resources that not all SMEs possess internally.

The construction site is still open: EU AI Act and non-European models

L'EU AI Act, fully operational in 2026, introduces a classification of AI systems by risk level. General-purpose models like DeepSeek fall into the GPAI (General Purpose AI) category and are subject to specific technical documentation and transparency obligations. However, the practical application of these obligations to non-European providers is still subject to interpretation by national authorities.

According to an analysis by Harvard Business Review, companies that adopt third-party AI without structured internal governance expose themselves to reputational as well as legal risks. In particular, the lack of an audit trail on the use of models becomes a problem when a supervisory authority requests documentation on how automated decisions affecting individuals are made.

Therefore, the issue is not simply «DeepSeek yes or no.» The issue is equipping ourselves with a framework of AI governance that allows any model — Chinese, American, or European — to be evaluated with objective criteria of risk, cost, and compliance. We at SHM Studio works on exactly these types of assessments. for Italian SMEs that want to adopt AI in a structured way.

Operational Implications for Italian SMEs: Four Concrete Scenarios

Translating the global trend into operational decisions requires distinguishing between different usage contexts. Below are four scenarios that summarize the most common situations in Italian SMEs.

• Automation of non-sensitive internal content: Drafting, document summarization, brainstorming. In this case, using DeepSeek via API may be acceptable if the prompts do not contain personal data. However, this policy needs to be formalized in an internal document.
• Customer Service and CRM: Any integration that processes customer data requires a prior GDPR assessment. In this scenario, self-hosted deployment is the only secure option for non-European models.
• Business data analysis and reporting: If the datasets contain confidential financial or commercial information, the risk of data leakage to foreign servers is unacceptable. Therefore, we recommend evaluating European models or on-premise solutions.
• Experimentation and R&D: Using isolated sandboxes with synthetic or anonymized data allows testing DeepSeek's capabilities without exposing the company to compliance risks. Finally, the results of these tests can inform more informed adoption decisions.

In addition to this, it is fundamental that SMEs update their Records of Processing Activities every time they introduce a new AI tool into the operational flow. This GDPR obligation is often overlooked, but it is the first element that a supervisory authority inspection verifies.

What nobody tells you: the hidden competitive advantage of knowing how to choose

The real competitive differentiator right now, with the proliferation of AI models, is not adopting the cheapest or most powerful tool. It's knowing how to build a structured decision-making process to evaluate each new solution. SMEs that develop this capability today will have a significant advantage in 2027-2028, when the AI market is even more crowded and regulatory pressures are more intense.

Similarly, the choice of AI model cannot be delegated exclusively to IT or the marketing manager. It requires coordination between legal, operations, and communications functions. In particular, the assessment of reputational risk—what happens if it emerges that the company sent customer data to Chinese servers—is a dimension that must be considered independently of the formal legality of the operation.

Le digital marketing strategies and the SEO activities SMEs can benefit enormously from AI, but only if adoption is managed systematically. Therefore, investing in structured consulting before choosing the model to integrate into their workflows is one of the highest ROI decisions an Italian company can make today.

To further explore how to structure a secure and measurable AI strategy, the team at SHM Studio is available for an initial assessment. Is it possible contact us directly to explore our Services for Italian SMEs.

In summary: what to do now

The DeepSeek trend is real, and the economic driver is understandable. However, adopting Chinese AI models in cloud mode without prior evaluation exposes Italian SMEs to concrete GDPR and reputational risks. Therefore, the answer is not to ignore these solutions, but to evaluate them with rigorous criteria.

Specifically, three immediate actions are recommended. First, map the data flows that would be involved in using the model. Second, involve the DPO or a privacy consultant in the evaluation. Finally, explore self-hosted deployment options on European cloud infrastructure as an alternative to direct cloud APIs.

For those who want to delve deeper into the opportunities of AI applied to copywriting, all Google Ads campaigns All of you LinkedIn campaign, the SHM Studio Blog publishes updated analyses and operational guides. Furthermore, our team follows regulatory and technological evolution to translate it into practical guidance for Italian businesses.