Guides / GUIDE-002

Buy, cloud service or run it yourself: choosing the implementation path (TCO, lock-in, data sensitivity)

Decide per use case whether to buy AI inside standard software, assemble it from a cloud model API, or run an open-weight model on your own hardware, based on data sensitivity, total cost of ownership and exit options.

Most SMBs end up with AI from three directions at once: features built into software they already use, cloud model APIs wired into their own workflows, and sometimes a model on their own server. Each path has different costs, risks and exit options. This guide gives you a repeatable way to choose the path for each use case. It does not give you one answer for the whole company.

Why it matters

The implementation path decides three things that are expensive to change later:

  • Where your data goes. A cloud service is a processor under Art. 28 GDPR and needs a data processing agreement (AVV). If the provider or its sub-processors are in the US, the transfer relies on the EU-US Data Privacy Framework (DPF) or on standard contractual clauses. The EU General Court upheld the DPF on 3 September 2025 (T-553/23, Latombe), but an appeal is pending at the Court of Justice (C-703/25 P) [4][5]. Its predecessors were struck down, so plan a fallback for US-based services handling personal data.
  • How hard it is to leave. Under the EU Data Act, cloud providers must remove obstacles to switching. From 12 January 2027 they may no longer charge switching fees, including data egress fees for the switch. Until then, charges are capped at the provider's direct costs [3]. Early-termination penalties in fixed-term contracts are not covered. Lock-in also comes from prompts, workflows and integrations built around one vendor, and the Data Act does not address that.
  • Who carries the regulatory role. If you only use a system, you are normally a deployer under the AI Act. If you substantially modify a general-purpose model, you can become its provider. The Commission's GPAI guidelines treat a modification that uses more than one third of the original training compute as the indicative threshold [7]. Typical SMB fine-tuning stays far below that, but large retraining projects do not. For high-risk systems, putting your own name on a system or changing its intended purpose can also make you a provider (Art. 25 AI Act). Annex III high-risk duties apply from 2 December 2027.

When you need it

  • After discovery and scoring (GUIDE-001), once you have a shortlist of use cases and before you ask vendors for quotes.
  • Before a pilot (GUIDE-009). The path decides which data you may use in the pilot.
  • Whenever a vendor rolls out AI features in existing software, for example in M365, DATEV, ERP, CRM or ticketing. This is a "buy" decision even when nobody signed a new contract.
  • At contract renewal, and before 12 January 2027 if you are renegotiating cloud contracts.

Who is involved

  • Management: owns the decision, budget and accepted risk.
  • Department lead and end users: describe the process, the volume and the quality bar. They also judge whether a standard feature is "good enough".
  • IT: handles integration effort, operations, identity and access, and hardware if you self-host.
  • IT security: reviews provider audit reports (C5, ISO 27001) and the threat model for self-hosting (GUIDE-013).
  • DPO: checks the legal basis, the AVV, third-country transfers and whether a DPIA is needed (GUIDE-005).
  • Data owners: confirm which data may leave which system (GUIDE-003).
  • Legal/compliance: reviews contract terms, exit clauses and sector rules.
  • Works council: if the system logs user activity, §87(1) no. 6 BetrVG applies whichever path you choose. Self-hosting does not avoid co-determination (GUIDE-004).

Step by step

1. Describe the use case on one page (1–2 hours per use case). Record process, users, monthly volume, systems involved and the worst realistic consequence of a wrong output.

2. Classify the data (half a day with data owners and the DPO). Use three or four classes, for example: - public - internal - confidential (contracts, prices, designs) - personal data, with a separate flag for special categories (Art. 9 GDPR: health, union membership and similar)

The highest class in the use case drives the decision. Check whether the data can be anonymised or redacted before it reaches the model (DOC-018). That step often turns a "self-host only" case into a "cloud is fine" case.

3. Map the three paths. Most SMB cases are "buy" or "assemble".

Path What it means Typical fit Main risks
Buy AI feature or SaaS product, used as delivered (e.g. copilot in office suite, invoice capture, meeting transcription) Standard tasks, many users, little IT capacity Data leaves via vendor and its sub-processors; little control over model changes; per-seat cost grows with headcount
Assemble (cloud API) Your workflow or app calls a model API from a cloud provider (EU region where offered), often via low-code (n8n, Power Automate) or a RAG platform Company-specific processes: order entry, email routing, document Q&A You own the integration and its maintenance; usage-based costs can spike; prompts and connectors tie you to one API
Run it yourself Open-weight model on own server, at a German hosting provider or on-prem GPU High-volume repetitive tasks, strictly confidential data, offline/shop-floor needs Hardware, patching, model updates and monitoring are your job; smaller models are often weaker on complex reasoning

A useful middle option is to self-host the workflow, for example running n8n on your own server, while calling a cloud model only with redacted data. You keep orchestration, logs and connectors in house without running GPUs.

4. Apply the decision rules. - If a mature standard product covers 80% of the need, buy it. Building your own invoice capture or transcription rarely pays off for an SMB. - If the value comes from your process and data (order formats, product knowledge, internal rules), assemble. - Consider self-hosting only if at least one of these is true: - the data must not leave your control by contract or policy - volume is high and steady enough to keep hardware busy - you need operation without internet access

You also need someone who can run it. A server nobody patches is a bigger risk than a well-audited cloud service. - Leave special categories and covert employee evaluation to the DPO before choosing any path. A DPIA will likely be required regardless.

5. Calculate TCO over three years, not the licence price. Include the following for each path: - licences or tokens at realistic volume, plus a peak scenario - integration and configuration days - data preparation, which is often the largest item (GUIDE-003) - training and change management - operation: monitoring, model updates, support (GUIDE-011) - for self-hosting: hardware, power, hosting, backup, and staff time for security updates - exit costs: data export, re-building prompts and integrations

Compare the paths at the same quality level. A cheap model that needs constant manual correction is not cheap. Ask vendors for usage figures from a pilot instead of relying on list prices.

6. Check the provider (cloud and buy paths). - Data protection: obtain the AVV, the list of sub-processors with their locations, and the basis for any third-country transfer. Get written confirmation that your inputs are not used for training. - Security: request the BSI C5 attestation or the ISO 27001 certificate. The BSI advises cloud customers to request the C5 report at selection, review it annually and analyse it themselves, because the BSI does not evaluate the reports. C5 also shows which security tasks stay with you as the customer. A revised edition, C5:2026, has been published alongside C5:2020 [1]. - Model changes: ask how you will be notified of model changes and whether you can pin a version.

Details are in GUIDE-010.

7. Design the exit before signing (1 day with legal and IT). Make sure the following are covered: - Data export: in which format, and within what deadline. - Content you build: keep prompts, workflows and evaluation test sets in your own repository. - Model independence: prefer an abstraction layer or a platform that supports several model providers. - Contract terms: check termination notice periods, and check that switching charges follow the Data Act timeline [3].

A simple test: could you switch the model behind your RAG assistant within four weeks?

8. Record the decision and review it. Keep one page per use case with the data class, the chosen path, the TCO, the exit plan and the approvals from the DPO, IT security and the works council if needed. Review it after the pilot and at each renewal.

Checklist

  • [ ] Use case described with volume and worst-case error impact
  • [ ] Data classified; anonymisation/redaction option checked
  • [ ] Paths compared: buy / assemble / self-host
  • [ ] Three-year TCO incl. data preparation, operation and exit
  • [ ] AVV, sub-processor list and transfer basis reviewed by DPO
  • [ ] C5 or ISO 27001 evidence reviewed by IT security
  • [ ] No training on your inputs confirmed in writing
  • [ ] Model-change notification / version pinning clarified
  • [ ] Exit plan: export format, prompts and workflows stored in-house, second model tested
  • [ ] AI Act role checked (deployer vs. provider if you modify or rebrand)
  • [ ] Works council informed / involved if user activity is logged
  • [ ] Decision documented with review date

Templates & tools

  • BSI C5 criteria catalogue: the security baseline for cloud services, with guidance for cloud customers on using audit reports [1].
  • BSI "Generative KI-Modelle – Chancen und Risiken für Industrie und Behörden": a living document on risks and countermeasures across the life cycle of LLM-based systems. Use it for the self-host versus cloud threat model [8].
  • DSK Orientierungshilfe "Künstliche Intelligenz und Datenschutz" (May 2024): criteria for selecting and using LLM applications as a controller [2].
  • Mittelstand-Digital Zentrum Chemnitz, "Die Qual der Wahl": a guide to choosing an LLM for SMBs, covering cloud and on-premise/edge operation as well as the AI Act and data protection [6]. Mittelstand-Digital centres offer free, vendor-neutral advice.
  • Commission guidelines for GPAI providers: relevant if you plan substantial fine-tuning [7].

Common pitfalls

  • Treating "self-hosted" as automatically compliant. Self-hosting does not replace a legal basis, a DPIA, access rights, logging or co-determination. Only the AVV with the model provider disappears.
  • Treating "EU region" as the whole answer. Check the sub-processors, support access from third countries and the transfer basis. Keep an eye on the pending Latombe appeal [5].
  • Leaving data preparation out of the budget. Cleaning, structuring and setting access rights for documents usually costs more than the model, whichever path you choose.
  • Per-seat creep. Licensing a copilot for everyone before measuring use. Start with a pilot group.
  • Ignoring token cost spikes. Agentic workflows and long contexts multiply usage. Set budgets and alerts with the provider.
  • Lock-in through convenience. Prompts and workflows that live only in a vendor's UI cannot be exported. Version them yourself.
  • Skipping the people. End users and the works council judge whether a "good enough" standard tool is really good enough. Involve them in the comparison, not just at rollout.

Sources

  1. BSI: Kriterienkatalog C5 (Cloud Computing Compliance Criteria Catalogue), incl. C5:2020 and C5:2026, guidance for cloud customers. https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/kriterienkatalog-c5_node.html
  2. Datenschutzkonferenz (DSK): Orientierungshilfe "Künstliche Intelligenz und Datenschutz", Version 1.0, 6 May 2024. https://www.datenschutz-bayern.de/dsbk-ent/DSK_OH_KI_und_Datenschutz.pdf (press release: https://datenschutzkonferenz-online.de/media/pm/2024_05_06_DSK_PM_OH_KI_und_Datenschutz.pdf)
  3. Regulation (EU) 2023/2854 (Data Act), Chapter VI switching between data processing services (Art. 23–31), switching charges ending 12 January 2027; overview: DLA Piper, "Cloud exit under the EU Data Act" (2026). https://www.dlapiper.com/insights/publications/law-in-tech/2026/cloud-exit-under-the-eu-data-act and Deloitte Legal https://www.deloittelegal.de/dl/en/services/legal/perspectives/cloud-switching-eu-data-act.html
  4. General Court, judgment of 3 September 2025, T-553/23 Latombe v Commission; summary: Clifford Chance, "Transatlantic data transfers: where the DPF stands post-Latombe". https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2025/09/transatlantic-data-transfers-where-the-dpf-stands-post-latombe.html
  5. Appeal C-703/25 P, Official Journal notice. https://eur-lex.europa.eu/eli/C/2025/6610/oj/eng ; WilmerHale, "European Court of Justice to Review Challenge to EU-U.S. Data Privacy Framework" (1 Dec 2025). https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20251201-european-court-of-justice-to-review-challenge-to-eu-us-data-privacy-framework
  6. Mittelstand-Digital Zentrum Chemnitz: "Die Qual der Wahl" – Auswahl eines Large Language Models. https://digitalzentrum-chemnitz.de/downloads/nachgelesen_auswahl-large-language-model/
  7. European Commission: Guidelines on the scope of obligations for providers of general-purpose AI models (downstream modification, one-third compute criterion); overview: https://artificialintelligenceact.eu/gpai-guidelines-overview/
  8. BSI: Generative KI-Modelle – Chancen und Risiken für Industrie und Behörden. https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/KI/Generative_KI-Modelle.pdf

Accessed 2026-10.