
AI and GDPR: how Hungarian companies can use LLMs lawfully
Legal basis, a DPA with the AI provider, EU data residency, pseudonymisation, retention and training opt-out, the balancing test, the AI Act and a checklist.
Six evaluation criteria, a comparison table, recommendations by task type and a router pattern with code: how a company picks an LLM in 2026.

Model selection in 4 steps
Context size, structured output, tool use, latency needs and data sensitivity per task.
50-100 real examples from your data; the same prompt on two models from each provider.
Cost per task and accuracy in one table; public benchmarks stop mattering here.
Route by task type, keep a second provider as fallback, abstract the client for switching.
"Which model should we pick?" is the most common question we get on the first call of an AI project, and the least useful one. In 2026, the flagship models from the three major providers (Anthropic, OpenAI, Google) perform within a few percentage points of each other on most business tasks according to public benchmarks — while on your specific task the gap can be 15-20 percentage points, just not necessarily in the direction the leaderboard suggests.
This article is not a ranking. It's a method for choosing a model for a concrete business task: six evaluation criteria, a comparison table reflecting the state of play in Q3 2026, recommendations by task type, and a router pattern with code that keeps you from locking into a single provider.
Two things up front. Prices and capabilities change fast: every number here carries a date and should be read as an order of magnitude, not a fixed fact. Second: model choice affects roughly 5-15% of a project's cost; the prompt, the eval set and the integration account for the rest. If those aren't solid, switching models won't save you.
At the end of the article there's a checklist you can run against your own task. It's the same method we described for use-case selection in AI implementation for Hungarian SMEs: your own data, your own measurement, a dated decision.
Six criteria we go through on every project. The order isn't a ranking of importance — the task decides which one carries the most weight.
In 2026, all three providers offer models with context windows above 200,000 tokens, with the Gemini line exceeding 1 million. But size isn't the same as usability: models retrieve information placed in the middle of a long context with varying reliability, and you pay for the full input regardless. A 300-page contract bundle submitted in one go is more expensive and less accurate than a RAG-based partial load.
If the model needs to call tools (CRM, ERP, search), the question isn't whether it supports tool calling, but how reliably it picks the right tool and fills in the parameters. You can only measure this on your own toolset. The pilot described in AI agents for SMEs measures exactly this.
Invoice extraction, categorization, data migration: the output is JSON, not prose. All three providers offer schema-constrained output (JSON schema or similar), but the valid-JSON rate and field-level accuracy differ by task. This you measure, not assume.
For a customer-service chat, a 2-second first token is acceptable; 8 seconds is not. For batch processing, latency is irrelevant — throughput and batch discounts matter instead. Small models are 3-5 times faster and, on many classification tasks, just as accurate.
As of Q3 2026, prices run roughly as follows: the smallest models cost $0.10-0.50 per million input tokens, mid-tier models $1-3, the largest $5-15; output tokens cost 3-5 times more. Exact figures shift quarterly, and prompt caching and batch APIs bring 50-90% discounts. Calculate cost per task in HUF, not per token.
Which region processes the data, is there a data processing agreement (DPA), is training use excluded, how long is the prompt retained. In 2026, all three providers offer business terms with a training opt-out; EU-region processing is available on Google's (Vertex AI) and Microsoft's (Azure OpenAI) clouds, and through some of Anthropic's cloud partners. We cover the details in AI and GDPR for Hungarian companies.
The table compares the three providers' model families, not a single specific version; each has a small, medium and large model. The assessment reflects our own project and eval-set experience through August 2026, not an independent benchmark.
| Criterion | Claude (Anthropic) | GPT (OpenAI) | Gemini (Google) |
|---|---|---|---|
| Context window | 200k+ tokens | 200k-1M tokens depending on model | 1M+ tokens on flagship models |
| Tool use reliability | Strong, native MCP support | Strong, extensive ecosystem | Good, tightly integrated with Google services |
| Structured output | Schema-constrained, tool-based JSON | JSON schema strict mode | JSON schema, response_schema |
| Long-document processing | Strong accuracy at medium length | Good | Strong on very long inputs |
| Hungarian language | Good phrasing, fewer grammatical errors | Good | Good, occasionally reads as a literal translation |
| Latency (mid-tier model) | 1-3 s to first token | 1-3 s | 1-2 s |
| Price (mid-tier model, Q3 2026) | $1-3 / M input | $1-3 / M input | $0.50-2 / M input |
| EU-region processing | Via cloud partner (AWS/GCP EU) | Azure OpenAI EU regions | Vertex AI EU regions |
| Training opt-out on business terms | Yes | Yes | Yes (Vertex / paid API) |
| Prompt cache / batch discount | Yes / yes | Yes / yes | Yes / yes |
What the table can't tell you: which model is more accurate on your invoices, your tickets, your contracts. There's only one way to find out: 50-100 real examples, the same prompt, two models from each provider, and a table with accuracy and cost per task in HUF.
Note: Public benchmarks (MMLU, HumanEval, SWE-bench and the like) measure well-defined tasks in English. The accuracy of a Hungarian-language extraction task on noisy OCR text doesn't follow from these. A benchmark is useful for ruling out clearly weak models; it's not enough to base a decision on.
The recommendations below come from our own experience, and your own eval will override them. The pattern, however, is stable: a small model where the task is closed-ended; a large model where judgment is required; the mid-tier model is sufficient almost everywhere else.
| Task type | Recommended size | What to watch |
|---|---|---|
| Classification, tagging, routing | Small model | Latency and price; a large model here is wasteful |
| Structured extraction (invoice, form) | Medium, with schema constraints | Field-level accuracy, valid-JSON rate |
| Long-document summarization | Medium or large, with a large context window | Mid-context retrieval accuracy |
| Customer-service replies in Hungarian | Medium | Quality of phrasing, hallucination rate |
| Agent, multi-step tool use | Large or a strong medium | Tool-selection reliability, number of steps |
| Code generation, refactoring | Large | Test pass rate, not the demo |
| Batch data cleanup | Small or medium, via batch API | Throughput, batch discount |
A pipeline categorizing 5,000 emails a day costs 150,000-300,000 HUF per month on a large model at 2026 prices, versus 15,000-30,000 HUF on a small model, with the same accuracy, provided the categories are well defined. A large model is justified only when it's measurably better on the eval set and that difference is worth more in money than the extra cost.
Contract comparison, where the question is "what changed between the two versions and does it matter," or a 12-step agent where errors compound: here the small model's inaccuracy costs more than the large model's token price.
An online store receives 800 incoming messages a day by email and chat. The pipeline's three steps use three different model sizes, and that's not a design choice — it's what the eval set showed.
The first step is classification: order status, return, invoice, complaint, other. A small model, a 40-token output, 0.3 seconds, 0.2-0.5 HUF per message. On the eval set, the small model scored 96%, the large model 97%; that one percentage point isn't worth a twentyfold price increase.
The second step is auto-replying to order-status and return questions: a medium model, tool use against the order API, a 200-300 token reply in Hungarian. Here the small model scored 81% (wrong tone, missing steps), the medium model 93%; the difference shows up in the customer experience, so the medium model won.
The third step handles complaints: there's no automatic reply here — the large model drafts a summary and a suggested response for the human agent, who decides. There are 60-80 such messages a day, at 20-40 HUF per message, because the model needs to see the full history. The total daily LLM cost for all 800 messages comes to roughly 3,000-5,000 HUF at 2026 prices, versus 25,000-40,000 HUF if every step ran on the large model.
Building on a single provider is a business risk in 2026: price changes, model deprecations, regional availability, outages. A multi-model architecture has three parts: an abstraction layer, a router, and a fallback.
A single internal interface (complete(task, input)) behind which provider-specific clients live. Prompts are provider-independent templates; the adapter handles the differences (tool format, schema declaration). This is what turns switching providers into a configuration change instead of a rewrite.
The router decides based on task type, input size and sensitivity. You don't need a "smart" router (one that uses an LLM to decide on a model) — a rule-based one is enough: predictable, testable, cheap.
// Rule-based LLM router with an abstraction layer (TypeScript, simplified)
type Provider = 'anthropic' | 'openai' | 'google';
type Tier = 'small' | 'medium' | 'large';
type Task = {
kind: 'classify' | 'extract' | 'summarize' | 'agent' | 'chat';
inputTokens: number;
sensitive: boolean; // personal data → EU-region route only
};
type Route = { provider: Provider; tier: Tier; region: 'eu' | 'global' };
const EU_ONLY: Provider[] = ['google', 'openai']; // example: Vertex EU, Azure EU configuration
export function route(task: Task): Route {
const region = task.sensitive ? 'eu' : 'global';
const providers = task.sensitive ? EU_ONLY : (['anthropic', 'openai', 'google'] as Provider[]);
let tier: Tier = 'medium';
if (task.kind === 'classify') tier = 'small';
if (task.kind === 'agent') tier = 'large';
if (task.kind === 'summarize' && task.inputTokens > 150_000) tier = 'large';
// Preferred provider by task type; the order is configuration, not code.
const preferred = PREFERENCE[task.kind].filter((p) => providers.includes(p));
return { provider: preferred[0], tier, region };
}
export async function complete(task: Task, prompt: PromptTemplate, input: unknown) {
const primary = route(task);
const candidates = [primary, ...fallbacksFor(primary)];
for (const r of candidates) {
try {
return await adapters[r.provider].complete({ ...r, prompt, input, timeoutMs: 20_000 });
} catch (err) {
if (!isRetryable(err)) throw err; // schema error, permission issue: don't fall back blindly
metrics.fallback(r, err);
}
}
throw new Error('all providers failed');
}
The PREFERENCE table says which provider's small model comes first for classification, which medium model for extraction, and so on. It comes from the eval set's results, and we re-measure it every quarter.
Fallback isn't the same as routing: it kicks in only when the primary provider fails (timeout, 5xx, rate limit). Two rules: on a schema-validation error, we don't blindly switch to another provider, because the prompt itself may be at fault; and we track the fallback rate, because if it goes above 5%, something is wrong with the primary provider.
Switching cost is the most commonly underestimated line item. Rewriting the client code isn't the expensive part — everything around it is.
| Item | With an abstraction layer | Without one |
|---|---|---|
| Client code | Configuration, 0-1 day | 2-5 days |
| Re-tuning prompts | 2-5 days (each model has its own style) | 5-10 days |
| Re-running and comparing the eval set | 1-2 days, if an eval exists | Nothing to compare against |
| Tool schemas and structured output | Handled by the adapter | Manual, on every call |
| Legal: new DPA, updated privacy notice | 1-3 weeks turnaround | Same |
Switching is cheap when the eval set and the abstraction layer are in place from day one. Without an eval, you won't know after switching whether the system got better or worse — that's the real risk, not the code.
Tip: Run your eval set on two providers even in your very first project, even if you end up choosing just one. The second provider's results sit in your back pocket as a ready-made plan B: if pricing or terms change with the first, you can decide within a day.
Four reasons a public leaderboard can mislead you on your own task:
The practical method: use the benchmark as a filter (drop the bottom third of the list), and let the eval set make the decision. The eval-building approach described in defending against LLM hallucinations applies here directly.
As of Q3 2026, the medium and large models from all three providers produce usable Hungarian text; the gap varies by task and can be measured in a day with 50-100 examples from your own eval set. Instead of a ranking, compare the measured accuracy and the cost per task in HUF.
Yes, if you have an abstraction layer: routing by task type (a small model for classification, a large one for agent work) can bring a 3-10x cost difference, and a second provider serves as a fallback during an outage or a price change. The extra cost is one adapter layer, which runs 2-4 days on a mid-sized project.
As of 2026, EU-region processing is available on Google Vertex AI and Microsoft Azure OpenAI's EU regions, as well as through Anthropic's cloud partners; business terms from all three providers include a training opt-out and a DPA. For personal data, the router should allow only the EU-region route.
Roughly: classification with a small model, 0.1-1 HUF per task; structured extraction with a medium model, 5-30 HUF per document; a multi-step agent run, 30-500 HUF. Token prices shift quarterly; prompt caching and batch APIs save 50-90% on the tasks that qualify.
Model choice in 2026 isn't a brand question. The flagship models from the three major providers perform close to each other; the difference measured on your own task is the only thing that matters, and you can only measure it with your own eval set. The six criteria (context, tool use, structured output, latency, price, EU data handling) carry different weight depending on the task, so there's no single right answer — only one that's right for a given task.
Architecture matters more than the choice itself: an abstraction layer, a rule-based router, a measured fallback. With that in place, switching models becomes a configuration change rather than a project, and a price change or deprecation becomes a one-day decision rather than a risk.
The practical sequence: write down the task profile, gather 50-100 real examples, run them on two or three models, put accuracy and cost per task in HUF into one table, and decide from the table. Re-run it every quarter.
Related articles: AI agents for SMEs in 2026, Building a RAG chatbot, AI and GDPR for Hungarian companies.
If you need to choose a model for a specific task, or your existing system is locked into one provider and you'd like to change that, book a 30-minute call: we'll go through the task profile with you and tell you what's worth measuring before you rewrite anything. In our AI automation projects, this is the first week's work.
About the author
Corevanix Kft.
Technology partner
Budapest-based technology partner — SAP/ERP integration, web development, AI automation and mobile app development. We work inside the client’s own environment, and the delivered code belongs entirely to the client.

Legal basis, a DPA with the AI provider, EU data residency, pseudonymisation, retention and training opt-out, the balancing test, the AI Act and a checklist.

Prompts are code: repo, versioning, review, template structure, few-shot examples, eval sets, regression tests, injection defence, cost and observability.

OCR + LLM pipeline, JSON-schema extraction, validation with human-in-the-loop, SAP/ERP integration, error-rate tracking and ROI for invoices and contracts.