Cheap is not less — Sonar measured what one pull request actually costs, and the number the GDPR counts is not the invoice

Sonar published a session trace on 1 September 2026 for one 800-line backend change: 512 model round-trips, a context window peaking at 458,700 tokens, 152.8 million cache-read tokens - what the post calls the re-billed transcript - and roughly 41 dollars, with 18 comparable pull requests in the same repository averaging about 234 million context tokens and about 65 dollars each against a 52 dollar median. The obvious reading is a cost story, and the correction is that the same measurement is a volume-of-processing number: the re-billed transcript is roughly 333 times the peak context window, and GDPR Article 4(2) names retrieval and consultation among the operations that constitute processing, with no threshold of cost or novelty attached, so a prompt-cache read of content already sent is not outside the Regulation for being cheap or for being a repeat. Article 5(1)(c) then tests necessity against the operation rather than the invoice and Article 5(2) puts the burden of demonstrating it on the controller, which is why an agent that re-reads a fixture file on 470 turns has 470 turns to justify. The contrast is the calendar: the Digital Omnibus, Regulation (EU) 2026/1744, moved the AI Act's Annex III high-risk obligations to 2 December 2027, while the data-minimisation duty has applied since 25 May 2018 and was not deferred - so the practitioner moves are to count file reads per turn rather than tokens in one real session log, to mark which of those files carry real personal data (fixtures and seed data, not src), to check whether the processor terms cover a cached transcript held for the length of a session rather than only prompts and outputs, and to enter the agent harness in the Article 30 record as its own processing activity with the retention the cache actually has.

Post

Sonar traced one pull request and published the receipt. An 800-line backend change. The transcript came to 152.8 million tokens.

On 1 September, Sonar research engineer Antonio Aversa published the session trace behind Sonar Vortex. One single-ticket PR: 512 model round-trips, a context window peaking at 458,700 tokens, 152.8 million cache-read tokens — what the post calls "the re-billed transcript" — and roughly $41. Across 18 comparable PRs in the same repo: ~234 million context tokens each, ~$65 per PR, median ~$52.

It is a cost post, and a good one. Three things before you file it as a bill to optimise.

  1. The window is not the volume. Teams size the context window and argue about whether 458,700 tokens is enough. The transcript actually processed was 333 times larger. The window tells you nothing about how many times your repository crossed the wire.

  2. A cache read is processing. GDPR Article 4(2): processing is "any operation ... such as collection, recording, ... storage, ... retrieval, consultation, use, disclosure by transmission". Retrieval and consultation are both named. Price is not in the definition. Caching lowered your bill; it did not lower the count.

  3. Which makes Article 5(1)(c) the live one. Personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". Necessity is tested against the operation, not the invoice. An agent that re-reads a fixture file on 470 turns has to justify 470 turns.

Monday:

  1. Take one agent session log. Count file reads per turn, not tokens.
  2. Mark which of those files carry real personal data. Fixtures and seed data are where it hides, not src.
  3. Read your DPA. It probably covers "prompts and outputs". Ask whether it covers a cached transcript held at the provider for the length of a session.
  4. Put the harness in your Article 30 record as its own processing activity, with the retention that actually applies to the cache.

And the calendar. The Digital Omnibus moved Annex III high-risk to 2 December 2027 — real runway. Article 5(1)(c) has applied since 2018. Nobody deferred that one.

Caching made the transcript cheap. It did not make it smaller.

How many times did your agent read that file?

#EUAIAct #DSGVO #AgenticAI #AIGovernance #SoftwareEngineering

First comment

Sources, primary first.

Sonar, "Stop the context tax" — Antonio Aversa, research engineer, 1 September 2026. The 512 round-trips, the 458,700-token peak, the 152.8 million cache-read tokens and the 18-PR averages all come from here. https://www.sonarsource.com/blog/stop-the-context-tax/

Sonar's own launch release for Sonar Vortex and the SonarQube Remediation Agent — dated 30 June 2026, not this week. The product is two months old; the measurement is what is new. https://www.sonarsource.com/company/press-releases/sonar-launches-sonar-vortex-and-sonarqube-remediation-agent/

GDPR Article 4 — the definition of processing at 4(2), where retrieval and consultation are both named. https://gdpr-info.eu/art-4-gdpr/

GDPR Article 5 — the principles; 5(1)(c) is data minimisation. https://gdpr-info.eu/art-5-gdpr/

One point cut for length: the release also claims a 36% reduction in token consumption on refactoring tasks — Sonar's own measurement, on Java, Python, TypeScript and C#, against Claude Opus 4.8. It is a vendor benchmark of a vendor product and I have not reproduced it. The figure I would actually act on is the one they measured on themselves: ~$65 mean per PR against a ~$52 median. That gap is not noise. It is your worst pull requests, and they are the ones re-reading the most.

Claims

Sources

Corrections

The aggregator sweep listed "SonarSource quantifies the 'context tax' and ships an agent-friendly code graph (Sonar Vortex)" as news of 2 September 2026. Two dates are wrong in that framing and both were corrected before publication:

  • The engineering post is dated 1 September 2026 on Sonar's own blog, not 2 September. The event date is used.
  • Sonar Vortex did not ship this week. Sonar's own press release dates the launch of Sonar Vortex and the SonarQube Remediation Agent to 30 June 2026 at the AI Engineer World's Fair, described as available that day. The product is two months old; only the measurement is new, and the edition says so.
  • The ~$0.20/million cache-read price underpinning Sonar's $0.54 example is stated without naming a model or provider. It is carried as the source's own assumption and the derived dollar figure was kept out of the post.
  • Considered and dropped: JetStream's Clearance announcement (dateline 2 September 2026, listed by the same aggregator as 3 September). A real practitioner story, but the day's stronger measurement was Sonar's.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice and the cover art is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.