GDPR exposure
What is ungoverned AI use already costing us?
The risk you carry before spending anything: how many people pass sensitive data, with what probability of an incident and what expected cost.
- ≈ 2 min
- Free calculation · AI commentary on request
- You leave with: The annual risk in euros, against the cost of compliance
What is already in place
A published, accessible document staff know about — not one still going through approval.
Processing agreements with the vendors in use, no-training settings enabled, processing register current.
The most decisive of the three: a rule with no sanctioned alternative is very widely ignored.
Your exposure
Closing all three controls costs about 11.9 years of exposure — after which the risk does not come back.
The figures above are computed and free. If you also want them read back to you — what they mean, what is specific to your sector, where to start — that is produced on request.
How the figure is reached
A four-link chain, each link arguable on its own. Deliberately so: a figure you cannot decompose is a figure you cannot defend in a committee.
| Line | Estimate |
|---|---|
| Set-up | |
Cost of closing the gap Usage charter. DPAs and processing register. A sanctioned tool for all active users. | €36,840 €20,560 — €68,760 |
| Risk | |
Users outside the framework About 60 of 80 people use AI tools outside any framework. 3 controls are missing, which pushes it toward the top of the published band. | €60 €50 — €60 |
Of whom exposing sensitive data About 7 people pass confidential or personal data to a third-party service with no documented legal basis. | €7 €3 — €12 |
Cost of one incident Investigation, notification, legal counsel and remediation, plus a sanction weighted by the chance one is actually issued — not by its theoretical ceiling. | €67,500 €15,000 — €425,000 |
Expected annual cost Probability × impact. Read it properly: a 4.6% chance of a €68k incident — not an annual bill of €3k. | €3,102 €172 — €58,595 |
The expected annual cost is a mathematical expectation, not a forecast. It does not mean you will pay this sum this year: it means a low probability of a high cost, averaged out, is worth this much. That is the form in which a risk enters a budget — but planning should be done against the incident, not against the average.
The assumptions
Every figure above rests on these. The ones marked “assumption” have no external source: they are modelling choices, labelled so they can be argued with rather than mistaken for measurements.
- Shadow use 75 %Published
- Share of knowledge workers using AI tools without employer sanction. Consistently reported between a third and three quarters; the figure rises where no sanctioned tool exists.
- Sensitive data passed 11 %Published
- Share of shadow-AI interactions carrying confidential or personal data. ~11% is the widely-cited central figure.
- Incident probability 4.6 %/anAssumption
- Likelihood that ungoverned AI use produces a reportable personal-data incident in a given year. No published base rate isolates AI as a cause, so this is explicitly a modelling assumption and the range is wide on purpose.
- Weighted sanction 7,500 €Published
- GDPR sanctions run to 4% of worldwide turnover, but the overwhelming majority of CNIL decisions are formal notices carrying no fine. The low end is zero because that is the most likely single outcome — the expected value, not the headline maximum, is what belongs in a business case.
What the calculation does, what the AI does
Every figure on this page comes from a deterministic algorithm running in your browser: the same input always gives the same result, and nothing is sent to produce it. AI runs only afterwards, to write the commentary from those figures. It produces none of them — the format it fills has no numeric fields — and any sentence quoting a value the calculation did not produce is removed before display.
Where to go next
See all 19 tools →- Pitfall radar
What is going to go wrong in our programme, and what will it cost?
≈ 2 min · Detected pitfalls, their weighted cost and the fix for each - EU AI Act
Is our system high-risk, and what does that oblige us to do?
≈ 4 min · The classification and the applicable obligations, article by article - Assess vendors
Which vendor should we trust with our data?
≈ 5 min · A ranking of vendors, knock-outs included - Cost calculator
What does our AI transformation actually cost, and when does it break even?
≈ 3 min · A line-by-line budget, the return and the break-even month - AI usage policy
Our teams already use AI: what rules do we give them, in writing, this week?
≈ 4 min · A complete AI usage policy, ready to sign - Roadmap
In what order, and over how long?
≈ 3 min · Quarterly phases and what each one delivers