UK DUAA right to complain enforces in -- days · 19 June 2026 EU AI Act high-risk enforces in -- days · 2 August 2026

Free Snapshot

See whether your AI use may create governance or regulatory exposure.

You may have AI risk before you think of yourself as an AI company.

If your app, website, workflow, agent, chatbot, form, internal tool, or vendor process uses AI or handles names, emails, prompts, uploaded files, customer data, employee data, health data, financial data, or decisions about people, governance obligations may already be in scope.

This free snapshot helps you see whether your AI use, data handling, operating regions, and current evidence position create possible exposure.

It does not score your organisation, provide a remediation pathway, produce a verdict, include FRIA, create an audit-grade review, or provide legal advice.

Use this if you need to answer: do we have something we need to look at?

OBEXGATE does not retain your assessment intake answers. Each report is generated fresh from the information you submit. We do not have access to previously entered assessment information after report generation. Payment processing, email delivery, and legally required transaction records may be handled separately by the relevant service providers.

Choose the level of AI governance review you need

Tier 1

Free Snapshot

Find out whether your AI use, data handling, or operating model may create governance or regulatory exposure.

Tier 2

$4.99 Pre-Qualification

Understand what regulations may possibly apply, whether you may need documentation, and how to start fixing the issue.

Tier 3

$199 Governance Foundation

Receive a weighted AI governance report, likely regulatory issues, practical remediation next steps, and a 30-minute expert call.

Tier 4

Full EVF

For organisations that need an audit-grade starting point to hand over to auditors, regulators, risk teams, compliance officers, procurement, investors, or General Counsel under the current regulatory landscape.

Q1

Where does your organisation operate or serve users?

Select all that apply. Customers, users, employees, vendors, or operations.

Select at least one region to continue.

Q2

Approximate annual revenue?

Choose one band, then fine-tune. Drives statutory maximums and your three-year cost basis.

Values are interpreted in your selected currency.

Fine-tune £25M

Applies to all monetary values on this page.

Choose a revenue band to continue.

Q3

What kind of data may be in scope?

Select all that apply. Including data handled through vendors.

Select at least one option to continue.

Q5

What operating environments apply?

Select all that apply. Many organisations span more than one.

Select at least one option to continue.

Q6

If asked how your AI is controlled, what could you show today?

Regulators evaluate evidence, not intent.

Select at least one option to continue.

A written policy or internal guidelines Some technical controls or system logs Both policy and technical evidence We could pull something together with time We're not sure what we would show

Select at least one option to continue.

Optional

Who is responsible for AI governance?

Select at least one option to continue.

A clearly named individual A formal group or committee Shared across teams informally No one has been formally assigned Not sure

Optional

If you needed to show how AI is managed, what do you already have?

Select all that apply. Strengthens the report; will not block submission.

A list of AI systems in use Risk or impact assessments Human review or oversight processes Records of issues or incidents Documentation from AI vendors or tools Training or guidance for staff using AI None of these Not sure what would be required

Statutory exposure

Aggregate statutory maximum across applicable regimes.

Sum of statutory maxima under the regulatory frameworks that apply to your jurisdictions, data types, sectors, and AI usage. Not indicative of actual enforcement outcomes.

These are parallel statutory maxima across applicable frameworks, not a single enforcement path.

Answer the questions above to see your statutory exposure.

Aggregate statutory maximum across applicable regimes

-

Sum of statutory maxima across applicable regimes; not indicative of actual enforcement outcomes.

Health records held (HIPAA Tier 2 calculation)

Framework	Citation	Amount

Methodology and assumptions

Figures reflect statutory maximum penalties under each framework current as of date of report generation. They represent parallel statutory maxima across applicable regimes, not guaranteed simultaneous enforcement, and are not indicative of actual enforcement outcomes.

The EU AI Act figure shows the high-risk systems tier (Article 99(4)), calculated as the higher of EUR 15M or 3% of global annual turnover. Prohibited practices carry a higher tier (EUR 35M or 7%) under Article 99(3) but apply only to specific illegal AI uses and are not included by default. The SME proportionality rule (Article 99(6)) is applied for organisations with annual turnover below EUR 50 million.

GDPR is calculated under Article 83(5) as the higher of EUR 20M or 4% of global annual turnover.

UK GDPR and the Data Protection Act 2018 mirror the GDPR structure, calculated as the higher of GBP 17.5M or 4% of global annual turnover.

DORA, enforceable since 17 January 2025, is calculated at up to 2% of annual turnover; national competent authority frameworks may impose additional penalties not captured here.

FCA and PRA enforcement is uncapped and context-dependent under FSMA 2000 s206. The figure shown is an illustrative benchmark only and does not represent a statutory ceiling.

HIPAA exposure is calculated on a per-violation basis using the Tier 2 reasonable cause minimum of USD 1,461 per violation, subject to the annual cap of USD 146,029 under the 2019 Notice of Enforcement Discretion. The health records slider drives this calculation. Civil litigation and class-action exposure operate on a separate basis and are not included.

LGPD penalties (Article 52) are calculated as 2% of Brazilian revenue, capped at BRL 50 million per violation.

Australian Privacy Act penalties (Section 13G) follow the greater-of structure: AUD 50 million or 30% of adjusted turnover, whichever is higher.

New Zealand Privacy Act 2020 figures reflect the maximum statutory criminal fine of NZD 10,000 per offence under Section 212. Civil damages via the Human Rights Review Tribunal are a separate liability surface, capped at NZD 350,000 per affected individual, and are not included.

Canadian privacy and AI frameworks are captured in the jurisdiction selection but do not currently produce a calculator effect; this will be added in a future revision.

Foreign exchange rates are approximate and refreshed on a 30-day rolling basis (current rates set 25 April 2026). Information contained is not legal or financial advice or a guarantee of outcome.

Three-year cost

What this is already costing you.

Operational governance cost over three years, and the portion OBEXGATE displaces. Adjust assumptions if the defaults do not fit your structure.

Most of this cost exists because governance is manual and unverifiable.

Answer Q2 (revenue) above to see your three-year cost.

Cost profile Set from your revenue and sector. Change to override.

One-off displaceable build / consulting

-

Annual displaceable workload

-

3-year displaceable cost basis

-

OBEXGATE does not replace governance leadership or external legal counsel. It reduces a defined portion of operational workload across governance, documentation, and audit preparation functions. Illustrative displacement assumptions: governance lead 30%, analysts 50%, legal 0%, regulatory tracking 80%, GRC tooling 50%, audit preparation 60%. Actual impact varies by organisation.

Adjust assumptions

Internal governance staff

Governance lead salary (loaded)

Compliance analysts (count)

Per analyst (loaded)

External consulting

Initial deployment / consulting (one-off)

External legal review (annual)

Regulatory update tracking (annual)

Tooling and audit

Current GRC tooling (annual)

Audit preparation (annual)

Estimates provided are illustrative and based on typical organisational cost structures. They do not constitute a guarantee of cost reduction or operational outcome. Actual costs, savings, and resource allocation will vary based on organisational structure, regulatory scope, and implementation approach. Currency conversions use FX rates as of 25 April 2026. Nothing presented constitutes financial, legal, or compliance advice. Estimates should be reviewed by your governance and compliance team and General Counsel before being relied upon for decision-making.

Send the report to yourself

Email the exposure snapshot to yourself.

This free assessment is an exposure snapshot only. It does not include scoring, FRIA, audit-grade review, legal advice, a remediation pathway, or a verdict.

Name *

Enter your name to continue.

Email *

Enter a valid email address.

Company (optional)

Phone (optional)

Report language

Reports in non-English languages are machine translated. Help us improve by flagging issues to hello@obexgate.com.

Estimates only. Not legal or regulatory advice. Actual obligations and exposure depend on your specific implementation.

Free assessment only: no score, no remediation pathway, no verdict, no FRIA, no audit-grade review, and no legal advice.

After the snapshot, the next step depends on what you need to know or prove.

PDF emailed within a few minutes.

What to do after the free snapshot

If the snapshot shows possible exposure, the next step depends on what you need to understand or prove.

Choose the $4.99 Pre-Qualification Report if you want to understand what regulations may possibly apply, whether you may need documentation, and how to start fixing the issue.

Choose the $199 Governance Foundation Report if you need a weighted AI governance score, a full written report, likely regulatory issues, practical remediation next steps, and a 30-minute expert call.

Choose Full EVF if you need a document to hand over to auditors, regulators, risk teams, compliance officers, procurement, investors, or General Counsel as a starting point for your organisation under the current regulatory landscape.

Get the $4.99 Pre-Qualification Report Start the $199 Governance Foundation Report Explore Full EVF

Or talk it through with a governance specialist.

30-minute working call. No slide deck, no demo. We work through the same numbers with you and identify the next concrete step.

Walk Through My Results

Report on its way

Check your inbox.

We've sent the exposure snapshot to your email. It should arrive within a few minutes. If you do not see it, check your spam folder.

OBEXGATE does not retain your assessment intake answers. Each report is generated fresh from the information you submit. We do not have access to previously entered assessment information after report generation. Payment processing, email delivery, and legally required transaction records may be handled separately by the relevant service providers.

Walk through your numbers with a governance specialist.

Most teams find the report most useful after a 30-minute conversation. We work through your specific exposure and identify the next concrete step.

Walk Through My Results