Run Your System

See what happens when your system meets enforcement.

Plain-language inputs simulate enforcement conditions across applicable regulatory frameworks. Answer what you know; uncertainty is part of the signal.

This reflects how your system behaves under real constraints, not how it is described internally.

No login. No integration. No sales process. Inputs stay in this browser until you submit your report request.

Where does your organisation operate or serve users?

Select all that apply. Customers, users, employees, vendors, or operations.

Select at least one region to continue.

Approximate annual revenue?

Choose one band, then fine-tune. Drives statutory maximums and your three-year cost basis.

Values are interpreted in your selected currency.

Fine-tune £25M

Applies to all monetary values on this page.

Choose a revenue band to continue.

What kind of data may be in scope?

Select all that apply. Including data handled through vendors.

Select at least one option to continue.

What operating environments apply?

Select all that apply. Many organisations span more than one.

Select at least one option to continue.

If asked how your AI is controlled, what could you show today?

Regulators evaluate evidence, not intent.

Choose one.

A written policy or internal guidelines Some technical controls or system logs Both policy and technical evidence We could pull something together with time We're not sure what we would show

Choose one option to continue.

Optional

Who is responsible for AI governance?

Choose one.

A clearly named individual A formal group or committee Shared across teams informally No one has been formally assigned Not sure

Optional

If you needed to show how AI is managed, what do you already have?

Select all that apply. Strengthens the report; will not block submission.

A list of AI systems in use Risk or impact assessments Human review or oversight processes Records of issues or incidents Documentation from AI vendors or tools Training or guidance for staff using AI None of these Not sure what would be required

Statutory exposure

Aggregate statutory maximum across applicable regimes.

Sum of statutory maxima under the regulatory frameworks that apply to your jurisdictions, data types, sectors, and AI usage. Not indicative of actual enforcement outcomes.

These are parallel statutory maxima across applicable frameworks, not a single enforcement path.

Answer the questions above to see your statutory exposure.

Aggregate statutory maximum across applicable regimes

Sum of statutory maxima across applicable regimes; not indicative of actual enforcement outcomes.

Health records held (HIPAA Tier 2 calculation)

Framework	Citation	Amount

Methodology and assumptions

Figures reflect statutory maximum penalties under each framework current as of date of report generation. They represent parallel statutory maxima across applicable regimes, not guaranteed simultaneous enforcement, and are not indicative of actual enforcement outcomes.

The EU AI Act figure shows the high-risk systems tier (Article 99(4)), calculated as the higher of EUR 15M or 3% of global annual turnover. Prohibited practices carry a higher tier (EUR 35M or 7%) under Article 99(3) but apply only to specific illegal AI uses and are not included by default. The SME proportionality rule (Article 99(6)) is applied for organisations with annual turnover below EUR 50 million.

GDPR is calculated under Article 83(5) as the higher of EUR 20M or 4% of global annual turnover.

UK GDPR and the Data Protection Act 2018 mirror the GDPR structure, calculated as the higher of GBP 17.5M or 4% of global annual turnover.

DORA, enforceable since 17 January 2025, is calculated at up to 2% of annual turnover; national competent authority frameworks may impose additional penalties not captured here.

FCA and PRA enforcement is uncapped and context-dependent under FSMA 2000 s206. The figure shown is an illustrative benchmark only and does not represent a statutory ceiling.

HIPAA exposure is calculated on a per-violation basis using the Tier 2 reasonable cause minimum of USD 1,461 per violation, subject to the annual cap of USD 146,029 under the 2019 Notice of Enforcement Discretion. The health records slider drives this calculation. Civil litigation and class-action exposure operate on a separate basis and are not included.

LGPD penalties (Article 52) are calculated as 2% of Brazilian revenue, capped at BRL 50 million per violation.

Australian Privacy Act penalties (Section 13G) follow the greater-of structure: AUD 50 million or 30% of adjusted turnover, whichever is higher.

New Zealand Privacy Act 2020 figures reflect the maximum statutory criminal fine of NZD 10,000 per offence under Section 212. Civil damages via the Human Rights Review Tribunal are a separate liability surface, capped at NZD 350,000 per affected individual, and are not included.

Canadian privacy and AI frameworks are captured in the jurisdiction selection but do not currently produce a calculator effect; this will be added in a future revision.

Foreign exchange rates are approximate and refreshed on a 30-day rolling basis (current rates set 25 April 2026). Information contained is not legal or financial advice or a guarantee of outcome.

Three-year cost

What this is already costing you.

Operational governance cost over three years, and the portion OBEXGATE displaces. Adjust assumptions if the defaults do not fit your structure.

Most of this cost exists because governance is manual and unverifiable.

Answer Q2 (revenue) above to see your three-year cost.

Cost profile Set from your revenue and sector. Change to override.

One-off displaceable build / consulting

Annual displaceable workload

3-year displaceable cost basis

OBEXGATE does not replace governance leadership or external legal counsel. It reduces a defined portion of operational workload across governance, documentation, and audit preparation functions. Illustrative displacement assumptions: governance lead 30%, analysts 50%, legal 0%, regulatory tracking 80%, GRC tooling 50%, audit preparation 60%. Actual impact varies by organisation.

Adjust assumptions

Internal governance staff

Governance lead salary (loaded)

Compliance analysts (count)

Per analyst (loaded)

External consulting

Initial deployment / consulting (one-off)

External legal review (annual)

Regulatory update tracking (annual)

Tooling and audit

Current GRC tooling (annual)

Audit preparation (annual)

Estimates provided are illustrative and based on typical organisational cost structures. They do not constitute a guarantee of cost reduction or operational outcome. Actual costs, savings, and resource allocation will vary based on organisational structure, regulatory scope, and implementation approach. Currency conversions use FX rates as of 25 April 2026. Nothing presented constitutes financial, legal, or compliance advice. Estimates should be reviewed by your governance and compliance team and General Counsel before being relied upon for decision-making.

Send the report to yourself

Get the full enforcement breakdown in your inbox.

This delivers a structured EVF diagnostic showing governance gaps, risk signals, and priority actions based on how your system behaves under evaluation.

Name *

Enter your name to continue.

Email *

Enter a valid email address.

Company (optional)

Phone (optional)

Report language

Reports in non-English languages are machine translated. Help us improve by flagging issues to hello@obexgate.com.

Estimates only. Not legal or regulatory advice. Actual obligations and exposure depend on your specific implementation.

Not a score. A diagnostic you can use.

If you cannot identify the execution boundary, you cannot control it.

PDF emailed within a few minutes.

Or talk it through with a governance specialist.

30-minute working call. No slide deck, no demo. We work through the same numbers with you and identify the next concrete step.

Book a 30-minute call

Report on its way

Check your inbox.

We've sent the full assessment to your email. It should arrive within a few minutes. If you do not see it, check your spam folder.

Inputs are no longer held in this browser. The report itself is what travels with you.

Walk through your numbers with a governance specialist.

Most teams find the report most useful after a 30-minute conversation. We work through your specific exposure and identify the next concrete step.

Book a 30-minute call