Which compliance fines and penalties matter most for your organization
If your team answers to more than one regulator, the first question is worst-case exposure, and the answer depends on which regime reaches you. The EU regimes use turnover-based maximums: the GDPR allows fines up to EUR 20 million or 4% of total worldwide annual turnover for the most serious infringements, NIS2 sets at least EUR 10 million or 2% for essential entities (and at least EUR 7 million or 1.4% for important entities), and the AI Act reaches EUR 35 million or 7% for prohibited practices. HIPAA civil money penalties are set per violation with a calendar-year cap, NERC penalties are per violation per day, SOX Section 906 creates personal criminal exposure for officers who knowingly or willfully certify false reports, and the PCI SSC does not fine anyone, since the payment brands decide enforcement.
These figures are ceilings written in law or regulator rules, not forecasts of what any authority will impose. Regulators weigh factors such as the nature and duration of an infringement, cooperation and prior conduct, so a maximum tells you the scale of the downside, not the likely outcome. The 'whichever is higher' rule under the GDPR, NIS2 and the AI Act matters most for large groups, because a percentage of worldwide turnover can exceed the fixed euro amount. A group with several billion euros in turnover should read the percentage as the operative number, while a smaller company will find the fixed amount is the one that counts.
Start by mapping which regimes reach each legal entity and each market, then confirm the applicable amounts with counsel and the relevant regulator, since national transposition and 2026 amendments can change the picture. Record the turnover base your counsel would use, the regulator that would enforce, and the period each cap covers. The most useful output is a short exposure register that links each penalty to the controls and reporting playbooks that reduce the chance of triggering it.
Maximum penalties side by side: GDPR, NIS2, AI Act, CRA, HIPAA, NERC, SOX and PCI DSS
This table sets out the maximum penalties each regime states in its text or regulator rules, along with who enforces it and whether a certificate changes exposure. Read the turnover-based rows as ceilings that apply per the legal text, not as typical fines, and check each regime's own enforcement rules before sizing risk.
| Aspect | Regime and maximum | What it applies to |
|---|---|---|
| Who enforces | GDPR: independent national supervisory authorities (Article 51). NIS2: national competent authorities. AI Act: national market surveillance authorities, with the Commission's AI Office for general-purpose AI model rules. | Enforcement sits with public authorities in each jurisdiction, not with any certification body. |
| Basis of the maximum | GDPR, NIS2 and AI Act: the higher of a fixed amount or a percentage of total worldwide annual turnover. CRA (Article 64): the higher of a fixed amount or a percentage of turnover. HIPAA: a per-violation amount with an annual cap. NERC: a per-violation, per-day amount. SOX Section 906: fixed fines and prison terms. | Turnover-based maximums scale with group revenue, so the same breach can carry very different ceilings for different companies. |
| Top tier amount | GDPR: EUR 20 million or 4%. NIS2 (essential entities): EUR 10 million or 2%. AI Act (prohibited practices): EUR 35 million or 7%. CRA: EUR 15 million or 2.5% for breaches of Annex I and Articles 13 and 14. HIPAA: $2,190,294 per violation for uncorrected willful neglect. NERC: $1,584,648 per violation, per day. SOX: $5,000,000 and 20 years for willful false certification. | Each figure is the statutory or regulatory maximum as supplied, not a typical or expected penalty. |
| Second tier amount | GDPR: EUR 10 million or 2%. NIS2 (important entities): EUR 7 million or 1.4%. AI Act (most operator obligations): EUR 15 million or 3%. CRA: EUR 10 million or 2% for other listed obligations. HIPAA: $145 per violation at the lowest tier (no knowledge). SOX: $1,000,000 and 10 years for knowing false certification. | The tier depends on the infringement type, the entity's classification or the culpability level, so confirm which tier your obligations fall under. |
| What the maximum applies to | GDPR: infringements of Articles 25 to 39 (lower tier) or principles, lawful basis, data subject rights and transfer rules (upper tier). NIS2: failures under the risk-management and reporting obligations. AI Act: prohibited practices, operator obligations, and misleading information to authorities. CRA: Annex I and listed obligations, and incorrect information to authorities. HIPAA: Security Rule and other violations, assessed by culpability. NERC: violations of reliability standards. SOX: certifying officers who knowingly or willfully certify a false periodic report. | Penalties attach to the violation itself. Check the article or rule for the exact tier before assigning exposure. |
| Does a certificate change exposure? | GDPR: certification under Article 42 is voluntary and does not reduce responsibility. NIS2: no certificate exists; inspections and audits apply. AI Act: conformity assessment does not cap fines. HIPAA: HHS does not recognize private certifications, and they do not prevent a later violation finding. PCI DSS: the council imposes no penalties, and certificates are not recognized as validation. SOX: a certification does not cover a false statement. | Expect no regime in this table to treat a private certificate as a shield against the maximum. |
| PCI DSS | The PCI SSC does not enforce compliance or impose fines. The individual payment brands decide which entities must validate and run any enforcement programs. | Penalties come through card brand and acquirer programs, so ask your acquirer or brand which consequences apply to your merchant or service provider level. |
How turnover-based fines are calculated in the EU
The whichever is higher rule means the ceiling for a large group is set by its turnover, not only by the flat euro amount. Under Article 83 of the GDPR, the maximum for infringements such as those in Articles 25 to 39 is EUR 10 million or 2% of total worldwide annual turnover, and for infringements of the principles, lawful basis, data subject rights and transfer rules it is EUR 20 million or 4%. Illustrative example only: a hypothetical group with EUR 1 billion in worldwide annual turnover would face a ceiling of EUR 20 million for a security-of-processing failure (2% of EUR 1 billion is EUR 20 million, which is higher than EUR 10 million), and a ceiling of EUR 40 million for a transfer-rule breach (4% of EUR 1 billion). The tier, not the company's size alone, sets the number, so the first task is to map each obligation to its tier.
The tiers differ by framework and by entity type. NIS2 Article 34 sets maximums of at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important entities. The same risk-management and reporting duties apply to both, but essential entities face ex ante supervision and important entities ex post supervision (Articles 32 and 33), so classification under Article 3 changes both the ceiling and the scrutiny. The AI Act's Article 99 uses three tiers: EUR 35 million or 7% for prohibited practices, EUR 15 million or 3% for most operator obligations, and EUR 7.5 million or 1% for misleading information to authorities. Confirm with counsel which tier applies to each system or entity in scope, because these figures are ceilings set by law, and national authorities decide actual amounts within them.
DORA works differently. It leaves administrative penalties for financial entities to member states (Article 50), so the national law of each member state sets those amounts. The only EU-level figure is for periodic penalty payments imposed on critical ICT third-party providers, which may reach 1% of average daily worldwide turnover. For a financial entity, the planning step is to check the transposing law in each country where it operates, and for a provider of ICT services, to confirm whether it has been designated as critical and what that designation means for its contracts.
What drives real exposure within these maximums
A statutory maximum is a ceiling, not a forecast. The cards below cover the factors that decide which tier applies, which authority acts, how turnover is measured and whether the conduct was knowing or willful, each of which changes the exposure for the same incident.
Infringement category sets the tier
Under the GDPR, Article 83 places Articles 25 to 39 infringements in the lower tier (EUR 10 million or 2%) and infringements of the principles, lawful basis, data subject rights and transfer rules in the higher tier (EUR 20 million or 4%). Check which obligation you actually breached, because the category, not the incident size, selects the ceiling. Confirm with counsel how your supervisory authority has applied these tiers in practice.
Essential or important classification
Under NIS2, Article 3 classifies in-scope entities as essential or important. Both face the same risk-management and reporting duties, but the essential tier carries the higher maximum (EUR 10 million or 2%) and ex ante supervision, while the important tier carries EUR 7 million or 1.4% and ex post supervision. Confirm your classification with the national competent authority, since transposition laws set how it is applied locally.
Group turnover and the worldwide basis
For GDPR, NIS2, the AI Act and the Cyber Resilience Act, the percentage limb is measured against total worldwide annual turnover, and the higher of the fixed amount and the percentage applies. For a large group, the percentage can exceed the fixed figure, so the turnover base matters more than the headline euro amount. Ask finance which financial year and which consolidated group figure a regulator would use, and confirm that position with counsel.
Competent authority and its procedure
Each regime is enforced by a different body: national supervisory authorities for the GDPR, national competent authorities for NIS2, national market surveillance authorities for most AI Act systems, FERC-referred enforcement for NERC CIP, the Department of Health and Human Services for HIPAA, and the individual payment brands for PCI DSS, since the PCI SSC itself imposes no penalties. Map which authority would open a case for each system you run, and confirm how that authority's enforcement practice works in your jurisdiction.
Knowing or willful conduct
HIPAA civil money penalties rise with culpability, from the lowest tier for violations where the entity had no knowledge up to the highest tier for uncorrected willful neglect. The annual cap applies on top of per-violation amounts, so the record of what you knew and how quickly you corrected it can change the outcome. Document detection dates, decisions and corrective actions as they happen, and confirm the tier analysis with HIPAA counsel.
How each regime sets and enforces its penalties
The GDPR is enforced by independent national supervisory authorities under Article 51, and its fine ceilings are written directly into Article 83. The European Data Protection Board, established by Article 68, issues guidelines and, under Articles 65 and 70, resolves disputes between authorities through binding decisions. The ceiling that applies depends on the provision breached, so the first question is which obligation an incident or audit finding touches.
- Two fine tiers in Article 83: EUR 10 million or 2% of total worldwide annual turnover for infringements such as Articles 25 to 39, and EUR 20 million or 4% for infringements of the principles, lawful basis, data subject rights and transfer rules, whichever is higher in each case.
- Certification does not offset fines: Article 42 certification is voluntary, lasts for at most three years and leaves the controller's or processor's responsibility intact.
- Cross-border procedure: Regulation (EU) 2025/2518 adds procedural rules for complaints and investigations in cross-border cases and applies from 2 April 2027.
- Pending changes: As of October 2026 the GDPR text has not been amended, while the Omnibus IV and Digital Omnibus proposals remain in the legislative process.
Confirm which supervisory authority would act as lead for your processing and how your national procedure adds steps to the Regulation's own timelines.
NIS2 is a directive, so its penalties reach entities through national transposition laws that Member States had to adopt and publish by 17 October 2024. Article 34 sets the ceilings, and national competent authorities supervise through inspections, security audits, security scans and information requests. DORA is a regulation that applies directly, but Article 50 leaves administrative penalties for financial entities to Member States, so the EU text sets amounts only for one category of enforcement.
- NIS2 essential entities: maximum fines of at least EUR 10 million or 2% of worldwide annual turnover under Article 34.
- NIS2 important entities: maximum fines of at least EUR 7 million or 1.4%, with ex post supervision, while essential entities face ex ante supervision.
- No NIS2 certificate: the Directive creates no certificate of compliance, so supervisory findings and fines are the outcome to plan for.
- DORA national penalties: the amounts for financial entities sit in each Member State's law, so check the rules where your entity is authorized.
- DORA critical ICT providers: EU-level periodic penalty payments of up to 1% of average daily worldwide turnover apply to designated providers.
Confirm which national transposition act governs your entity, and whether your sector and size place you in the essential or important category.
The EU AI Act sets its penalty tiers in Article 99, and each tier is the higher of a fixed euro amount or a percentage of worldwide annual turnover. National market surveillance authorities enforce the Act for AI systems, while the Commission's AI Office enforces the general-purpose AI model rules under Article 88 and, under Article 75(1) as amended in 2026, holds exclusive competence over certain AI systems. The Cyber Resilience Act sets its own turnover-based ceilings in Article 64.
- AI Act prohibited practices: up to EUR 35 million or 7% of worldwide annual turnover.
- AI Act most operator obligations: up to EUR 15 million or 3%, and up to EUR 7.5 million or 1% for misleading information to authorities.
- CRA Article 64 tiers: up to EUR 15 million or 2.5% for Annex I and Articles 13 and 14, up to EUR 10 million or 2% for other listed obligations, and up to EUR 5 million or 1% for incorrect or misleading information.
- Timing of high-risk duties: under the 2026 amendment, Annex III high-risk rules apply from 2 December 2027, so confirm the transitional position for each system.
- Conformity route: most Annex III systems use internal control, with notified bodies involved for some biometric systems and Annex I products.
Confirm which AI Act category your system falls into and which authority would supervise it before budgeting for enforcement exposure.
Three US regimes set maximums in different places. HIPAA civil money penalties are inflation-adjusted in 45 CFR 102.3, NERC's Sanction Guidelines in Appendix 4B of its Rules of Procedure refer to the FERC civil penalty maximum in 18 CFR 385.1602, and SOX Section 906 states criminal penalties for officers in the statute itself. None of the three produces a certificate, so the penalty figure is the main enforcement signal for each.
- HIPAA penalties: for penalties assessed on or after 28 January 2026, the range runs from $145 per violation with no knowledge to $2,190,294 per violation for uncorrected willful neglect, with a calendar-year cap of $2,190,294.
- HHS and certifications: HHS does not recognize private certifications and says they do not prevent a later violation finding.
- NERC maximum: $1,584,648 per violation, per day, as adjusted by FERC Order No. 906 in January 2025.
- SOX Section 906: the CEO and CFO face fines up to $1,000,000 and 10 years for knowing false certification, and up to $5,000,000 and 20 years for willful false certification.
- Check the current figures: the HIPAA and FERC amounts are adjusted periodically, so confirm the figure in force on the date of any assessment.
Confirm with counsel which of these regimes apply to your entity and which authority would bring any action.
The PCI Security Standards Council maintains PCI DSS and its assessment templates, but it does not enforce compliance or impose penalties. The individual payment brands decide which entities must comply and validate, and they run any enforcement programs. That means there is no council-set maximum to quote, and the consequences of non-compliance come from brand rules and the contracts between merchants, acquirers and service providers.
- Standard owner: the Council writes the standard, assessor requirements and templates, but holds no fining authority.
- Brand decides scope: each payment brand determines who must validate and on what schedule.
- Contract terms carry the risk: acquirer and processor agreements often set remediation obligations, so review them alongside the brand rules.
- Evidence route: a Report on Compliance or Self-Assessment Questionnaire with an Attestation of Compliance is the proof, because certificates are not recognized as validation.
- Ask for written terms: request each brand's enforcement program, cure periods and any monetary consequences in writing before you plan.
Confirm which brands and acquirers your organization deals with, and ask each one for its written enforcement terms rather than relying on a summary.
How to map your own exposure against these maximums
This sequence turns the maximum penalties on this page into a per-entity exposure view, so that a decision-maker can see which regime applies to which business line, which turnover base applies, and which figures must be rechecked before a budget or risk decision is taken.
Inventory the regulators for each business line
Compliance or legal counsel lists every business line, product and country where the organization operates or serves customers, then names the regulator and regime that plausibly applies to each one. Typical starting points include GDPR supervisory authorities for EU personal data, NIS2 national competent authorities for in-scope sectors, DORA competent authorities for financial entities, HHS for covered electronic health information, and FERC or NERC for bulk electric system operators. The output is a one-page register with one row per business line and regime, reviewed by the business owner of each line. Confirm applicability with counsel, because scope depends on sector, size and the Member State or US activity involved.
Confirm the turnover basis with finance
For every regime that uses a percentage of turnover, finance confirms which figure is the base: total worldwide annual turnover for GDPR, NIS2 and the EU AI Act, or average daily worldwide turnover for DORA periodic penalty payments on critical ICT providers. Finance also confirms which legal entities and group companies are counted, and which financial year is used. The output is a written figure, with its source year and consolidation rules, that the risk team can apply to each percentage cap. Ask finance to state whether the figure is audited and who signed it off.
Classify each entity under the applicable regime
Classification changes which maximum applies. Under NIS2, the legal team records whether each in-scope entity is essential or important under Article 3, since the two categories carry different fine maximums and different supervision models. Under the EU AI Act, the team records whether each AI system is a prohibited practice, high-risk, transparency-relevant or outside the Act, and whether the organization acts as provider, deployer, importer or distributor. The output is a classification record for each entity and system, with the legal reasoning and the date of the assessment.
Map likely failures to infringement tiers
Security, privacy and compliance leads list the failures that would most plausibly occur, such as a late breach notification, a missing risk-management measure, a misleading statement to a regulator, or an ICT third-party gap. For each failure, the team identifies the infringement tier that the regulation places it in. For example, GDPR Article 83 separates obligations covered by the lower tier from principles, lawful basis, data subject rights and transfer rules in the higher tier. The output is a table linking each failure scenario to a tier, its maximum, and the articles that define it. Label any scenario in the table as illustrative until counsel has reviewed it.
Check current figures in the official text
Before any figure is used in a board paper, budget or insurance discussion, the compliance team checks it against the official source on the day of the decision. For HIPAA civil money penalties, use the eCFR text of 45 CFR 102.3, which reflects inflation adjustments. For NERC, use the eCFR text of 18 CFR 385.1602 and the NERC Sanction Guidelines. For EU texts, use the consolidated versions on EUR-Lex, including the consolidated AI Act text. The output is a source log that records the URL, the version or consolidation date, the article or section, and the person who checked it. Do not rely on secondary summaries, including this page, for the final number.
Record pending amendments and their status
Legal and policy staff list each proposal or amendment that could change a maximum or a scope, and record its status on the day of the check. Examples on this topic include the 2026 amendments to the AI Act, which changed high-risk application dates, the Commission proposal on NIS2 targeted amendments, and the pending Omnibus procedures affecting the GDPR. For each item, the team notes the procedure reference, the current stage, and the date of the next expected step. The output is a watch list with an owner and a review date. Where a proposal has not been adopted, the exposure model should state the currently applicable text and show the pending change as a sensitivity note.
Assemble the exposure view for decision-makers
Risk and finance leads combine the register, turnover basis, classifications, tier mapping and source log into one exposure view per regime. Each row shows the regime, the maximum as written, the base it applies to, the regulator, and the open items from the watch list. The view states clearly that maximum fines are ceilings set by law, not estimates of likely penalties, and that actual amounts depend on the regulator's assessment. The output is a version-controlled document approved by counsel and the accountable executive, with a named owner who will refresh it when a source changes.
Which fine figures may change before your next audit
The fine tiers in the texts below are unchanged in the sources supplied for this page, but several legislative files are moving. Confirm the current wording before you put any maximum in a board paper. For the GDPR, the Omnibus IV proposal (COM(2025) 501, procedure 2025/0130(COD)) had a text agreed in interinstitutional negotiations on 26 June 2026 and was awaiting Parliament's first-reading vote as of October 2026. The Digital Omnibus proposal (COM(2025) 837, procedure 2025/0360(COD)) was awaiting committee decision. The GDPR text itself had not been amended as of October 2026, so Article 83 still governs the EUR 10 million or 2%, and EUR 20 million or 4%, tiers. Track both files on the European Parliament Legislative Observatory) and check the consolidated text on EUR-Lex before you rely on it.
For NIS2, the Commission proposed targeted amendments on 20 January 2026 (COM(2026) 13), including a new small mid-cap category. The proposal still needs approval by the European Parliament and the Council, and Commission pages updated through July 2026 describe it as a proposal. If you are a mid-sized entity, the first question is whether the proposal would move you out of the essential or important tiers that carry the EUR 10 million or 2% and EUR 7 million or 1.4% maximums. Ask your national competent authority how it will transpose any change, because the Directive binds through national law and Member States may keep stricter rules under Article 5.
For the EU AI Act, Regulation (EU) 2026/1744 amended the Act on 8 July 2026, and it entered into force on 27 July 2026. Its high-risk rules now apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I product systems, instead of the earlier 2 August 2026 and 2 August 2027 dates. Check which high-risk date governs each system in your inventory, and confirm with counsel that the Article 99 tiers of EUR 35 million or 7%, EUR 15 million or 3%, and EUR 7.5 million or 1% still match the consolidated text on EUR-Lex. Re-check your fine exposure before each board cycle until the proposals close.
Common questions about compliance fines and penalties
Does holding a certificate reduce a fine?
No certificate is guaranteed to reduce a fine, and for some regimes the law says so directly. HHS states that no Security Rule standard requires an entity to certify compliance, that it does not endorse or recognize private certifications, and that such certifications do not prevent HHS from later finding a violation. Under the GDPR, Article 42 certification is voluntary, lasts for at most three years, and does not reduce the controller's or processor's responsibility for compliance. Treat any certificate as evidence you can show a supervisor or customer, not as a shield. Ask your counsel how a regulator in each jurisdiction weighs voluntary certifications when it sets a penalty, because the answer depends on the regime and the facts of the case.
Who pays for work that reduces fine exposure?
Your organization pays for all of it, and the regulator never does. The work splits into two roles. Your staff, legal counsel and internal audit own the decisions, the policies and the accountability, and the regulator sets the penalty and runs any investigation. An outside firm such as DeployOpen can plan, implement, document and test the controls, prepare the evidence, and support assessments, but it does not issue audit reports, attestations or certifications, and independent auditors and certification bodies do. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. Ask any provider to name which outputs are theirs and which must come from an independent assessor.
Does the PCI SSC fine companies that break PCI DSS?
No, the PCI Security Standards Council does not fine anyone. The council states that it does not enforce compliance or impose penalties. The individual payment brands decide which entities must comply and validate, and they run any enforcement programs. In practice, a non-compliant merchant or service provider usually faces consequences set by its acquirer or the card brands under their own rules, so the exposure depends on your contracts and your payment relationships. Check the brand and acquirer terms that apply to your business, and confirm with your acquirer what validation they require and what they may do if you miss it.
Do SOX penalties apply to the company or to its officers?
Section 906 of the Sarbanes-Oxley Act puts criminal exposure on individuals. It requires the CEO and CFO to certify each periodic report that contains financial statements. For a knowing false certification, the statute sets fines up to $1,000,000 and up to 10 years' imprisonment, and for a willful false certification, fines up to $5,000,000 and up to 20 years. The company's own fines and sanctions are a separate question that depends on the securities regime and the specific case. Because the personal exposure is real, officers typically want their own evidence of the controls behind each certification. Ask counsel to confirm how these provisions apply to your reporting structure.
How long does it take to prepare evidence, and what does the work need from us?
The timeline depends on how many systems are in scope, how mature your current controls are, and how quickly your staff can supply records. No fixed duration can be given for every organization, so ask any provider for a timeline in the written scope rather than relying on a general estimate. The work usually needs named owners for each control, access to system configurations and logs, current policies and asset lists, and time from the people who run the systems. Evidence gathered on a rolling basis is usually easier to defend than material assembled the week before an assessment. Confirm with your assessor which evidence formats and sampling periods they expect before work begins.
Can we map requirements across frameworks ourselves?
Yes, many teams do this in-house, and the official sources help. NIST publishes informative references for the CSF 2.0, and the CIS Controls Navigator offers CIS mappings to 30 frameworks and versions. These mappings are useful starting points, but each publisher states its limits. NIST does not check the correctness of non-NIST mappings, and ENISA states that its mapping is not a measure of equivalence and does not assess whether a standard fully covers the regulation. Plan for internal time to review each mapping against the actual text and your own systems, and have counsel or an assessor confirm any mapping that carries legal weight. An outside firm can speed this up, but it still cannot certify the result.
What drives the cost of reducing exposure?
Cost depends mainly on scope, starting maturity and how many regimes apply. Each framework adds its own evidence, testing and documentation, so overlapping regimes can share work when one control satisfies several requirements. Costs are one-time when you build controls and evidence, and they recur when you test, reassess, retrain staff and keep records current. Ask for a quote that separates implementation, testing, evidence preparation, and any assessor fees, and that states what is one-time and what is an ongoing retainer. Your independent assessor's fees are a separate line from any consultant's fees, so keep them apart when you compare offers.
What to ask for in a quote for penalty-readiness work
A quote for penalty-readiness work should start from a written scope that names each regime and each legal entity in it. DeployOpen does not publish a price list. A quote follows from the agreed scope, and most engagements are fixed-scope, with scope, deliverables and timelines set in writing before work begins. The cost components are therefore the parts of that scope: who scopes the exposure, who prepares the evidence, who designs and tests the controls, and who reviews them later. Scoping is the first paid step, because it decides which fine ceilings apply to which entities. Evidence preparation covers the records a regulator would ask for, such as risk assessments, incident procedures and supervisory correspondence. Control design and testing cover the technical and procedural work that the assessment depends on. Ask the vendor to split the quote along these lines so you can see what each phase costs and what you can drop.
The scope document should state the regimes covered, for example GDPR, NIS2, the EU AI Act or the Cyber Resilience Act, and the entities in each: parent, subsidiaries, and any establishment in another Member State. It should name the turnover basis the maximum fine calculations will use, and the jurisdictions where your systems or users sit. Turnover-based ceilings depend on worldwide annual turnover, so ask the provider to state which financial year and which group-level figure it assumes, and to say what changes if your figures differ. Ask for the deliverables by name, the format of each, and who signs off on them. Confirm which of the fine tiers in each regulation the provider has assessed, and whether the assessment covers only the statutory maximums or also the exposure in your own operating model.
The quote should also list what you must supply: current data maps, contracts with processors and suppliers, incident and breach history, prior regulator correspondence, and named owners for each control. Missing inputs usually add effort, so ask the provider to name them up front and to state the cost of a delay. Finally, ask what recurs. Regulations change: the EU AI Act, NIS2 and GDPR are all subject to amendment proposals, so ask whether a retainer or a re-scoping clause covers reviews after rule changes, how it is triggered, and what it excludes. Ask for the terms for a re-scope and for the handover of evidence if you change providers.
How DeployOpen helps you scope compliance readiness
DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For fines and penalties, we help you turn the regulatory exposure described on this page into a written scope, the controls and evidence that the relevant regulators will ask for, and a handover your own team can run.
How we scope
- Confirm which regimes apply to your entity, sector and turnover before any technical work starts.
- Map the fine tiers that matter to your systems, data flows and third-party dependencies in writing.
- Agree deliverables, exclusions and timelines in a fixed-scope document before work begins.
How we build
- Implement the technical controls that regulators and auditors examine, such as security of processing and incident handling.
- Harden self-hosted platforms in your cloud accounts, data centers or air-gapped networks to the agreed scope.
- Run security testing against the built environment and record findings with remediation owners.
How we hand over
- Deliver the control documentation, configuration records and evidence library your compliance lead needs.
- Walk your engineering and compliance staff through runbooks so they can operate the controls themselves.
- Document which obligations remain with your legal, privacy and management teams, and which are technical.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after handover, scoped in writing.
- Update documentation and evidence when the regulatory texts you rely on change or are amended.
- Confirm with your counsel and the relevant authority how penalties and reporting duties apply to your case.
Sources and further reading
- Regulation (EU) 2024/1689 (AI Act), Article 99, EUR-Lex ↗
- Regulation (EU) 2016/679 (GDPR), Articles 51, 65, 68, 70, 83 and 99, EUR-Lex ↗
- Directive (EU) 2022/2555 (NIS2), EUR-Lex ↗
- 45 CFR 102.3 Penalty adjustment and table, eCFR ↗
- NERC Rules of Procedure Appendix 4B, Sanction Guidelines ↗
- Sarbanes-Oxley Act of 2002, Public Law 107-204, GovInfo ↗
