Skip to content
Book a review

The cost of one AI failure

One AI Failure. Six Regulators. Sanctions Stack.

A single AI system can answer to six regimes at once. When it fails, the same incident is reported to each of them, on different clocks, and each carries its own sanction.

Book a 30-minute review

Exhibit 01 · One system, one incident

CV-screening AI

5,000-person financial services

High-risk · Annex III

  1. EU AI Act€15M / 3% turnover
  2. GDPR€20M / 4% turnover
  3. NIS2€10M / 2% turnover
  4. DORA1% turnover / day
  5. PLD 2024Uncapped · strict
  6. ForeignVaries by bloc
Statutory maxima for one high-risk system at a 5,000-person financial-services firm.

The problem, in full

The Rules Change Monthly. Will Your Answers Hold Up?

  • Dated45 major deadlines across 36 regimes. 21 fall in the next six months.
  • MultiplyingOver 2,100 AI bills introduced in 2026 alone.
  • ConflictingThe AI Act requires bias testing on sensitive data. The GDPR restricts processing it.
The question a regulator asks
“What happened with this system at 16:42 on 2 September 2026? Who did it affect, who was accountable, and what was done about it?”

Sources: Regulation (EU) 2024/1689; Regulation (EU) 2016/679. Deadline counts as of October 2026.

How we solve it

One AI System. Hundreds of Obligations. One Record.

A question asked once feeds every regime that depends on the answer.

One system. Every duty from six regimes, each one traced to the record.

CV-Screening AI → EU AI ActCV-Screening AI → GDPRCV-Screening AI → DORACV-Screening AI → NIS2CV-Screening AI → ForeignCV-Screening AI → PLD 2024EU AI Act → GovernanceEU AI Act → TechnicalEU AI Act → TransparencyEU AI Act → ReportingGDPR → GovernanceGDPR → TechnicalGDPR → TransparencyGDPR → ReportingDORA → GovernanceDORA → TechnicalDORA → ReportingNIS2 → GovernanceNIS2 → TechnicalNIS2 → ReportingForeign → GovernanceForeign → TransparencyForeign → ReportingPLD 2024 → TechnicalPLD 2024 → TransparencyGovernance → RiskGovernance → OversightGovernance → DataTechnical → RiskTechnical → OversightTechnical → DataTechnical → LoggingTransparency → OversightTransparency → LoggingTransparency → NoticesReporting → LoggingReporting → IncidentsRisk → ApplicableRisk → Not applicableRisk → DeferredOversight → ApplicableOversight → Not applicableOversight → DeferredData → ApplicableData → Not applicableData → DeferredLogging → ApplicableLogging → Not applicableLogging → DeferredNotices → ApplicableNotices → Not applicableNotices → DeferredIncidents → ApplicableIncidents → Not applicableIncidents → DeferredApplicable → SealedApplicable → UnprovenApplicable → No evidenceNot applicable → Out of scopeDeferred → Out of scopeSealed → RegulatorUnproven → RegulatorNo evidence → RegulatorOut of scope → RegulatorCV-Screening AIHigh-risk · Annex IIIRegulatorOne record
  • derived from the regulation text
  • decided by a named person
  • sealed
  • covered, not yet evidenced
  • no evidence
  • out of scope
  1. Step 1 · MappedAsked OnceEach regime's duties resolve to a small set of controls. One question settles each control.
    EU AI ActGDPRDORANIS2Foreign
    What candidate data does the system use, and who holds it?
    Answered once, by a named person
  2. Step 2 · EvidencedUsed Everywhere It Is NeededThe answer is a fact. Every duty that depends on it takes it, with the evidence behind it.
    One answer
    • EU AI Actdata governancesealed
    • GDPRlawful basissealed
    • DORAthird partiescovered, unproven
    • NIS2supply chainsealed
    • Foreigndata transfersno evidence
  3. Step 3 · ReadyOne RecordWhichever regulator asks, the answer, who gave it and the proof are already in one place.
    Record entrysealed
    Question
    Candidate data and who holds it
    Answered by
    Data Protection Officer
    Source
    Cited to the regulation text
    Feeds
    EU AI Act, GDPR, DORA, NIS2, Foreign

A schematic: a 5,000-person financial-services firm, one high-risk system (Annex III). The number of lines is not a count of duties, and the example question is illustrative.

Why you can trust us

Built for People Who Check.

EU/UK Sovereign

All customer services are held in the EU and UK. Your data is stored and processed there in every environment, production, testing and support alike.

Grounded in Text

All obligations are cited and traceable to their authoritative regulatory publications. Each one quotes the provision it rests on, held exactly as the official source published it. When the law changes, the record changes with it.

AI Transparency

We are transparent about where we use AI and where we use our own intellectual property. AI is one of the tools we use, but it never replaces decades of regulatory judgement. Our AI Use Disclosure sets out where each applies.

Certifications in progress

  • ISO/IEC 27001In Progress
  • ISO/IEC 42001In Progress
  • Cyber Essentials PlusIn Progress

Your next step

Which of the Six Apply to You?

Book a 30-minute review