Regulatory Liability Index
Explore selected administrative fine ceilings for regulations relevant to connected products.
Illustrative calculations for EU CRA, AI Act, NIS2, and UK PSTI. These are not predictions of a fine or a determination that a rule applies.
Estimated Liability Breakdown
Illustrative statutory ceilings for selected infringements, using annual turnover.
| Regulation | Penalty Basis | Max Exposure |
|---|---|---|
| EU AI ActArt. 99 | Up to 7% or €35M | Up to €35M |
| EU Cyber Resilience ActArt. 64 | Up to 2.5% or €15M | Up to €15M |
| UK PSTI ActSchedule 5 | Up to 4% or £10M | Up to £10M |
| EU NIS2 DirectiveArt. 34 | Up to 2% or €10M | Up to €10M |
Illustrative ceilings, not predicted or minimum fines. GBP to EUR rate: 1.18 (indicative). Applicability and actual penalties depend on the infringement, entity, and circumstances.
SME & Start-up Protection
Under the EU AI Act (Article 99.6), administrative fines for Small and Medium Enterprises are capped at the lower of the two calculated amounts (fixed ceiling or percentage of turnover).
Our calculator automatically applies this protection when the "SME / Start-up" toggle is active. Check the applicable SME definition and company relationships before using this option.
The Enforcement Frameworks
Understanding the regulatory landscape behind the calculations.
EU AI Act
Enforced 2026The ceiling shown here concerns prohibited AI practices under Article 5. Other infringements have different ceilings.
Fines up to €35M or 7% of global annual turnover, whichever is higher (for enterprises).
Article 99 (Prohibited practices & High-Risk obligations)
EU Cyber Resilience Act
Enforced 2027Selling any product with digital elements (connected hardware, IoT devices, embedded systems) in the EU market.
Market withdrawal + fines up to €15M or 2.5% of global annual turnover.
Article 64 (Non-compliance with Annex I essential requirements)
UK PSTI Act
Active 2024Consumer connectable products sold in the UK (IoT devices, smart home products, wearables).
Fines up to £10M or 4% of global annual turnover for security duty breaches.
Schedule 5 (Enforcement and penalties)
EU NIS2 Directive
Enforced 2024Operating as an "Essential Entity" in critical infrastructure sectors (energy, transport, health, digital infrastructure).
Fines up to €10M or 2% of global annual turnover for cybersecurity measure failures.
Article 34 (Administrative fines)
Calculation Methodology
How the Illustrations Are Calculated
The illustrations compare a fixed statutory ceiling with a percentage of turnover for selected infringements. The relevant rule determines whether the higher or lower amount is used:
- •Fixed Ceiling:A statutory cap for the selected infringement (e.g., €15M for CRA)
- •Percentage of Turnover: A percentage of your global annual revenue (e.g., 2.5% for CRA)
- •Selected Ceiling: The higher of the two values, or the lower where the SME rule applies
Data Sources
Legislative Texts
Official EU and UK government publications, including final adopted texts and enforcement guidelines.
Currency Conversion
GBP to EUR conversion rate: 1.18 (indicative). Actual rates may vary.
Important Disclaimers
This is an estimation tool
Actual penalties depend on severity, intent, duration of non-compliance, cooperation with authorities, and other mitigating or aggravating factors. This calculator illustrates selected statutory ceilings. It does not determine applicability. It is not legal advice. Consult qualified legal counsel for compliance guidance.
Frequently Asked Questions
What is the Regulatory Liability Index?
The Regulatory Liability Index illustrates selected statutory administrative fine ceilings under EU CRA, AI Act, NIS2, and UK PSTI. It does not determine whether a rule applies or predict a penalty.
How are the fines calculated?
The selected statutory ceilings compare a fixed amount with a percentage of annual turnover. The relevant infringement, entity type, and legislation determine which ceiling applies. The AI Act includes a lower-of rule for qualifying SMEs. These figures are ceilings, not minimum fines.
Does this apply to my product?
Applicability depends on the product or service, market, entity type, and relevant exclusions. Turnover and SME status alone are not enough to decide. Check the scope provisions and applicable national rules before using a figure in a business decision.
Discuss the engineering questions behind the figures
Device Prophet can help review architecture assumptions, investigate security issues, and plan implementation work.