Compliance Fine Exposure: GDPR, HIPAA, PCI DSS, EU AI Act

Article 83 sets two tiers of administrative fines. Lower tier: up to 10 million euros or 2 percent of worldwide annual turnover, whichever is higher. Upper tier: up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher, for the more serious violations (lawful basis, data subject rights, transfers outside the EU).

How shadow IT creates exposure: personal data of EU data subjects ending up in unapproved apps without a documented lawful basis, without a data protection impact assessment where required, without appropriate organizational and technical safeguards, or with transfers outside the EU that lack an adequacy decision or Standard Contractual Clauses. Shadow AI compounds this when personal data is processed by AI tools without a lawful basis.

Source: gdpr-info.eu/art-83-gdpr/

Civil money penalty tiers under 45 CFR 160.404, adjusted annually for inflation. 2024 figures (rounded): tier 1 (no knowledge), approximately $137 minimum per violation, up to approximately $68,928 per violation, with an annual cap near $2.134 million at the wilful-neglect tier. Criminal penalties under 42 USC 1320d-6 add imprisonment exposure for wilful violations involving personal gain.

How shadow IT creates exposure: protected health information transmitted to or stored in apps where the vendor is not a HIPAA-covered business associate with a signed BAA. Shadow AI specifically: entering PHI into an unapproved AI tool creates an immediate disclosure without a BAA. Each disclosure instance can be counted as a violation.

Source: hhs.gov/hipaa compliance enforcement

PCI DSS v4.0 is an industry standard, not a regulation. Exposure flows from card brand contractual assessments against acquirers, which typically cascade to merchants. Non-compliance penalties are commonly reported in the trade press as monthly assessments in the $5,000 to $100,000 range depending on merchant tier and card brand, with higher post-breach assessments (forensic cost, card replacement cost, fines per compromised card). Exact values are contractual and not published officially.

How shadow IT creates exposure: cardholder data flowing through apps that are not within the validated cardholder data environment, network segmentation broken by shadow apps, unauthorized processors handling cardholder data without proper contractual and technical controls. Shadow SaaS used by customer-facing teams (support, sales) is a common finding.

Source: pcisecuritystandards.org

Penalty tiers under Article 99. Prohibited AI practices: up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher. Non-compliance with obligations on high-risk AI and general-purpose AI: up to 15 million euros or 3 percent of worldwide annual turnover. Incorrect information to authorities: up to 7.5 million euros or 1 percent of worldwide annual turnover. Application is phased: prohibited practices apply from February 2025; governance and general-purpose AI model obligations from August 2025; full high-risk AI obligations from August 2026.

How shadow AI creates exposure: high-risk AI applications (employment decisions, creditworthiness, access to public services, biometrics in the workplace) deployed through shadow channels without the documentation the Act requires (risk management system, data governance, quality management system, human oversight). Non-EU organizations are in scope when the output is used in the EU.

Source: eur-lex.europa.eu regulation 2024/1689

Neither is a regulatory regime; there are no statutory fines. Exposure flows through other mechanisms: auditor findings extending the audit timeline or forcing a qualified opinion, SaaS vendor or enterprise customer relationships requiring clean attestations (renewal friction, SLA credits, delayed deals), remediation cost for discovered gaps, and competitive positioning in sales processes that demand attestation evidence.

How shadow IT creates exposure: control gaps surfaced during audit (access controls, change management, asset inventory, vendor management) because shadow apps were not covered by documented controls. In enterprise-sales contexts, a single material exception can delay a renewal by months or cost seven-figure deals.

Sources: AICPA Trust Services Criteria, ISO/IEC 27001