Estimating AI Regulatory Fine Exposure as Expected Loss

Expected loss decomposition

The estimate is built from five components. Each one is defined below and developed in the sections that follow.

Why statutory maximums and qualitative ratings fall short

A statutory maximum describes the ceiling of a penalty tier, not the fine an organization should expect. Expected loss replaces a single maximum with a severity distribution that is bounded by the applicable penalty tier, so that the ceiling limits the range of outcomes without being treated as the likely outcome.

Decomposing exposure into event likelihood, severity distribution and control effectiveness also makes each input explicit, so it can be reviewed, challenged and updated.

Define the unit of analysis and map obligations

Calculate expected loss for each AI system and obligation group rather than for the organization as a whole. Two inputs set the scope of the model:

• Unit of analysis: the AI system, agent or use case that exposure is assigned to.
• Obligation and penalty tier: the applicable rules and the fine ceiling each one carries.

The penalty tier becomes the upper bound for the severity distribution in the next step.

Estimate event probability and model severity

Event probability

Estimate the annual likelihood of an enforcement action for each unit of analysis. This is the frequency component of the calculation.

Severity distribution

Model a range of plausible fines, capped by the penalty tier, and use the expected fine from that distribution if an event occurs. Do not substitute a single maximum for the distribution.

Worked calculation structure

1. Identify the unit of analysis: the AI system, agent or use case.
2. Map the obligations that apply and the penalty tier each one carries.
3. Estimate the annual probability of an enforcement action for that unit.
4. Model the severity distribution, capped by the penalty tier.
5. Apply the control adjustment for evidenced controls, reflecting their effect on frequency and severity.

Evidence for probability and control-effectiveness inputs

The control adjustment reflects the effect of evidenced controls on frequency and severity. The stronger the evidence behind a control, the more defensible its effect on the estimate.

Limits of the model and how to document them

Every input is an estimate. Document every assumption and its uncertainty so that reviewers can see what the figure depends on. At a minimum, record the following for each AI system and obligation group:

• The unit of analysis and why exposure is assigned to it.
• The obligations and penalty tier used as the upper bound.
• The event probability and the uncertainty around it.
• The severity distribution and the uncertainty around it.
• The control adjustment and the evidence that supports it.