Free interactive tool · Nothing stored or sent

What is it costing you not to know?

Four real cost streams — regulatory, remediation, commercial, and delay — totaled from numbers you enter. No estimate, no model, no invented averages. Your inputs, your number.


A printed Risk Snapshot report on a dark desk beside a calculator, reading glasses and a pen, showing a total-risks doughnut, an inherent-versus-residual risk bar chart, a top-risk-areas list, a six-month risk trend, a likelihood-against-impact heat map and a key-insights column Illustrative sample
Illustrative — a risk snapshot, not your numbers
  • Free interactive tool
  • Runs in your browser
  • Nothing stored or sent
  • Last updated 5 August 2026
Regulatory Remediation Commercial Delay
The question an audit answers

The one number nobody can give you.

% of models with an undetected issue

Neither you nor we know this number yet. This is the one an audit answers.

The cascade

Four cost streams, added up.

Enter what you know. Blank fields count as zero, and every figure stays in this browser.

Regulatory exposure

Likelihood of a finding × the size of the fine it could carry.

Use a published fine for your practice as an anchor. No verified examples published yet — see Insights for sourced case studies as they're added.
0%
How likely a regulator flags an issue if they looked at your AI today.
Regulatory $0

Remediation cost

Engineering time to actually fix what's found, across the models most likely to need it.

Credit, hiring, claims, triage — decisions a regulator would look at first.
What an hour of engineering time really costs you — salary plus benefits and overhead, not just the paycheck.
Remediation $0

Commercial cost

Deals that stall because a buyer's questions about your AI can't be answered yet.

Deals where a customer or partner's security/AI review of your system is holding things up.
Commercial $0

Delay cost

Every week a launch slips while AI risk gets sorted out.

Delay $0

Total exposure

$0

Your inputs, your number — we assert nothing.

Nothing you enter is stored or sent. The math runs entirely in your browser.

Transparent by design

No black box. Here's the exact math.

Regulatory
likelihood of finding (%) × penalty size
Remediation
# high-risk models × hours to fix per model × loaded hourly rate
Commercial
deals stalled × average deal value
Delay
weeks of delay × cost per week of delay
Total exposure
Regulatory + Remediation + Commercial + Delay

That's the whole formula. No hidden multipliers, no industry-average assumptions swapped in when a field is blank — blank fields count as zero. The “% of models with an undetected issue” figure never appears in this math because nobody has a real number for it without testing; that's a separate, deliberately unanswered question, not an input.

FAQ

Common questions.

Is this number real for my company?

The arithmetic is real — it is exactly your inputs multiplied together, nothing more. Whether the inputs themselves are realistic for your business is a judgment call only you can make. We assert nothing about your actual exposure.

Do you store what I enter?

No. The calculation runs entirely in your browser. Nothing you type into this page is sent to iDharma or saved anywhere — not even locally on your device.

Where do the public fine anchors come from?

Only from verified, sourced regulatory actions — we link the original source for each one. We deliberately do not publish a fine amount until it has been checked against that source, so the anchor list may be short or empty at any given time.

Why is the "undetected issue" box empty?

Because nobody — not you, not us, not anyone — knows that number for your AI without testing it. That's the entire point of the box. An audit is how you find out.

Do I have to fill in every field?

No. Blank fields count as zero, so a stream you leave empty simply adds nothing to the total. That is a gap in the arithmetic rather than a finding that the cost is zero — if you don't have a figure yet, read the total as “at least this much, on the streams I could fill in.”

What counts as a high-risk model?

Credit, hiring, claims, triage — decisions a regulator would look at first. The question is not how sophisticated the model is, it is whether its output changes what happens to a person. A simple scorecard that declines applications belongs in that count; a large model that drafts marketing copy does not.

What currency are the figures in?

The fields are labelled in USD because the published fines used as anchors are. The arithmetic itself has no currency in it — it multiplies and adds whatever you type. Enter every figure in one currency and the total comes back in that same currency.

Why doesn't it show a return, or a saving?

Because a saving figure would mean asserting how much of your exposure an audit removes, and that is not knowable before your models are tested — the same reason the box above is empty. This tool totals what is at stake. What an audit changes about it is not arithmetic anyone can do for you in advance.

Can I save, share or export the result?

No, and that is the storage answer rather than a missing feature: there is nothing to export because nothing is kept. Reloading the page clears every field, and closing the tab ends it. If you need the number, write it down before you go.

Is this an estimate of what an audit costs?

No. Every figure on this page is a cost of not auditing, and every one of them is entered by you. Nothing here prices an audit, and no part of the total is an iDharma fee. What an audit costs is on the Pricing page.

Turn the unknown into a number you can act on.

The unknown

The red box above is the whole point.

What you get

An audit is how you find out what's actually in it, instead of guessing.

The arithmetic on this page is real — it is exactly your inputs multiplied together, nothing more. Whether the inputs themselves are realistic for your business is a judgment call only you can make. We assert nothing about your actual exposure, and nothing here is legal, financial or compliance advice. Nothing you enter is stored or sent.