Risk & Value Evaluator

The business-risk perspective pure compliance review lacks: priority score, compliance cost bands, 3-year ROAI and an explicit verdict. Five-step evaluation pipeline — every threshold, band and formula is read from the knowledge graph (meta.evaluator, v2.1.2) — community-disputable, not hardcoded.

Step 0 — Describe or upload the use case

Service-as-a-Software examples:

Step 1 — Inventory & assumptions

Autonomy Data sensitivity Exposure Role (Art. 25 flip: shift to deployer if you materially modify the system) Realisation factor (base rate) Risk-class estimate Likelihood L: 3 — possible Impact I: 3 — €100k–€1M / material harm, localized breach Mitigation M: 3 — partial guardrails, manual review Gross annual benefit (€) Annual decision volume

BFSI / HealthTech premium (+20–30% compliance cost)Mature GDPR / ISO-27001 estate (−20–30% initial)Profiling of natural persons (blocks Art. 6(3) derogation)Safety-critical context (critical-infra / medical / physical actuation)

Art. 6(3) derogation criteria (multi):

Step 2 — Regulatory triage

Estimated class: Limited Risk (Transparency)

Effective class after triage: Limited Risk (Transparency)

Step 2b — Knowledge-graph reasoning & vendor recommendations

Describe the use case in Step 0 (a sentence or two) to derive the regulatory conclusion, required controls, evidence and vendor layers from the graph.

Step 3 — Quantification

Priority Score PS = (L·I)/M

3.00

Acceptable residual risk under standard continuous monitoring

FAIR-AIR Expected Loss / year (α = 1.1)

€55k – €550k

Planning band, not a prediction — see FAIR-AIR note.

Applicable fine tier

€7.5m or 1.5% of global turnover

inaccurate/misleading info to authorities

Liability exposure

PLD + AILD

Strict liability (PLD) + rebuttable causality presumption (AILD). Log preservation is your defence.

Step 4 — Compliance effort (limited-risk)

Initial (one-off)

€5k – €20k

Annual run-rate

€2k – €8k

Art. 50 labelling infra + Art. 4 literacy

≈ € per decision (annual midpoint / volume)

€0 – €1

Step 4b — 3-year discounted ROAI

ROAI (3y)

1730%

Benchmark: 150–300% for structured enterprise deployments.

Realised benefit (3y, discounted)

€510k

Total cost (3y)

€28k

Initial × 1.2 reserve (t0) + 3y of annual cost, discounted

Payback

2 months

Benchmark: 14–24 months.

3-year ROAI: gross annual benefit and recurring annual cost are both discounted at the configured rate for years 1-3; the initial cost (plus regulatory rework reserve) is booked undiscounted at t0.

FAST-TRACK DEPLOYMENT

Automated audit-as-code checks, baseline IT/privacy policy, no extra governance gates. Write down kill criteria anyway.

Indicative decision support, not legal advice. Risk classification depends on your concrete deployment context and can change with scope drift — validate the result with qualified counsel.