Skip to content
YTT Secunet

Tool / Cross-border AI transfer exposure

Residency Risk Calculator

Enter your turnover and how AI requests are routed today. Get the statutory ceilings that apply, an exposure rating with the reasons behind it, and the control that removes each one.

Exposure workbench

Group turnover for the preceding financial year, as the fining provisions use it.

2M

40%

Names, emails, account numbers, IDs or free text about a person.

Where requests go today
Special-category data (GDPR Art. 9)?

Health, biometric, religious, trade union or sexual orientation data in prompts.

Part of an EU AI Act high-risk system?

Annex III uses such as credit scoring, recruitment or access to essential services.

Exposure rating

High

After in-jurisdiction routing

LowNo transfer exposure left from routing.

Requests with personal data

800k / month

Leaving the jurisdiction by route

800k / month

GDPR Art. 83(5)

EUR 40M

Statutory maximum for unlawful transfers (Art. 83(5)(c)). Basis: 4% of worldwide annual turnover.

EU AI Act Art. 99(4)

EUR 30M

Not triggered by your inputs: no high-risk system declared.

Ceilings are maxima, not predicted fines. Authorities set the amount case by case under GDPR Article 83(2) and AI Act Article 99(7): nature, gravity and duration, intent or negligence, mitigation, and cooperation.

Why, and the control that removes it

High

Every request with personal data is a Chapter V transfer to the US

Sending EU or UK personal data to a US endpoint is a restricted transfer. It needs the provider's certification under the EU-US Data Privacy Framework, or Article 46 SCCs with a transfer impact assessment and supplementary measures per EDPB Recommendations 01/2020. The request also pays a transatlantic round trip.

Route EU tenants to in-region endpoints and let the eu-gdpr-strict pack deny any endpoint outside the EEA before the request leaves.

Sovereign routing
Check

Accountability: can you prove where each inference ran?

Article 5(2) puts the burden of demonstrating compliance on the controller. A provider configuration page shows intent, not what happened to request 7f3a91 during last Tuesday's incident.

An Ed25519-signed receipt on every response, chained into hourly Merkle roots that an auditor verifies offline with ytt-verify.

Cryptographic proofs

Latency on the same route

Frankfurt to US East round trip (your current route)80 to 100 ms
YTT Secunet added gateway latency, p99< 8 ms

Transatlantic figure: speed-of-light fibre path and public cloud inter-region measurements, before model compute. Gateway figure: YTT Secunet production telemetry, 2026.

Email me this assessment

EUR 1.2B
fine on Meta Platforms Ireland for transferring EU user data to the US under SCCs after Schrems II
Irish Data Protection Commission, 22 May 2023
EUR 530M
fine on TikTok for transfers of EEA user data to China and transparency failures
Irish Data Protection Commission, May 2025
EUR 290M
fine on Uber for transferring European drivers' personal data to the US without a valid transfer tool
Dutch Data Protection Authority (AP), August 2024

How the calculator works

Ceilings come straight from the regulations. GDPR Article 83(5) caps fines for unlawful international transfers at EUR 20 million or 4% of worldwide annual turnover, whichever is higher. The AI Act caps breaches of high-risk and other operator obligations at EUR 15 million or 3%, and for SMEs the lower of the two applies.

The rating is a rule set, not a model. Points come from where requests go today, whether Article 9 data is involved, and whether the system is high-risk under the AI Act. There are no survey numbers and no likelihood estimates, so the same inputs always give the same answer.

Each finding names its control. The routing finding maps to jurisdiction-aware routing and in-jurisdiction failover, Article 9 data to in-path pseudonymization, high-risk systems to the AI Act policy pack and Annex IV exports, and accountability to signed receipts with Merkle inclusion proofs.

Read the GDPR Chapter V transfer guide for AI inference
typescriptresidency-risk.model
// T = worldwide annual turnover, EUR, preceding year

// GDPR, Regulation (EU) 2016/679, Art. 83(5)
gdpr = max(20_000_000, 0.04 * T)

// AI Act, Regulation (EU) 2024/1689, Art. 99(4)
aiAct = max(15_000_000, 0.03 * T)
// Art. 99(6): SMEs and start-ups take the lower
aiActSme = min(15_000_000, 0.03 * T)

// Exposure points: fixed rules, no probabilities
route = {
  "us-hosted": 3,
  "eu-failover-us": 2,
  "provider-eu": 1,
  "in-jurisdiction": 0,
}
points = route[current]
       + (article9 ? 1 : 0)
       + (highRiskSystem ? 1 : 0)

// 0 Low, 1 Medium, 2 to 3 High, 4+ Critical

Calculator questions

Is the result a prediction of what we would be fined?

No. The calculator computes statutory maxima from your turnover: the higher of EUR 20 million or 4% under GDPR Article 83(5), and the higher of EUR 15 million or 3% under AI Act Article 99(4). Actual fines are set case by case using the Article 83(2) criteria, and most are far below the ceiling.

Why does an EU region of a US provider still score Medium?

Processing in an EU region removes the routine transfer, but a US-parented provider can be compelled under the CLOUD Act to produce data in its possession, custody or control, and provider-side retention or support access from outside the EU can amount to a transfer. Zero retention and pseudonymization narrow what exists to be disclosed.

We rely on the EU-US Data Privacy Framework. Does that change the rating?

The DPF adequacy decision of 10 July 2023 is a valid transfer tool for certified US recipients, so a transfer under it can be lawful. The calculator still rates US routing as High because the transfer exists, rests on one adequacy decision that has been challenged before, and must be documented in your records and DPIA.

Which ceiling applies to an AI Act high-risk system?

Breaches of the obligations for high-risk systems, such as data governance, logging and technical documentation, fall under Article 99(4): up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher. The EUR 35 million or 7% ceiling in Article 99(3) is reserved for prohibited practices under Article 5.

Does in-jurisdiction routing make us compliant?

It removes the transfer that routing creates. You still need a lawful basis, a DPIA where Article 35 requires one, Article 30 records, and, for high-risk AI, the AI Act obligations. YTT Secunet enforces and evidences the technical controls; it does not give legal advice.

What happens to the data we enter?

The calculation runs in your browser. Nothing is sent unless you choose to email the assessment, in which case your email, company and the inputs above go to our Regulatory Specialist team under our privacy notice.

Sovereign route ready

Turn a High rating into a signed Low.

Point one service at a regional YTT Secunet base URL and every response carries proof of where it ran.

Schedule an architecture demo Start 14-day trial