The Cost of No AI Governance: Fines, Lawsuits and Lost Business

Most organizations I talk to are not ignoring AI governance on purpose. They are busy, the tools are already in use, and nobody has yet put a number on what it costs to leave the gap open. So the conversation keeps getting postponed.

I think that is the wrong way to frame it. Governance looks like a cost because the bill for skipping it arrives later, usually all at once, and usually from a direction nobody was watching. This article lays out where that bill actually comes from: regulatory penalties with specific ceilings written into law, enforcement actions that have already happened, litigation, and the reputational damage, which is harder to measure and which you should not assume your insurance covers.

I have tried to stick to things you can check. Where a rule is still moving, I say so.

What Does "No AI Governance" Actually Mean?

It rarely means a company has no AI. It means the company cannot answer basic questions about the AI it has: which systems are in use, who approved them, what data they touch, what happens when they get something wrong, and who is accountable when they do.

ISO/IEC 42001:2023 treats those questions as the starting point of a management system. Clause 5.2 requires an AI policy, clause 6.1.2 requires a documented AI risk assessment process, clause 6.1.4 requires an AI system impact assessment process, and clause 9.2 requires internal audits. An organization without any of this is not necessarily doing anything reckless today. It simply has no way to show a regulator, a customer, or a court that it was paying attention.

That last point matters more than people expect. In the FTC's Rite Aid case described below, the central finding was that the company had not taken reasonable steps to assess and reduce the risk beforehand.

Regulatory Fines: The Ceilings Written Into Law

The EU AI Act

Regulation (EU) 2024/1689 entered into force on 1 August 2024, and Article 99 sets the penalty tiers:

For small and medium-sized enterprises, Article 99 applies whichever amount is lower. That is a real concession, though it does not make the exposure trivial for a startup selling into the EU.

Two practical points. The prohibitions in Article 5 have applied since 2 February 2025, so the top penalty tier is already enforceable in principle. And the timeline for high-risk system obligations has been under discussion: the European Commission's Digital Omnibus proposal of November 2025 sought to adjust some application dates. I have not verified where that proposal stands in the legislative process as of this update, so if you are planning around a specific deadline, confirm the current status in the Official Journal rather than relying on any article, including this one.

The Act also reaches beyond the EU. A company outside Europe that places an AI system on the EU market, or whose system's output is used in the Union, can fall within scope. US software companies can easily assume the Act is someone else's problem until a European customer sends a procurement questionnaire.

GDPR Still Applies to AI

The EU AI Act did not replace the General Data Protection Regulation, and many AI failures are privacy failures first. Article 83(5) of the GDPR allows fines up to €20 million or 4% of worldwide annual turnover for violations of the core principles and data subject rights. Article 22 restricts decisions based solely on automated processing that significantly affect people, which covers a surprising amount of credit, hiring, and insurance workflow.

European regulators have not been shy. In December 2024 the Italian data protection authority, the Garante, fined OpenAI €15 million over how ChatGPT processed personal data, including the lack of an adequate legal basis and transparency failures. In September 2024 the Dutch Data Protection Authority fined Clearview AI €30.5 million for building a facial recognition database from scraped images.

United States: No Single Statute, Plenty of Enforcement

There is no federal AI Act in the US, which leads some executives to conclude there is no exposure. That conclusion does not survive contact with the enforcement record.

The Federal Trade Commission has used its existing authority under Section 5 of the FTC Act against unfair and deceptive practices. In December 2023 the FTC's order against Rite Aid barred the company from using facial recognition surveillance for five years, after finding it had failed to take reasonable steps to assess and reduce the risk of false positives, which fell hardest on women and people of color. The core of that case was a missing risk process, which is exactly what a governance system exists to supply.

In September 2024 the FTC announced Operation AI Comply, a set of actions against companies making deceptive claims about AI products, including DoNotPay, which had marketed a "robot lawyer." The Securities and Exchange Commission has pursued what it calls AI washing. In March 2024 it settled with two investment advisers, Delphia and Global Predictions, for a combined $400,000 in penalties after finding they had overstated their use of AI.

State and local rules add more. New York City's Local Law 144 requires bias audits for automated employment decision tools and sets civil penalties of $500 for a first violation and up to $1,500 for each subsequent one, with each day of use potentially counting separately. Colorado's SB 24-205 imposes duties on developers and deployers of high-risk AI systems, and its effective date has already been moved once by the Colorado legislature. I have not verified its current status as of this update, so check the current statute and effective date before you build a compliance plan around it.

Comparison: Penalty Exposure by Regime

Note: these figures are not like-for-like. The EU and GDPR rows are statutory maximums tied to turnover, the NYC row is a per-violation civil penalty, and the FTC and Colorado rows have no single comparable amount in this table.

The Costs That Are Not Fines

If I had to rank where the money really goes, regulatory fines would not be first for most mid-sized companies. The ceilings are dramatic, but a regulator has to find you, investigate, and conclude. The other costs show up faster.

Litigation and Liability

Courts are treating AI outputs as the company's responsibility. In Moffatt v. Air Canada (2024 BCCRT 149), British Columbia's Civil Resolution Tribunal held the airline liable for incorrect bereavement fare information given by its website chatbot and rejected the argument that the chatbot was a separate entity responsible for its own statements. The damages were small, roughly C$812 in total. The precedent was not small, because it told every company with a customer-facing chatbot that "the AI said it" is not a defense.

In Mata v. Avianca (S.D.N.Y. 2023), attorneys were sanctioned $5,000 after filing a brief containing case citations a chatbot had invented. The money is almost beside the point. The lawyers' names are attached to that story permanently.

Hiring is a likely area of litigation exposure, given the cases so far. In 2023 the EEOC settled with iTutorGroup for $365,000 after alleging its software automatically rejected older applicants. In Mobley v. Workday, a federal court in California conditionally certified a nationwide collective under the Age Discrimination in Employment Act in May 2025, allowing claims against an AI screening vendor, sued as an alleged agent of the employers using its tool, to proceed on behalf of a large group of applicants. Whatever the final outcome, the case shows that relying on a third-party screening tool does not take discrimination questions out of the hiring process, and employers should expect to be asked about the tools they use.

Lost Revenue From Procurement

This is the cost nobody budgets for. Enterprise buyers, especially in healthcare, financial services, and the public sector, are adding AI governance questions to security questionnaires and vendor reviews. A company that cannot produce an AI policy, a risk assessment, and evidence of oversight does not get fined. It just loses the deal, and often never learns why.

ISO/IEC 42001 certification is increasingly used as a shortcut for answering those questions, because it gives a buyer an independently audited management system to point to. I would not claim it is universally required. It is, in my view, becoming the thing that shortens a procurement cycle.

Incident Response Without a Plan

An AI system that produces a harmful output at 2 a.m. is an operations problem before it is a legal one. Without defined roles, escalation paths, and the ability to pause or roll back a model, the first hours are spent working out who is allowed to decide. Clause 8 of ISO/IEC 42001 on operation, and the Annex A controls on AI system lifecycle and monitoring, exist to make those decisions boring and fast.

Insurance and Investor Questions

Cyber and professional liability insurers have begun asking about AI use on applications, and some carriers have introduced AI-specific exclusions or conditions. I am not going to put a figure on how widespread that is, because I cannot point you to a source that would hold up. What I can say is that you should read your own policy language now, not after a claim.

Reputational Damage: Why It Is Harder to Recover From

A fine is a number with a closing date. Reputational damage from an AI failure behaves differently, and I think there are two reasons. This section is analysis, not measured data: I am not citing a study of customer loss or share-price effects, so treat it as a judgment.

First, the story is easy to retell. "A hiring algorithm rejected older applicants" or "a chatbot lied to a grieving customer" needs no technical background to understand, so it travels well beyond trade press. The Air Canada case was covered widely over a C$812 award.

Second, an AI failure reads as a decision the company made, not an accident that happened to it. People forgive a mistake faster than they forgive the sense that nobody was checking. When a company says it had no process for reviewing the system, the public hears negligence.

The recovery cost is the part that rarely makes it into a business case: the remediation program, the outside review, the customer communications, the months of leadership attention. I have no source that quantifies this, but it is reasonable to expect that remediation after a failure costs more than building the governance beforehand.

What Does It Take to Build AI Governance?

It depends on your size, how many AI systems you run, and how regulated your sector is. I will not quote a universal price, because it would be invented. The structure of the work is more useful:

1. Inventory. List every AI system in use or in development, including third-party tools employees adopted on their own.
2. Classify. Decide which systems touch hiring, credit, health, safety, or other consequential decisions. These get the closest attention under both the EU AI Act and most US state laws.
3. Assess. Run the risk and impact assessments that clauses 6.1.2 and 6.1.4 of ISO/IEC 42001 call for, and document the results.
4. Assign accountability. Name an owner for each system and a body that can approve, pause, or retire it.
5. Monitor and audit. Set up performance and bias monitoring, then verify the whole thing through internal audit under clause 9.2.

The first step alone usually changes the conversation. Organizations often find more AI tools in use than leadership expected, especially third-party tools that teams adopted on their own.

If you are not sure where you stand, a structured ISO 42001 gap assessment measures your current practices against the standard's requirements and shows what is missing before an auditor, regulator, or customer finds it first.

How ISO/IEC 42001 Reduces Exposure

ISO/IEC 42001:2023 is the first international management system standard for AI. It does not make you immune to enforcement, and certification is not a legal safe harbor under the EU AI Act. What it does is give you a documented, auditable process, which is the thing regulators and plaintiffs keep finding absent.

Annex A of the standard contains 38 controls organized under 9 control objectives, covering topics such as AI policies, internal organization, resources, impact assessment, the AI system lifecycle, data, information for interested parties, use of AI systems, and third-party relationships. Because it follows the same high-level structure as ISO 9001 and ISO/IEC 27001, organizations that already run those systems can usually extend what they have rather than start over.

There is also a useful overlap with the EU AI Act. Risk management, data governance, documentation, human oversight, and monitoring appear in both. A company building to ISO/IEC 42001 will not automatically satisfy every article of the Act, so you still need a mapping exercise, but you will not be starting from a blank page. If you want help building that system, our ISO 42001 consulting work is organized around exactly this problem.

Where I Would Start This Quarter

If I were running a company that had not yet done anything formal, I would not begin with a policy document. I would begin by asking one question of every department head: what AI tools does your team use, and what decisions do they influence? The answers tend to reveal the real risk faster than any framework.

Then I would pick the single highest-consequence system, probably something touching employment or customers, and do a proper impact assessment on it. One system done well teaches the organization what the rest of the program needs to look like.

The honest framing, I think, is that you are going to pay for AI governance either way. One path is a planned expense you control. The other is a fine, a settlement, or a lost contract that arrives on someone else's schedule.

Frequently Asked Questions

What is the maximum fine under the EU AI Act? Under Article 99 of Regulation (EU) 2024/1689, the highest tier is €35 million or 7% of total worldwide annual turnover, whichever is higher, for violations of the prohibited practices in Article 5. Most other obligations carry up to €15 million or 3%, and supplying incorrect information to authorities carries up to €7.5 million or 1%. For SMEs, the lower of the two amounts applies.

Can a US company be fined under the EU AI Act? Yes, if it places an AI system on the EU market or if the output of its system is used in the EU. Location of the company does not determine scope. Many US software and SaaS vendors fall within it without realizing.

Is there any AI regulation in the US if there is no federal AI law? Yes. The FTC enforces against unfair or deceptive AI practices under Section 5 of the FTC Act, the SEC has acted on misleading AI claims, the EEOC applies existing anti-discrimination law to automated hiring tools, and states and cities have their own rules, such as New York City Local Law 144 and Colorado SB 24-205.

Does ISO 42001 certification protect me from fines? No. It is not a legal safe harbor. It does give you a documented and independently audited management system for AI risk, which is the evidence regulators, courts, and customers look for, and it can reduce the likelihood that a failure occurs in the first place.

Who is liable when a third-party AI tool causes harm? Often the company deploying it. Moffatt v. Air Canada rejected the argument that a chatbot was responsible for its own statements, and Mobley v. Workday shows a court allowing age-discrimination claims to proceed against an AI screening vendor as an alleged agent of employers, so employers cannot assume a vendor's tool removes their own exposure. Contracts can allocate some risk to vendors, but they do not remove your own duties.

Last updated: 2026-10-31