What compliance really costs
And why SMBs pay the most for the least.
Before we built anything at Heldr, we asked one question: what does compliance actually cost a Dutch company? Not the fines. The everyday cost of keeping up. The answer explained why so many owners we spoke to felt stuck.
In brief
- Following rules costs Dutch businesses €9.1 billion a year, and the Netherlands has the highest burden in the EU as a share of labour costs.
- SMBs get the same rules as a bank, without a legal department. Every common way of handling it fails in its own way.
- Shadow AI adds a new line to the bill: the expensive part is the tool nobody knew about.
The bill nobody sees
PwC Netherlands calculated it in July 2026. Following rules costs the Dutch economy €16.8 billion a year. €9.1 billion of that lands on businesses. After inflation, the cost rose 28% between 2013 and 2024.
#1 in the EU
Measured as a share of labour costs, the Netherlands had the highest compliance burden of all 27 member states in 2024.
Source: PwC Netherlands, 2026
And that figure only counts labour: the hours people spend on compliance. Tools, advisers and audits come on top.
Same rules, a fraction of the people
The EU AI Act, NIS2 and GDPR don't scale down for smaller companies. A business with forty people gets the same customer questionnaire as a bank. It just has to answer it without a legal department.
So most SMBs choose one of four routes. Each one fails in its own way.
How companies handle it today
| Approach | Indicative cost | What goes wrong |
|---|---|---|
| One-off consultant | €5,000 to €50,000 per project | The knowledge leaves with them. Next law, next consultant. |
| Internal compliance officer | €60,000 to €90,000 per year | Too expensive for most SMBs. Knowledge sits with one person. |
| Spreadsheets | Looks free | Error prone, nobody has the full picture, and it breaks the moment something changes. |
| Enterprise GRC platform | €50,000 to €200,000 per year | Built for companies with a compliance department. |
The pattern is the same every time. Compliance is bought as a project, done once, and out of date by the next quarter.
AI just added a new line to the bill
Then came AI. Not the AI a company decided to adopt, but the AI its people started using on their own.
IBM's 2025 Cost of a Data Breach Report was the first to look at this. What it found:
1 in 5
Breaches where shadow AI played a role. It added $670,000 to the average cost.
Source: IBM, 2025
97%
Of organisations with an AI related breach, the share that had no proper AI access controls.
Source: IBM, 2025
63%
Breached organisations without an AI governance policy, or still writing one.
Source: IBM, 2025
The global average cost of a breach was $4.44 million. Most of that is not a fine. It is detection, recovery, lost business and notifying the people affected.
The lesson is uncomfortable but simple: the expensive part is not the policy you wrote. It is the tool nobody knew about.
What is live today
Some of this is no longer a future problem.
- AI literacy (AI Act article 4) has applied since 2 February 2025.
- AI transparency obligations have applied since 2 August 2026.
- The Cyberbeveiligingswet, the Dutch NIS2 law, has applied since 15 August 2026, with no transition period.
- High risk AI obligations are delayed, phasing toward the end of 2027.
Status as verified by Heldr in October 2026. This is general information, not legal advice.
What we concluded
Three things.
Compliance has to be affordable. A company of forty people should not need a legal budget to follow the law.
Compliance has to be continuous. A one off audit describes a company that stopped existing the moment someone installed a new tool. The work has to run in the background, like accounting does.
Compliance is the foundation, not the paperwork. When you know which tools you use, who has access, where your data goes and which suppliers you depend on, most of the cheap doors an attacker looks for are already closed. What remains is a short list of places worth protecting, and you can protect those properly.
That is why we built Heldr.
Sources and further reading
Last reviewed on 29 October 2026. Legislation and official guidance may change.
See what's running in your company.
The Heldr Pilot shows every AI tool in use, a verdict per framework and what to fix first.
No demo.
Just a good conversation.
Together we look at what is going on, what is relevant and where the biggest risks sit.
Book an introductionRelated within this theme