Most “compliance” projects start with the vendor, not the question. Someone asks for three proposals, compares hours and picks. Six months later they discover the framework was the wrong one, or that the real cost sat in the stack, not the report. A regulatory diagnostic — done properly — reverses the order: first what applies, what it costs not to have looked, and what audit depth makes sense. Then, if it fits, you talk program.
Three numbers that matter before scope
Cost of not complying: not the regulation’s maximum fine. An estimate of technical effort, exposure and product delay if you stay as you are. The Orbit wizard ranks it from sector, size, markets and what worries you most. It is orientative. It is for leadership to see magnitude, not for an actuary.
Risk: where it hurts first — data, access, continuity, third parties. If you do not prioritise, the project eats the quarter on the most visible control, not the most expensive one to fail.
Applicable framework: the short list, not the encyclopaedia. A Spanish Fintech with EU clients does not need “every acronym”. It needs the ones the product and the market trigger. Confusing the list with the plan is the brief’s most expensive error.
What the thermometer does — and what a crawler will not see
You are reading this on a static page. The personalised result is not here: it lives behind the flow (site, card, questions, estimate). That is deliberate. A diagnostic that could be scraped whole would be a generic article, not your card.
The flow asks for the URL and legal name, proposes a card (sector, size, seat) for you to correct, then focuses the rest on what keeps you up. At the end: an estimate and the framework the thermometer thinks applies. It is not an opinion. The Terms say so. If someone uses it as a certificate, they are misusing the tool.
The boundary with the initial audit
The diagnostic costs machine time and a few of your minutes. The initial audit is €1,000 and a technical study by plan (basic, complete, extended or full). The first decides whether the second is worth it. The second opens Orbit.
Skipping the diagnostic and buying “a compliance project” is the consultancy model again: invented scope, then a SOW change. Skipping the audit and asking for blind implementation is the opposite error: you touch the system with no map. The order exists for that reason.
How to use it in a committee (without theatre)
Bring the three: business, technology and whoever reads the framework. Correct the card together. Treat the estimate as a hypothesis, not a verdict. If the magnitude does not justify a program, you saved an RFP. If it does, the next step is the 30-minute conversation and, if it fits, the audit.
What not to do: send the result to a consultancy to “turn it into a proposal”. The thermometer is not designed to feed another deck. It is designed to decide whether Orbit is the vehicle or not.
Signals you are not ready yet
There is no internal owner of the stack. You cannot share read access in a reasonable cycle. The goal is “a badge for the website”. In those cases the diagnostic will still return numbers, but the program will not start well. Fix internal governance first.
If there is an owner, a product in production and a framework that already costs you sleep, the wizard is the right place to start. Five minutes on the card save five weeks of a badly framed brief.