What is DORA?
DORA, the Digital Operational Resilience Act, is the European Union regulation that sets common rules for how financial entities manage the risk of their information and communication technology (ICT). It applies to banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers, and the ICT providers that serve them, and it has applied since January 2025. The aim is that a bank keeps operating through a cyberattack, a cloud outage, or a failed supplier, and that supervisors see the incidents that do happen.
DORA does not mention AI, but every AI system a financial entity runs is an ICT system, and every hosted model API it calls is an ICT third-party service. The regulation therefore governs how AI is bought, contracted, monitored, and tested in finance.
How DORA works
The regulation has five pillars. ICT risk management requires a documented framework owned by the management body, with asset inventories, protection, detection, response, and recovery. Incident management requires classifying ICT incidents and reporting major ones to the supervisor within set deadlines. Resilience testing requires regular testing of critical systems, and for significant entities threat-led penetration testing every three years. Third-party risk management requires a register of all ICT contracts, specific contractual clauses on security, audit rights, exit, and subcontracting, and analysis of concentration risk, with the largest providers placed under direct EU oversight. Information sharing lets entities exchange threat intelligence.
For AI, the third-party pillar bites hardest. A model API used in a critical function needs the full contract clauses, an exit strategy, and a place in the register. A self-hosted open-weight model moves the dependency from a vendor to the entity’s own infrastructure, where the risk management and testing pillars apply instead.
DORA in practice
A payment institution uses a language model to summarize suspicious transaction cases for its investigators. Under DORA, the compliance team records the model service in the register of information and classifies the function it supports as important. The contract with the model vendor is renegotiated to add audit rights, incident notification duties, and an exit plan. Because a vendor outage would halt case processing, the institution deploys a fallback open-weight model in its own data center and tests the switchover twice a year as part of its resilience testing program.
What to watch for
- Map every AI feature to the business function it supports, because the function’s criticality drives the controls.
- Check whether AI features embedded in existing SaaS products introduce new subcontractors that belong in the register.
- Test the fallback for an AI service, since a plan that has never been exercised offers no resilience.
- Expect supervisors to ask how a model vendor’s own outage or data breach would reach your customers.