DORA and AI: What EU Financial Institutions Need to Have in Place

DORA has been enforceable since January 2025. AI systems are in scope. Most firms missed it.

CROs, CISOs, IT risk managers, and regulatory compliance leads at banks, asset managers, insurance companies, payment institutions, and fintechs operating in or serving the EU under DORA’s scope.

Most DORA implementation programs focused on cloud providers, legacy infrastructure, and critical ICT third parties — the categories explicitly named in the regulation. AI models running on that infrastructure were often left out of the ICT asset register, incident classification criteria, and resilience testing programs.

A practical guide to the five most commonly missed DORA obligations for AI systems: absence from ICT asset registers, undefined AI incident classification criteria, AI vendors not covered by DORA Article 30 contractual requirements, resilience testing that ignores AI failure modes, and BCPs with no AI system fallback procedures.