DORA

The Digital Operational Resilience Act (DORA) is an EU regulation that sets uniform requirements for the digital operational resilience of financial entities, including their use of AI and ICT third-party service providers.

What is DORA?

DORA applies from January 2025 to banks, insurers, investment firms, payment institutions, and many of their critical ICT providers. Requirements cover ICT risk management, incident reporting, digital operational resilience testing, third-party risk management, and information sharing. AI systems supplied to financial entities must support DORA's testing, monitoring, and exit-strategy obligations.

How does DORA apply to enterprise AI?

Any AI vendor selling into EU financial services must be ready for DORA-aligned diligence: documented incident processes, testing evidence, contractual sub-contracting controls, and exit plans.