DORA and AI: Managing Third-Party ICT Risk and Operational Resilience in European Finance

The European Union's Digital Operational Resilience Act (DORA) established a comprehensive regulatory framework for financial institutions operating across Europe.

Unlike legacy regulations that focused primarily on financial capital reserves, DORA focuses on information and communication technology (ICT) resilience: the ability of banks, investment firms, insurance companies, and fintechs to withstand, respond to, and recover from ICT-related disruptions.

Generative AI and autonomous software agents represent a major, unmapped category of third-party ICT risk under DORA.

When European financial entities embed cloud foundation models into their core development, customer service, or algorithmic trading workflows, those AI providers become critical ICT third-party service providers. Uncontrolled dependency on single-provider cloud models creates severe operational resilience vulnerabilities.

DORA Pillars Directly Impacted by AI Adoption

Financial institutions must align their AI deployments across four core DORA chapters:

• Article 28 / ICT Third-Party Risk Management: Financial entities must maintain a comprehensive Information Register of all ICT third-party service providers, documenting data locations, criticality, and alternative fallback providers.
• Article 17 / Major ICT Incident Reporting: DORA mandates strict reporting timelines for major ICT incidents: initial notification within 4 hours, an intermediate report within 72 hours, and a final report within one month. If an AI agent executes an unauthorized trade or exfiltrates customer data, the firm must produce immediate forensic telemetry.
• Article 30 / Exit Strategies and Vendor Lock-In: Institutions cannot rely on third parties without viable exit strategies. If an organization's software development or analytics infrastructure is completely dependent on a single closed cloud LLM, it violates DORA's concentration risk mandates.
• Article 9 / Protection and Prevention: Entities must continuously monitor ICT systems and deploy mechanisms to detect anomalous traffic, prompt injections, and data exfiltration in real time.

Documented ICT Failures in European Financial Services

European regulatory bodies (EBA, ESMA, EIOPA) have already highlighted key failure points in early AI adoption:

1. Cloud API Outages Paralyzing Customer Operations

In late 2024, a major pan-European neo-bank experienced an 8-hour service outage when its cloud LLM provider suffered a global infrastructure failure. Because the bank had designed its automated fraud review pipeline with direct dependencies on that single API and no local fallback mechanisms, transaction reviews stalled, creating immediate regulatory reporting obligations under DORA.

2. Concentration Risk in Banking Codebases

European banking supervisors conducted targeted reviews of algorithmic trading and core banking modernization projects, discovering that several tier-1 banks were relying on a single proprietary US cloud model for code generation and automated testing. Regulators issued supervisory warnings requiring the banks to demonstrate viable multi-model exit strategies.

DORA requires financial entities to prove operational resilience under catastrophic conditions. If an outage at a single cloud AI provider brings your operations to a halt, you have failed the fundamental standard of the regulation.

Building DORA-Compliant Resilient AI Architectures

To comply with DORA requirements, European financial entities must architect their AI workflows around resilience, auditability, and vendor neutrality:

1. Multi-Model and Local Fallback Redundancy: Avoid single-provider lock-in. Implement architectures that support multi-agent model switching (such as Claude, Codex, local open weights, and proprietary options). If a cloud provider suffers an outage, workflows seamlessly transition to sovereign local hardware.
2. Complete ICT Asset Registration: Maintain automated discovery logs that track every AI model, agent runtime, and developer tool in active use across the institution, feeding directly into the DORA Information Register.
3. Comprehensive Forensic Incident Telemetry: Implement intent observability that logs every model input, output, and tool call with cryptographic timestamps, allowing incident response teams to meet DORA's 4-hour reporting threshold.

Summary

DORA has transformed operational resilience from an IT best practice into a strict legal mandate for European financial institutions. By deploying multi-model architectures with sovereign local execution and auditable boundaries, financial organizations can aggressively innovate with AI while remaining fully resilient and compliant.