DORA for AI providers to financial firms

DORA applies directly to around twenty categories of financial entities in the EU: credit institutions, payment institutions, electronic money institutions, investment firms, crypto-asset service providers, insurance and reinsurance undertakings, and central counterparties, among others. It obliges those entities to manage ICT risk, report significant incidents to competent authorities, test digital operational resilience, manage third-party ICT risk, and, in limited cases, participate in threat-led penetration testing.

The regulation reaches AI providers indirectly through the third-party ICT risk-management pillar (Chapter V) and directly through the oversight framework for critical ICT third-party providers (Article 31 onwards). Any AI provider whose service is deemed to support a critical or important function of a financial entity is a third-party ICT service provider under DORA. If the European Supervisory Authorities designate a provider as a critical ICT third-party provider (CTPP), that provider becomes subject to direct oversight by a lead overseer with powers to conduct investigations, on-site inspections, and issue binding recommendations.

Every contract between a financial entity and a third-party ICT provider must include specific provisions defined in Article 30: description of services, service levels, notice periods, exit strategies, access and audit rights for the financial entity and the competent authority, security controls, incident-reporting protocols, subcontracting terms, and applicable law. A generic services agreement is not compliant. Financial entities are also required to maintain a Register of Information listing all their ICT third-party arrangements, submitted annually to competent authorities.

The five pillars of DORA are: ICT risk management (Chapter II), ICT-related incident classification and reporting (Chapter III), digital operational resilience testing (Chapter IV), third-party ICT risk management (Chapter V), and information and intelligence sharing (Chapter VI). For AI providers, Chapters III, IV, and V carry the operational weight.

If you are procuring AI as an EU financial entity, DORA determines what your contract with the AI provider must contain. The provisions in Article 30 are non-negotiable, they must be in the contract before the service commences supporting a critical or important function. A provider who cannot accept those provisions, or who has not previously executed a contract compliant with them, is not yet a viable procurement counterparty for regulated financial engagements.

The classification of your engagement as supporting a critical or important function is decided by you as the financial entity, not by the provider. That classification drives the depth of the due diligence, the resilience-testing requirements, and the exit-strategy planning obligations. A provider serving multiple financial entities across the EU can find itself designated a critical ICT third-party provider through cumulative concentration, at which point it becomes subject to direct oversight by the European Supervisory Authorities.

Incident reporting obligations under Article 19 apply to the financial entity, but the provider is the primary source of the information the financial entity must report. Providers must be contractually obliged to notify the financial entity of ICT-related incidents within timeframes that allow the entity to meet its own reporting deadlines to the competent authority. AI providers who cannot produce incident information at the granularity DORA requires cannot support the financial entity's compliance chain.

The gap between an AI provider generally familiar with DORA and one operating a DORA-ready contracting and operations posture is significant. Familiarity with Article 30 contract clauses, concrete incident-reporting timelines, a documented exit strategy, and evidence of prior audits under DORA-adjacent frameworks (EBA guidelines on outsourcing, DNB or BaFin sector guidance) are the operational markers. The questions below draw the line.

Trustgent's provider profiles include a DORA readiness attribute. At L2 cross-reference level and above, that attribute is checked against evidence outside the provider's marketing: contracts published in redacted form, references in financial-entity procurement documentation, participation in industry-body working groups, or third-party publications describing the provider's DORA posture. We do not act as a DORA compliance auditor (the financial entity, its competent authority, and the European Supervisory Authorities carry that role) but we distinguish, in the index, between a DORA claim and a corroborated posture.