AI for business · Regulation
Digital Operational Resilience Act — financial sector
ICT risk management, incident reporting, resilience testing and oversight of ICT providers for banks, insurers, investment firms, payment institutions and their critical ICT suppliers.
In forceEUCybersecurityRegulation (EU) 2022/2554
What it means for AI
AI services from cloud providers are ICT third-party services: they belong in the register of information, need contract clauses and an exit strategy.
What you must do
- Register of all ICT third-party arrangements, including AI services.
- Contract requirements and exit plans for critical services.
- Major ICT incident reporting to the supervisor.
Examples
An insurer uses a generative AI assistant for claims
Add the provider to the ICT register, assess concentration risk and agree audit and exit rights.
Key dates
DORA applies.
Who supervises
Bank of Slovenia, Insurance Supervision Agency, Securities Market Agency.
Official sources
Industry guides
General information, not legal advice — consult a lawyer for borderline cases. Regulations reviewed on 29 Sep 2026.