The Digital Operational Resilience Act became enforceable in January 2025, requiring EU financial institutions to maintain comprehensive ICT risk management frameworks under BaFin supervision. AI agents operating autonomously—processing loans, running compliance checks, executing trades—have created regulatory gaps.
The Five DORA Pillars
1. ICT Risk Management Framework
Identify, protect, detect, respond, recover across all ICT assets including AI agents.
2. ICT Incident Reporting
Classify and report major ICT-related incidents to BaFin within 72 hours.
3. Digital Operational Resilience Testing
Regular testing including TLPT covering AI agent attack surfaces.
4. Third-Party Risk Management
Contractual and oversight requirements for AI/ML vendors and model providers.
5. Cyber Threat Intelligence Sharing
Information sharing across financial entities for collective resilience.
Traditional vs AI-Augmented ICT Risk
| Dimension | Traditional | AI-Augmented |
|---|---|---|
| Behaviour | Deterministic | Probabilistic |
| Failure modes | Binary | Gradual degradation, silent drift |
| Attack surface | Network, app, infra | + training data, prompts, weights |
| Vendor concentration | Distributed | Few model providers dominate |
| Auditability | Full code traceability | Black-box decisions |
Implementation Roadmap
Phase 1 (Months 1–2): Discovery & Gap Analysis
Inventory all AI agents. Map to DORA requirements. Identify gaps in asset classification, third-party contracts, and testing coverage.
Phase 2 (Months 3–5): Framework Enhancement
Update ICT risk management framework. Revise policies for AI asset classification, change management, and incident classification.
Phase 3 (Months 6–8): Testing & Validation
Execute resilience testing covering AI-specific scenarios. Validate exit strategies. Test incident reporting workflows.
Phase 4 (Ongoing): Continuous Governance
Embed AI risk management into BAU. Continuous monitoring for agent behaviour and model drift.
Need help implementing this?
First strategy session is complimentary. We typically respond within 4 hours.