AI Act vs DORA vs NIS2: Compliance Convergence for Financial Organisations

Financial institutions must navigate AI Act, DORA, and NIS2 with overlapping obligations and timelines. This guide maps the intersections: where obligations overlap, where they conflict, and how to dual-map documentation to reduce compliance burden.

Three regulations, one compliance programme

Financial organisations in the EU face AI Act, DORA, and NIS2 — three regulations that were designed independently but overlap substantially in the context of AI systems used in financial services. Managing them separately creates duplicative documentation, inconsistent governance, and unnecessary cost.

This guide maps the overlaps and shows where a single compliance effort can satisfy multiple regulations simultaneously.

Timeline comparison

Where AI Act and DORA overlap

Risk management

AI Act Art. 9 requires a risk management system for high-risk AI covering identification, estimation, evaluation, and mitigation of risks throughout the lifecycle.

DORA Art. 5–16 requires an ICT risk management framework covering identification, protection, detection, response, and recovery from ICT risks.

Overlap: Both apply to AI systems used in financial services. A single risk register and governance process can satisfy both, provided it covers the AI-specific risks required by Art. 9 (accuracy, robustness, bias, fundamental rights) in addition to DORA's ICT risk categories (availability, confidentiality, integrity, authentication).

Dual-mapping approach: Extend your DORA ICT risk register to include AI-specific risk dimensions. Document the combined assessment as meeting both Art. 9 and DORA Art. 5–16 requirements.

Incident reporting

AI Act Art. 73 requires providers of high-risk AI to report serious incidents to market surveillance authorities without undue delay.

DORA Art. 19–23 requires financial entities to report major ICT-related incidents to competent authorities within strict timelines (initial: 4 hours; intermediate: 72 hours; final: 1 month).

Overlap: An ICT incident caused by or involving a high-risk AI system may trigger both reporting obligations simultaneously. Build a single incident response procedure that assesses both thresholds and routes to both regulators where required.

Third-party and supply chain

AI Act imposes obligations on providers who develop AI. Deployers who procure high-risk AI systems from providers must verify provider compliance.

DORA Art. 28–44 requires financial entities to manage ICT third-party risk, including for AI providers and cloud services running AI systems.

Overlap: Procurement due diligence for AI systems used by financial entities must satisfy both: DORA's ICT third-party risk assessment and contractual requirements, AND verification of AI Act conformity assessment and CE marking.

Practical tip: Add AI Act compliance verification to your DORA ICT third-party due diligence checklist. Require AI providers to supply their conformity assessment documentation and EU database registration number.

Where AI Act and NIS2 overlap

NIS2 applies broadly to essential and important entities including financial institutions, energy providers, health organisations, and digital infrastructure operators.

NIS2 Art. 21 security measures apply to all ICT — including AI systems. Risk-based security measures, supply chain security, and business continuity planning all apply to AI as ICT components.

NIS2 Art. 23 incident reporting (24-hour early warning, 72-hour notification, 1-month final report) applies to significant incidents, including those involving AI systems.

Integration opportunity: NIS2 security measures and AI Act Art. 15 (accuracy, robustness, cybersecurity) for high-risk AI can be addressed through the same information security management system (ISMS) and cybersecurity programme.

Recommended dual-mapping framework

1. Single AI inventory — catalogue all AI systems, mapping each to AI Act risk tier AND DORA/NIS2 applicability
2. Combined risk register — extend ICT risk register to include AI-specific dimensions (bias, opacity, fundamental rights impact)
3. Unified incident response — single procedure with dual-threshold assessment for AI Act + DORA/NIS2 reporting
4. Shared third-party template — DORA ICT due diligence + AI Act conformity verification in one supplier questionnaire
5. Joint QMS — design the AI Act quality management system (Art. 17) as an extension of the DORA governance framework, not a separate silo

For DORA-specific guidance, see our sister site regulation-dora.eu — covering DORA's full ICT risk management, incident reporting, and third-party frameworks in depth.