A financial entity under DORA that runs AI is subject to two regimes that ask for overlapping evidence about the same systems. This module sets out what you can build once, what a DORA control has NOT discharged, and the three incident clocks side by side.
Secure payment by Stripe. Delivered by email immediately, one named user.
A financial entity under DORA that runs AI systems is subject to two regulations drafted by different directorates, supervised through different channels, and built on different premises — which nonetheless ask for overlapping evidence about the same systems.
The usual response is two programmes. That is expensive, and it is also worse than expensive: two registers of the same systems will eventually disagree, and when they do, neither can be relied on in front of a supervisor.
The two regimes side by side. Object of regulation, dates, who is bound, what triggers the heavy duties, supervisor and penalty exposure. Including the provision most compliance teams miss: under Art. 74(6)-(7) of the AI Act, the market surveillance authority for many AI systems used by financial institutions is the financial supervisor you already report to. Both regimes can arrive in the same conversation.
What each regime asks you to hold, as artefacts rather than as principles — the DORA framework, asset identification, incident process, testing programme, register of information and contractual provisions, against the AI Act's risk management system, data governance evidence, Annex IV file, logging, oversight, conformity assessment and post-market duties.
The convergence analysis, in eight rows. Each states what can serve both regimes and — the more useful half — what the AI Act still demands separately. Asset identification, risk management, third-party management, incident management, testing, logging, the management system and competence. The rule of thumb it builds to: DORA asks whether the service keeps running; the AI Act asks whether the decision was sound and whether you can show it.
A ten-case classification matrix for the AI financial entities actually run: credit scoring, fraud detection, AML monitoring, algorithmic trading, insurance pricing, chatbots, generative content, biometric onboarding, HR screening and internal assistants. Each row gives the DORA angle and the AI Act classification question to settle — including the two that most often change a budget: fraud detection is expressly carved out of Annex III point 5(b), and HR screening is high-risk but self-assessed under Annex VI, with no notified body required.
One vendor contract instead of two. DORA Art. 30 already forces a contractual discipline that most AI Act vendor requirements can ride on. The module maps clause by clause what the existing ICT schedule already covers, and isolates the AI delta: four clauses and a warranty.
The three incident clocks side by side. A single AI failure can start DORA major-incident reporting, AI Act Art. 73 serious-incident reporting and the GDPR Art. 33 breach clock, on three different triggers. None substitutes for another. Including the runbook constraint that contradicts every operational instinct: Art. 73(6) forbids altering the system in a way that may affect the evaluation of causes before informing the authorities — the opposite of what a DORA recovery playbook tells the same engineers.
One register, with overlays. The attributes to add to the DORA Art. 28(3) register of information so that it carries the AI Act classification too, and why the tier must be derived rather than typed.
A 90-day sequence for an entity that is DORA-compliant today and has done little on the AI Act, front-loading the two obligations with the nearest deadlines and the cheapest evidence.
Compliance, risk and ICT functions in credit institutions, insurance undertakings, investment firms and payment institutions already operating under DORA — and the vendors who sell AI into them and are asked these questions during procurement.
It is a structural analysis of two regulations, not legal advice. Classification under Annex III is implementation-specific: two banks running nominally similar models can land on different sides of the point 5(b) fraud carve-out.
Is your organisation subject to both the AI Act and DORA? The two regulations intersect on the operational resilience of financial AI systems. Our sister site regulation-dora.eu covers DORA in depth — including what the AI Act adds on top of an existing DORA programme.
The AI Act for financial institutions ↗ Explore regulation-dora.eu ↗Yes. DORA — Regulation (EU) 2022/2554 — has applied since 17 January 2025 to credit institutions, insurance undertakings, investment firms, payment institutions and the other entities listed in its Art. 2. The same entities are subject to the AI Act for the AI systems they provide or deploy. The regimes do not substitute for one another: DORA governs the resilience of the ICT that delivers your services, the AI Act governs the safety and rights impact of particular AI systems.
No, and assuming it does is the expensive error this module exists to prevent. DORA Art. 5-10 is about operational resilience; AI Act Art. 9 is about harm to health, safety and fundamental rights from a system's intended use and reasonably foreseeable misuse. A DORA risk register will not contain a single Art. 9 row. The module states, control area by control area, exactly what the AI Act still demands on top.
The fundamental rights impact assessment is usually read as a public-sector duty. Art. 27(1) extends it to deployers that are credit institutions, for Annex III point 5(b) creditworthiness systems, and insurance undertakings, for point 5(c) life and health risk-assessment and pricing systems. It has no DORA analogue at all, so nothing you already run covers it.
No. The free page is a short orientation piece. This is a 9-page module: the two regimes compared across six dimensions, an artefact-by-artefact inventory of what each asks you to hold, an eight-row convergence analysis, a ten-case classification matrix for the AI financial entities actually run, a single vendor contract schedule serving both regimes, the DORA, AI Act and GDPR incident clocks side by side, and a 90-day sequence.
A 9-page PDF, delivered by email immediately after payment, one named user. The AI Act references are as amended by Regulation (EU) 2026/1744 — the Digital Omnibus of July 2026 — which moved four of the dates most published material still cites.