Start Free Trial
Home/Regulations/DORA — EU Digital Operational Resilience Act — Regulatory Reference
Regulatory Reference
Financial Services Global / EU high

DORA — EU Digital Operational Resilience Act — Regulatory Reference

ICT risk management, third-party oversight — AI agent registry and vendor access controls directly apply.

Key Provisions
  • Regulation (EU) 2022/2554 — applies from 17 January 2025
  • ICT risk management framework (Articles 5–16)
  • ICT-related incident reporting (Articles 17–23)
  • Digital operational resilience testing (Articles 24–27)
  • ICT third-party risk management (Articles 28–44)
How AutoPIL Enforces It
  • Agent registry + source registry constitute the documented ICT inventory DORA requires
  • Audit chain supports incident reporting timelines by surfacing affected agents and data sources
  • Third-party (LLM provider) access controls enforced by the AutoPIL policy engine
Audit LogPolicy EngineAgent RegistryAlert RulesSensitivity Labels
AutoPIL Policy IDs
FS-DORA-ART5-001ICT Inventory via AutoPIL Registries
FS-DORA-ART17-001Incident Reporting Audit Support
FS-DORA-ART28-001Third-Party LLM Provider Controls
Official Sources
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554https://www.eba.europa.eu/regulation-and-policy/single-rulebook/interactive-single-rulebook/dora

This page is a working reference and not a substitute for qualified legal review. Verify against official sources before use in compliance artifacts.

Frequently Asked Questions
What is DORA and when did it take effect?
DORA — the Digital Operational Resilience Act (Regulation (EU) 2022/2554) — is EU legislation that sets binding requirements for ICT risk management, incident reporting, resilience testing, and third-party ICT oversight across EU financial services. It applies to banks, investment firms, insurance companies, payment processors, crypto-asset service providers, and their ICT third-party providers. DORA took effect on 17 January 2025. Unlike some regulations with phase-in periods, there was no grace period — full compliance was required from the effective date.
Does DORA apply to AI vendors serving EU financial institutions?
Yes. DORA Articles 28-44 govern ICT third-party risk management and explicitly cover 'critical ICT third-party service providers.' AI vendors providing LLM APIs, model inference services, or AI governance tooling to EU financial institutions are ICT third-party providers under DORA. Institutions must: document all ICT third-party dependencies, assess concentration risk, include DORA-required contract clauses covering audit rights and exit plans, and report major ICT incidents regardless of whether the root cause is internal or third-party.
What ICT inventory does DORA require financial institutions to maintain?
DORA Articles 5-16 require a comprehensive ICT risk management framework that includes: a complete and up-to-date register of ICT assets (including AI systems and their data dependencies), documented information flows between ICT systems and external providers, classification of ICT assets by criticality, and ongoing monitoring of all ICT-related dependencies. An AI agent that accesses production financial data is an ICT asset under this framework and must be registered, documented, and monitored.
How does DORA's incident reporting timeline work for AI-related incidents?
DORA Articles 17-23 require financial institutions to classify ICT-related incidents by severity and report major incidents to their competent authority. The initial notification for a major incident must be submitted within 4 hours of the incident being classified as major (and no later than 24 hours after first detection). Intermediate reports are due within 72 hours. A final report is due within one month. For AI-specific incidents — a rogue agent accessing unauthorized data sources, a policy enforcement failure, a data exfiltration event — AutoPIL's audit chain provides the event timeline required for the incident report.
How does AutoPIL satisfy DORA's third-party ICT oversight requirements?
DORA requires documented oversight of all ICT third-party dependencies, including AI vendors. AutoPIL's agent registry and source registry together constitute the ICT asset inventory DORA requires: each AI agent is registered with its policy bindings, data source access scope, and owner team. Each data source is registered with sensitivity classification and access history. The tamper-evident audit chain provides the incident investigation record. When an ICT incident involving an AI agent occurs, AutoPIL's audit chain identifies the affected agents, data sources, and exact access timestamps needed for the DORA incident report.
AutoPIL Policy — YAML Reference

The policy below implements DORA's ICT risk management requirements for AI agents accessing financial data. Agent registry + source registry together satisfy the ICT asset inventory DORA Articles 5-16 require.

dora_ict_governance.yaml 
# FS-DORA-ART5-001 — ICT Risk Management via Agent Registry
# DORA Articles 5-16: ICT risk framework + third-party oversight
# Applies from 17 January 2025 — no phase-in period

- name: dora_ict_governance_agent
  policy_id: FS-DORA-ART5-001
  agent_role: dora_ict_agent

  allowed_sources:
    - ict_asset_registry
    - third_party_contracts
    - incident_reports
    - resilience_test_results
    - vendor_assessments

  denied_sources:
    - customer_financial_records
    - payment_transaction_data
    - trading_positions
    - client_portfolios

  allowed_tasks:
    - ict_inventory_review
    - third_party_risk_assessment
    - incident_classification
    - resilience_testing_review

  max_sensitivity: high
  require_task_for_sensitivity: high

  # DORA Art. 28: third-party risk — each task bound to minimum required sources
  task_bindings:
    - task: ict_inventory_review
      permitted_sources: [ict_asset_registry, third_party_contracts]
    - task: third_party_risk_assessment
      permitted_sources: [vendor_assessments, third_party_contracts, ict_asset_registry]
    - task: incident_classification
      permitted_sources: [incident_reports, ict_asset_registry]
    - task: resilience_testing_review
      permitted_sources: [resilience_test_results, ict_asset_registry]

  session_ttl_minutes: 480

  require_principal_entitlements:
    - tasks: [third_party_risk_assessment]
      require_any: [group:ict-risk-officers, group:ciso-team]
Deploy this policy Full YAML reference →
Covered Industries

DORA applies to financial entities regulated in the EU and their ICT third-party providers. AI systems that access, process, or generate outputs from financial data are ICT assets under DORA's scope.

Financial Services →
Banks, investment firms, payment processors, and crypto-asset service providers in the EU are within DORA scope. AI agents accessing financial data are ICT assets requiring documented oversight.
Insurance →
Insurance and reinsurance undertakings are explicitly within DORA scope. ICT third-party AI vendors serving EU insurers must satisfy the same oversight and contract requirements as other ICT providers.
AutoPIL Governance Platform

Enforce this regulation today

AutoPIL intercepts every AI agent data access call, enforces your policy, and writes a tamper-evident audit record — before sensitive data enters the agent context window.

Start Free Trial View All Industries