AI at financial institutions: DORA, outsourcing and the AI Act

DORA in brief, for AI

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied since 17 January 2025 to banks, insurers, investment firms, payment institutions and other financial entities. DORA governs how they manage ICT risk, including when it sits with a third party.

An AI service is ICT. If your organisation uses an outside AI vendor, the following apply, among others:

• The register of information: all contractual arrangements with ICT third-party providers, including the AI vendor and its material subcontractors.
• Contractual requirements (Article 30): including the location of data processing, access, audit and inspection rights, availability and cooperation on termination.
• An exit strategy (Article 28): you must be able to switch or bring the service back in-house without disrupting your business or harming your clients.
• Concentration risk: what if much of your ICT sits with the same few large parties?

If the AI service supports a critical or important function, the requirements become heavier. Supervisors are filling this in for AI: Germany’s BaFin, for example, published guidance on ICT risks in the use of AI under DORA in December 2025.

The exit problem of closed AI models

With a closed AI model from a large vendor, an exit strategy is hard. You cannot take the model with you; it exists only at the vendor. Automations, prompts and work processes are tuned to that model. If the vendor changes its terms, its price or the model itself, you have little choice.

Open-weight models are different. The weights are published; you can run the same model on other hardware or at another party. Your automations keep working. That makes an exit strategy concrete rather than theoretical.

The AI Act: credit scoring and insurance are high-risk

The AI Act names two financial applications explicitly as high-risk: AI used to evaluate the creditworthiness of individuals or establish their credit score (with an exception for fraud detection), and AI for risk assessment and pricing in life and health insurance. After the Digital Omnibus, strict requirements on documentation, logging, data quality and human oversight apply to them from 2 December 2027. See The EU AI Act in 2026.

Those heavy requirements do not apply to most internal uses, such as summarising, searching policies and preparing reports. The GDPR, professional secrecy rules and DORA do.

Where AI adds value in finance

• summarising client files for an advisory meeting or a periodic review;
• gathering and structuring information for customer due diligence under anti-money laundering rules, with the assessment staying with your staff;
• searching and answering questions in internal procedures, product terms and regulations;
• preparing draft reports and explanatory notes;
• classifying and routing complaints and customer questions.

An ICT chain you can explain

A supervisor wants to know who is involved in processing your customer data, where, and what you do if that party drops out. The shorter the chain, the simpler the answer.

With werqly, AI runs on a dedicated node in your server room, with open-weight models. Self-managed, werqly is mainly a software supplier. If you choose werqly Cloud or werqly Pro management, werqly is an ICT third-party provider in your DORA register, and the exit does not depend on one model vendor. Safeguards block IBANs, customer numbers and other patterns per role, and the audit log records who did what. More on this is on AI for financial institutions.