Sensitive figures in public tools
Client data, transactions and preliminary figures end up in AI tools that are not in your ICT register. That is a data breach and a DORA finding at once.
Financial sector
AI on client and transaction data. With an ICT supply chain you can explain. Including to your supervisor.
Financial institutions and accountants want AI for analysis, reporting and case preparation. Under DORA they must keep every ICT service provider in view and be able to show an exit strategy. werqly runs open-weight models on a node that belongs to you alone, in your own server room or in our European datacentres, without dependence on a single model vendor.
- Financial data stays in the EU
- Open-weight models, no lock-in
- Audit log per user and per source
Running on your own node
Role: Finance & Control
- Mistral Large
- Llama 70B
- Qwen 32B
Safeguards active
Insight: anonymous (default)
- IBAN detection
- Client numbers blocked
werqly Node — your own AI node, in your own server room
The risk
Where it goes wrong in financial services.
Dependent on one vendor
An AI suite built on a closed model ties your process to the price, the terms and the continued existence of a single party.
Uses that are high-risk
Assessing creditworthiness or insurance risk with AI falls under the strictest rules of the AI Act.
Benefits
What it gives your organisation.
Faster work on figures and files, with an ICT supply chain you can explain to your supervisor.
Faster close and reporting
Analysing figures, flagging deviations and staging reports takes controllers and auditors less time.
An ICT supply chain you can explain
One service provider, open-weight models and an exit strategy that works on paper and in practice.
No lock-in to one model vendor
Open-weight models run on your node. Changing vendor is not a migration project.
Lighter documentation for DORA and the AI Act
Model provenance, logging and roles are recorded, so much of your supervisory file comes out of the system.
Use cases
What financial organisations use it for.
Automations are built per organisation, usually following from the TIMA Scan. The assessment stays with your staff.
Analysing monthly and annual figures
Flagging deviations and preparing first commentary for the controller or auditor.
Preparing client due diligence
Gathering and structuring information for KYC and AML files, for assessment by a member of staff.
Processing invoices and entries
Reading, classifying and staging incoming documents for approval.
Reports from your systems
Assembling periodic reports from ERP, CRM and core systems, in your own format.
Searching policy and regulation
Internal policy documents and regulation searchable, with sources.
Client correspondence
Classifying incoming questions and staging a draft reply for the member of staff.
AI security and governance control
AI security and governance, built for financial services.
werqly AI Control gives risk, compliance and IT one place to bound, log and account for AI use.
Roles per department
Finance, compliance and client contact each get their own sources, models and automations.
Safeguards on IBANs and client numbers
Account numbers, client numbers and other patterns are blocked per role before they reach a model.
Audit log to your SIEM
Every prompt, model and automation run, timestamped, exportable to your own monitoring.
Insight per department
Choose per department how much usage you see. Anonymous by default, four-eyes approval for incident investigation.
Model provenance for the AI Act
Which model performed which analysis is recorded. Required once a use counts as high-risk.
Exit and register in order
Automations and data are transferable. werqly sits in your DORA register with fixed arrangements.
Regulation
What your supervisor looks for.
werqly does not take over your obligations. It does make the ICT supply chain behind your AI short, visible and explainable.
| Framework | What it asks | How werqly fits |
|---|---|---|
| DORA (Regulation (EU) 2022/2554, applicable since 17 January 2025) | ICT risk management, a register of ICT third-party service providers, contractual requirements and an exit strategy. | In your own server room and self-managed, werqly is mainly a software supplier. With werqly Cloud or werqly Pro management, werqly belongs in your register. The models are open-weight, so an exit does not depend on one model vendor. |
| EU AI Act: high-risk uses | AI for the creditworthiness of natural persons and for risk assessment in life and health insurance is high-risk, with strict requirements for documentation, logging and human oversight. | werqly does not make such a use compliant by itself. The audit log and recorded model provenance do support your documentation. |
| GDPR and professional secrecy | Processing client and transaction data with a lawful basis, purpose limitation and appropriate security. Accountants are also bound by professional secrecy. | Processing on a dedicated node in the EU. Safeguards block IBANs, client numbers and other patterns per role. |
| EU anti-money laundering rules | Customer due diligence and reporting of suspicious transactions, assessed by the obliged entity itself. | Automations gather and structure information. The assessment and the report stay with your staff. |
This page is not legal advice. Always assess the use of AI with your own data protection officer, compliance function or professional body.
Recommended setup
Which setup fits a financial organisation.
Organisations under DORA often choose their own server room: the ICT supply chain is then at its shortest. werqly Cloud suits organisations without a server room of their own, with werqly as an ICT service provider in their register.
- Own server room, self-managed: the shortest ICT supply chain
- werqly Cloud: dedicated node in the EU, never shared
- Open-weight models: no dependence on one model vendor
Calculate your private AI costs.
Enter your work email and number of employees. We work out four setups for you straight away: in your own server room or in our datacentre, self-managed or with werqly Pro management. werqly is not a cheap AI subscription: you pay for your own hardware and full control.
- 1Enter your email and number of employees
- 2Compare four proposals
- 3Request a quote straight away
Working out the proposals…
If you choose werqly Cloud or werqly Pro management, werqly is an ICT service provider in your DORA register.
Your own server room
Your node in your own server room or rack
werqly Cloud
No server room? A locked rack in our EU datacentre
werqly Pro management
Your own server room
We operate the node and the models
— per month
—
- Data never leaves your premises
- No outside party in the processing
- Updates, monitoring and support by werqly
werqly Pro management
werqly Cloud
We operate the node and the models
— per month
—
- For organisations without a server room
- Dedicated node in a locked rack, never shared
- Updates, monitoring and support by werqly
Self-managed
Your own server room
Your IT department operates it; we supply software and updates
— per month
—
- Data never leaves your premises
- No outside party in processing or management
- Full control with your IT department
Self-managed
werqly Cloud
Your IT department operates it; we supply software and updates
— per month
—
- For organisations without a server room
- Dedicated node in a locked rack, never shared
- Your IT department runs policies and automations
Indicative amounts, excluding VAT. Custom automations are quoted separately. Only the quote is binding.
FAQ
Questions from financial organisations.
Is werqly a critical ICT third-party provider under DORA?
No, werqly has not been designated as a critical ICT third-party service provider. With werqly Cloud or werqly Pro management, werqly is an ICT service provider that belongs in your register and to which you apply the DORA requirements for contracts and exit.
What does an exit look like?
In your own server room the hardware is yours, running open-weight models you can use without werqly. With werqly Cloud we record the exit arrangements, including the handover of your data and automations, in the contract.
May AI make credit decisions?
AI that assesses the creditworthiness of natural persons is high-risk under the AI Act, with strict requirements. werqly does not change that. Use werqly to prepare files and analyses; the decision stays with a member of staff.
Does financial data leave the EU?
No. Processing happens on a dedicated node in your server room or in our European datacentres, with no call to an external model vendor.
Further reading in the knowledge base
AI at financial institutions: DORA, outsourcing and the AI Act
What does DORA mean for AI at banks, insurers and investment firms? Outsourcing, the register of ICT providers, the exit strategy and high-risk rules in the AI Act.
Read the article →What is private AI? Meaning, forms and when you need it
Private AI means language models run on infrastructure that belongs to your organisation alone. What it is, which forms exist and when it is the right choice.
Read the article →Is ChatGPT GDPR-compliant for your organisation?
Can your organisation use ChatGPT under the GDPR? The difference between free and business use, when it becomes a data breach and what you need to arrange.
Read the article →Other sectors
Law firms and notaries
It is not about AI, it is about professional secrecy. Case files and client data never leave your firm.
View the sector →Healthcare
Patient data, national hosting rules and medical confidentiality: AI that runs in your own server room.
View the sector →Local government
Residents’ data, algorithm registers and the AI Act: AI you manage yourself.
View the sector →