EU AI Act vs DORA: AI Risk Management for Banks and Financial Firms

Banks, insurers, payment firms and investment firms now face two EU regulations that both reach into how they run AI. The Digital Operational Resilience Act (DORA) has applied since 17 January 2025 and treats every AI system as an ICT asset that must be resilient, secure, monitored and recoverable, along with every AI vendor as an ICT third-party provider. The EU AI Act adds a second lens: is the AI itself fair, transparent, well governed and overseen by humans, especially when it decides who gets credit or insurance?

The two laws were written by different teams for different purposes, but they meet in the same place: the bank's risk function. DORA's first annual incident report recorded 3,383 major ICT incidents across the EU financial sector in 2025. Meanwhile, the AI Act's high-risk rules for credit scoring and life and health insurance pricing apply from 2 December 2027.

This guide compares the two regulations side by side, shows where AI Act duties can be met through existing DORA and banking governance, and sets out a practical plan for one integrated AI risk framework.

The short answer

DORA asks whether your AI keeps running safely: is it secure, tested, monitored, recoverable after an incident, and properly governed when a third party provides it? The AI Act asks whether your AI treats people properly: is it built on governed data, explainable to the people who use it, overseen by humans and free from unlawful bias?

Every AI system in a financial entity falls under DORA. Only some fall under the AI Act's high-risk regime, mainly credit and insurance decisions about individuals. For those systems, you need both, and the AI Act lets financial institutions meet several duties through the governance rules they already follow.

What DORA requires, and how it captures AI

DORA applies to 20 types of financial entity, including credit institutions, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and fund managers. It rests on five pillars:

• ICT risk management (Articles 5 to 16): a management-body-approved framework covering identification, protection, detection, response, recovery and learning
• ICT incident management and reporting (Articles 17 to 23): classifying incidents and reporting major ones to supervisors
• Digital operational resilience testing (Articles 24 to 27): including threat-led penetration testing for significant entities
• ICT third-party risk (Articles 28 to 44): due diligence, mandatory contract terms, a register of information, exit plans and EU oversight of critical providers
• Information sharing (Article 45): voluntary exchange of cyber threat intelligence

DORA never uses the word "AI", but it captures AI completely. A credit model is an ICT asset. A chatbot outage that blocks customer service can be a major ICT incident. A general-purpose AI model accessed through an API is an ICT service, and its provider is an ICT third-party service provider that belongs in your register of information.

The critical provider list matters for AI. It includes the hyperscale cloud platforms that host most bank AI workloads, such as Amazon Web Services, Google Cloud and Microsoft, along with IBM, Oracle, SAP, Accenture and Tata Consultancy Services. Because the ESAs update the list every year, AI model providers whose services become systemic could be added later.

Source: ESAs' 2025 Report on major ICT-related incidents (JC 2026 16), published 3 June 2026. It covers 2025 incidents with a final report submitted by 5 February 2026.

What the AI Act adds for financial firms

The AI Act sorts AI by risk. For financial services, two Annex III use cases are high-risk:

• Creditworthiness and credit scoring of natural persons (point 5(b)), except AI used to detect financial fraud
• Risk assessment and pricing for natural persons in life and health insurance (point 5(c))

Other financial AI can still be high-risk if it falls under other Annex III categories, such as AI used in recruitment or to evaluate employees. Any AI system is subject to the prohibitions (in force since 2 February 2025), AI literacy duties, and Article 50 transparency rules for chatbots and AI-generated content (since 2 August 2026).

For high-risk systems, providers must meet requirements on risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness and cybersecurity. They must also run a quality management system and complete conformity assessment and registration. Deployers, which includes most banks using a vendor's credit model, must use the system as instructed, assign competent human oversight, monitor it, keep logs and, for credit and insurance uses, carry out a fundamental rights impact assessment (Article 27) before first use.

If you are building AI governance inside a bank or insurer, I post practical breakdowns of the AI Act, DORA, ISO 42001 and the NIST AI RMF regularly on LinkedIn. You're welcome to connect with me there and tell me which overlap your risk team is working through.

Built-in relief: where financial governance satisfies the AI Act

The AI Act recognises that financial institutions already work under strict internal governance rules, under the Capital Requirements Directive (CRD) and similar sector laws. It lets them meet several duties through those existing arrangements:

The EBA's AI Act mapping, sent to the Commission on 21 November 2025, reached a similar conclusion. Many AI Act control objectives for credit scoring are already covered by the CRD and CRR, DORA, consumer and mortgage credit rules and EBA guidelines on loan origination and internal governance. But it found no exemption from core AI Act duties such as data governance and human oversight.

EU AI Act vs DORA: side by side

Where the two regimes meet in practice

Supervisors are already linking the two. In its June 2026 Risk Assessment Report, the EBA warned that highly capable frontier AI models are increasing cyber risk for banks by speeding up vulnerability discovery and exploitation. That puts AI squarely inside DORA's ICT risk framework, whether or not a bank uses high-risk AI itself.

How the timelines fit together

• 16 Jan 2023

  DORA enters into force.

• 1 Aug 2024

  AI Act enters into force.

• 17 Jan 2025

  DORA applies to financial entities.

• 2 Feb 2025

  AI Act prohibitions and AI literacy duties apply.

• 18 Nov 2025

  ESAs designate 19 critical ICT third-party providers.

• 21 Nov 2025

  EBA sends its AI Act mapping for banking and payments to the Commission.

• 3 Jun 2026

  ESAs publish the first DORA major-incident report: 3,383 incidents in 2025.

• 27 Jul 2026

  Digital Omnibus on AI enters into force, moving the Annex III high-risk deadline.

• 2 Aug 2026

  AI Act Article 50 transparency duties and penalties apply.

• 2 Dec 2027

  AI Act high-risk duties apply to credit scoring and life and health insurance pricing.

A 6-step plan for one AI risk framework

1. Build one AI inventory linked to the DORA register

   List every AI system, model and AI service, including vendor and embedded AI. Link each one to its DORA ICT asset record and register-of-information entry, and tag its AI Act risk class and role (provider or deployer).

2. Classify high-risk use cases precisely

   Identify credit scoring, creditworthiness assessment and life and health insurance pricing for individuals, along with HR uses. Record the fraud-detection exclusion where it genuinely applies.

3. Extend the ICT risk framework to AI-specific risks

   Add model risk, bias, drift, data poisoning, prompt injection and explainability to your DORA ICT risk framework and model risk management, approved by the management body.

4. Upgrade third-party contracts

   Combine DORA's mandatory contract terms with AI Act deliverables from vendors: instructions for use, technical documentation summaries, conformity evidence, change notifications and serious-incident cooperation.

5. Add the AI-specific controls banking rules lack

   Build data governance and bias testing for credit and pricing models, design meaningful human oversight, and complete fundamental rights impact assessments before 2 December 2027.

6. Unify incidents, testing and reporting

   Use one incident triage process for DORA and AI Act reporting, include AI systems in resilience testing, and report AI risk to the management body alongside ICT risk.

Common mistakes to avoid

• Assuming DORA doesn't cover AI because it never mentions it
• Leaving general-purpose AI APIs out of the register of information
• Treating the AI Act's integration provisions as a full exemption
• Assuming the vendor does the fundamental rights impact assessment, when it's the deployer's duty
• Running separate AI, ICT and model risk inventories that never reconcile

A prompt to map your AI portfolio to DORA and the AI Act

Paste in your organisation's details to get a first-draft compliance map. Your risk, compliance and legal teams should review it.

You are a financial services regulatory specialist with deep
knowledge of DORA (Regulation (EU) 2022/2554), the EU AI Act
(Regulation (EU) 2024/1689) as amended by the Digital Omnibus on
AI, and EBA guidance on AI and internal governance.

Our organisation:
[entity type (bank, insurer, payment institution, investment
firm); Member State; list of AI systems with purpose, provider
(in-house or vendor), hosting and data used; whether any assess
creditworthiness or price life/health insurance for individuals;
key AI and cloud vendors; current ICT risk and model risk
frameworks]

Produce:
1. For each AI system: AI Act risk class and our role (provider
   or deployer), and its DORA treatment (ICT asset, ICT service,
   supports a critical or important function?).
2. A table of AI Act duties for high-risk systems, marking which
   are met through existing governance (Articles 17(4), 18(3),
   19(2), 26(5), 26(6), 72(4)) and which need new controls.
3. Contract clauses to add for AI vendors, combining DORA
   Article 30 with AI Act deliverables.
4. An incident triage flow that tests both DORA major-incident
   and AI Act serious-incident criteria.
5. A fundamental rights impact assessment outline for our
   credit or insurance AI.
6. A plan to 2 December 2027, with owners.

Use only what I provide and mark uncertain points UNKNOWN.

DORA makes sure your AI keeps running when everything else goes wrong. The AI Act makes sure it does the right thing when everything goes right. Banks need both answers. — Kumail Mehdi

Frequently asked questions

Building AI risk management in a bank or insurer? Let's connect on LinkedIn. I'm always glad to compare notes on AI in financial services.

Sources

• EUR-Lex — Regulation (EU) 2022/2554 (DORA)
• EUR-Lex — Regulation (EU) 2024/1689 (AI Act)
• ESAs — List of designated critical ICT third-party service providers
• Ropes & Gray — Lessons from the ESAs' first DORA major-incident report
• CPDS Academy — DORA 2025 incidents and third-party risk
• EBA — AI Act implications for the EU banking and payments sector
• Bird & Bird — Interplay between AI and financial institutions
• Harvard Data Science Review — Credit underwriting and insurance under the EU AI Act
• The Leveraged Years — EBA maps the AI Act to credit scoring
• Let's Data Science — EBA says frontier AI models increase banks' cyber risk
• PwC Legal — ESAs publish first list of critical ICT third-party providers