The interplay of the AI Act and DORA: one AI system, two supervisory frameworks

Since 17 January 2025, DORA (Regulation (EU) 2022/2554) applies to banks, insurers, investment firms, payment institutions and their critical ICT service providers. The AI Act adds a second layer for the same institutions. The two frameworks pursue different goals — DORA protects the operational continuity of the financial system, the AI Act protects the safety and fundamental rights of individuals — but in practice they bite on the same systems, the same suppliers and the same internal processes.

Where the AI Act touches the financial sector directly

Annex III of the AI Act designates two typically financial applications as high-risk: AI systems for assessing the creditworthiness or establishing the credit score of natural persons (point 5b, with an exception for systems used to detect financial fraud), and AI systems for risk assessment and pricing in life and health insurance (point 5c). A bank supporting credit acceptance with AI, or an insurer differentiating premiums with AI, is therefore a deployer — and sometimes a provider — of a high-risk system.

The bridging provisions: the AI Act deliberately leans on financial services law

The legislator sought to avoid duplicate governance through three explicit bridging provisions:

• Article 17(4): providers that are financial institutions subject to

internal governance requirements under Union financial services law are deemed to fulfil most quality management system requirements by complying with those existing governance rules; a few elements of Article 17(1) remain excepted.

• Article 26(5): for deployers that are financial institutions, the

monitoring obligation is deemed fulfilled by complying with the internal governance rules under financial services law.

• Article 26(6): those same institutions retain the logs of high-risk

systems as part of the documentation they already keep under financial services law.

For institutions whose DORA and governance house is in order, this is good news: AI Act quality management need not become a parallel structure but can be embedded in the existing framework.

Where DORA already covers the AI question

DORA treats externally sourced AI — a model API, a SaaS scoring service, a cloud-based fraud detection system — as an ICT service from a third-party provider. The DORA requirements therefore apply in full: contractual minimum provisions, inclusion in the information register, concentration risk analysis and exit strategies. DORA's ICT risk management framework (identify, protect, detect, recover, learn) covers AI systems embedded in operations just as much as classic ICT.

Where it grinds

Three points demand deliberate design. First, incident reporting: DORA has its own duty to report major ICT incidents to the financial supervisor, while the AI Act (Article 73) requires reporting serious incidents with high-risk systems to the market surveillance authority. A single failure in an AI system can trigger both duties at once, with different deadlines and counters. Second, testing obligations: DORA resilience testing addresses continuity and security, not the data quality and bias requirements of the AI Act; one does not replace the other. Third, timing: DORA applies now, while the AI Act's high-risk obligations are expected — under the Digital Omnibus agreement of 7 May 2026 — to apply only from 2 December 2027. That makes the DORA framework the natural place to house AI Act preparation already — the bridging provisions of Articles 17 and 26 exist precisely for that purpose.