DORA and AI: what EU financial entities must show about their AI suppliers

DORA does not have a separate chapter for AI. That is easy to read as good news, one less regulation to track, but it is closer to the opposite: it means an AI vendor supporting a financial entity's critical operations is already inside the same rigorous ICT third-party risk framework as its core banking platform, its cloud provider, and every other piece of infrastructure the business depends on.

Who is actually in scope

The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025. It covers a wide sweep of the EU financial sector: credit institutions, payment and e-money institutions, investment firms, insurance and reinsurance undertakings, crypto-asset service providers, trading venues, central counterparties, and several further categories set out in the regulation itself. Their ICT third-party providers are pulled into scope too, particularly those the European Supervisory Authorities designate as critical, who face direct EU-level oversight rather than oversight only through their financial-entity customers.

Why an AI vendor is just another ICT provider under DORA

DORA's logic is deliberately uniform. It does not ask whether a service is "AI" or "not AI". It asks whether the service supports a critical or important function, and if it does, the same obligations apply regardless of what the underlying technology is. For a financial entity using an AI system for anything from fraud detection to credit scoring to customer-facing support, that means the AI vendor relationship has to clear the same bar as a payments processor or a data centre contract:

• Due diligence before signing, assessing the provider's own operational resilience and concentration risk, not just its functionality.
• Inclusion in the register of information the financial entity maintains for every ICT third-party arrangement, with the criticality of the function it supports clearly recorded.
• Specific contract terms DORA requires for arrangements supporting critical or important functions: audit and access rights, defined service levels, visibility into any sub-outsourcing chain, and a documented exit strategy if the relationship ends.
• For providers the European Supervisory Authorities designate critical, direct oversight at EU level, on top of whatever the financial entity itself does.

DORA does not create a lighter-touch category for AI. It creates one ICT third-party regime, and AI vendors supporting critical functions sit inside it like everything else.

Where AI specifically raises the bar

Two things make an AI vendor relationship harder to document well than a more conventional ICT contract, not because DORA treats it differently, but because the underlying service is harder to inspect. First, audit and access rights are only useful if there is something concrete to audit: a vendor whose model behaviour and decision logic are opaque gives a financial entity little to actually examine when the contract's audit clause is invoked. Second, sub-outsourcing visibility is harder to establish when a vendor's own AI infrastructure depends on further third parties, model providers, hosting, data pipelines, that the financial entity has no direct line of sight into.

An AI system that runs on infrastructure the financial entity controls, or that produces a verifiable, inspectable record of what it actually did, removes both problems at the source. The audit right has something real to point at. The sub-outsourcing chain is shorter because fewer parties sit between the decision and the record of it.

What this means in practice

A financial entity bringing in an AI vendor for a function that matters should treat the onboarding exactly like any other critical ICT contract under DORA: due diligence on the vendor's own resilience, a complete and accurate register entry, the mandatory contract terms actually negotiated rather than assumed, and a genuine answer to what happens if the vendor cannot continue. AI does not get a pass on any of it, and it does not get a harsher bar either. It gets the same one, which is precisely why the entities that treat their AI vendors with the rigour DORA already demands of everything else will find the compliance work more straightforward, not less.