We use cookies and similar storage that the site needs to work. With your permission, we would also like to use marketing cookies to understand which of our pages and campaigns interest you and, if we know who you are, to let our team follow up. You can change your mind at any time from Cookie settings at the foot of every page. Cookie Policy
The board owns ICT risk, and every AI service you buy carries the same third-party duties as cloud. A bought-in model or LLM (large language model) API needs a register entry, DORA contract terms and an exit plan.
Penalties are set nationally for firms and managers, but are EU-level and coercive for critical providers. National maxima run from about €1m to €20m or 10% of turnover; critical ICT third-party providers (CTPPs) face daily penalties of up to 1% of average daily worldwide turnover.
Supervision is entering a new phase: big tech is now overseen directly, and frontier AI is the next inspection target. The European Supervisory Authorities (ESAs) designated 19 CTPPs on 18 November 2025 and issued a frontier-AI statement on 31 July 2026.
What should you do now?
Put every AI service in the register. Inventory all third-party models, LLM APIs and AI-enabled tools. Flag those supporting critical or important functions, and record them in your register of information with their subcontractors.
Re-paper AI and cloud contracts to Article 30. Close gaps on audit rights, incident notification, data return, threat-led penetration testing (TLPT) participation and exit transition periods. Vendors: offer a standard DORA addendum before buyers ask.
Build and test real exit plans. For each critical AI or cloud dependency, document a credible alternative and transition route. Assess concentration on a single hyperscaler.
Fold AI into incident and testing processes. Make sure model outages and AI-related failures trigger classification against the 4-hour/24-hour clock. Test AI according to its criticality.
Brief the board against the July 2026 statement. Show how frontier-AI risk is governed, detected and managed; this is where inspections are likely to look next.
What does DORA require of the board and of bought-in AI?
Board accountability is explicit. Under Article 5(2)(a), the management body bears the ultimate responsibility for managing the firm's ICT risk. It approves the framework, sets risk tolerance and must keep its skills current.
AI services are ICT services. DORA has no separate AI regime, so a bought-in AI model, LLM API or AI-powered tool is treated like any other ICT service.
Where it supports a "critical or important function", the stricter contract terms apply in full. That is a function whose failure would materially impair the firm's performance, compliance or continuity. Germany's BaFin has issued non-binding guidance along these lines.
One caution: no EU-level guideline has yet formally classified AI model access as an ICT service. The position rests on supervisory and practitioner interpretation, but it is the safe working assumption.
Five pillars.
Five pillars.
Pillar
Articles
What it requires
Pillar
1. ICT risk management
Articles
5–16
What it requires
A documented ICT risk framework owned and approved by the management body; simplified version for the smallest firms
Pillar
2. Incident management and reporting
Articles
17–23
What it requires
Classify ICT incidents; report major ones to the supervisor on a fixed clock; reporting significant cyber threats is voluntary
Pillar
3. Resilience testing
Articles
24–27
What it requires
Regular testing programme; advanced threat-led penetration testing for designated entities
Pillar
4. ICT third-party risk
Articles
28–44
What it requires
Register of all ICT contracts, mandatory contract terms, exit strategies, concentration-risk management, and EU oversight of critical providers
Pillar
5. Information sharing
Articles
45
What it requires
Voluntary arrangements to share cyber-threat intelligence
Register of information. Every firm keeps a standardised register of its ICT third-party arrangements. The first registers reached the ESAs by 30 April 2025 and were used to pick the CTPPs. The 2026 refresh was narrower.
Article 30 contracts and exit plans. Every ICT contract must be one written agreement covering, among other things:
subcontracting;
service and data locations;
data access and return on termination;
service levels and incident assistance;
termination rights.
Critical or important functions also need:
precise service levels and continuity testing;
the provider's participation in TLPT;
unrestricted audit rights for the firm and its supervisor;
exit strategies with an adequate transition period.
Incident reporting clock. The deadlines come from Delegated Regulation (EU) 2025/301, not DORA itself:
Initial notification: within 4 hours of classifying an incident as major, and no later than 24 hours after the firm became aware of it.
Intermediate report: at the latest within 72 hours of the initial notification, even if nothing has changed.
Final report: no later than one month after the latest intermediate report.
Weekend and holiday deadlines can roll to noon on the next working day, except initial or intermediate reports from banks, CCPs (central counterparties), trading venue operators or NIS2 essential or important entities.
Threat-led penetration testing. TLPT is an intelligence-led simulated attack on live production systems. Entities designated by their national supervisor must carry it out at least every three years; the supervisor may change the frequency. The rules align with the ECB's TIBER-EU framework.
For AI and tech vendors, the effect is commercial. Buyers will demand DORA-ready contracts and cloud-style due diligence.
What are the penalties for firms, managers and critical providers?
Financial entities. DORA sets no fixed EU fine ceiling. Member States must set penalties that are effective, proportionate and dissuasive (Article 50).
Management penalties. Sanctions can extend to members of the management body and other responsible individuals under national law.
Publication. Supervisors can issue public notices naming the person or firm responsible.
National maxima vary widely:
What are the penalties for firms, managers and critical providers?
What are the penalties for firms, managers and critical providers?
Country
Firms
Individuals
Country
Sweden
Firms
about €1m
Individuals
—
Country
Italy
Firms
€20m or 10% of turnover
Individuals
up to €5m
Country
Ireland
Firms
—
Individuals
up to €1m
CTPPs. The Lead Overseer can impose periodic penalty payments on a critical provider. Key features:
up to 1% of the provider's average daily worldwide turnover in the preceding business year;
accrued daily until compliance, for no more than six months;
imposed only after at least 30 days' notice;
published, unless that would seriously jeopardise markets.
These are coercive, not one-off fines. Ultimately, supervisors can require firms to suspend or terminate use of a non-compliant provider.
No enforcement record yet. No public DORA enforcement actions had been identified as of October 2026.
How is oversight of big tech and frontier AI evolving?
The first 19 CTPPs. On 18 November 2025 the ESAs designated the first 19 critical ICT third-party providers:
Accenture
Amazon Web Services
Bloomberg
Capgemini
Colt
Deutsche Telekom
Equinix
FIS
Google Cloud
IBM
InterXion
Kyndryl
LSEG Data and Risk
Microsoft
NTT DATA
Oracle
Orange
SAP
Tata Consultancy Services
None is a standalone AI model developer. AI delivered through designated hyperscalers sits within CTPP oversight. AI-only providers are reached today only through their customers' contracts and registers.
The oversight regime is in its first year. Each CTPP's Lead Overseer, one of the ESAs, can demand information, investigate, inspect on site and issue recommendations.
The list is not settled. By April 2026, some designated providers had reportedly challenged their designation before the ESAs' Joint Board of Appeal. A 2026 designation round was in preparation; an updated list had not been confirmed as of this brief.
The July 2026 frontier-AI statement signals direction, not new law. On 31 July 2026 the ESAs issued a joint statement (JC 2026 25) on ICT risks from frontier AI models. It calls for a consistent, risk-based supervisory approach. It expects robust governance covering prevention, detection and management of these risks.
Adopted versus not binding:
Not binding: the July 2026 statement creates no new legal obligations, including for AI model providers. Treat it as a preview of inspection priorities.
Still to come: the main Commission review on 17 January 2028 will cover CTPP criteria, scope and oversight.
What is DORA, and who is in scope?
DORA (Regulation (EU) 2022/2554) turns scattered technology and cyber-risk guidance into hard law for the financial sector.
Who is in scope. Article 2(1)(a)–(t) lists 20 types of "financial entity". They include:
banks (credit institutions), payment and e-money institutions, and account information service providers;
investment firms, crypto-asset service providers and issuers of asset-referenced tokens;
central securities depositories, CCPs, trading venues and trade repositories;
alternative investment fund managers, UCITS management companies and data reporting service providers;
insurers, reinsurers, insurance intermediaries and occupational pension funds (IORPs);
credit rating agencies, administrators of critical benchmarks, crowdfunding service providers and securitisation repositories.
Some very small entities, such as IORPs with 15 members or fewer, are excluded.
ICT third-party providers. Technology vendors (cloud, software, data, AI) are not financial entities, but DORA reaches them in two ways. Indirectly, their financial-sector customers must impose specific contract terms on them (Articles 28–30). Directly, if designated "critical", they fall under EU-level oversight (Articles 31–44).
Proportionality. Rules scale with size, risk profile and services. A simplified ICT risk framework applies to the smallest players, such as small and non-interconnected investment firms and small IORPs. Proportionality lowers the bar; it does not remove it.
Which dates matter?
Which dates matter?
Which dates matter?
Date
Event
Date
14 Dec 2022
Event
DORA adopted
Date
27 Dec 2022
Event
Published in the Official Journal (L 333)
Date
16 Jan 2023
Event
Entered into force
Date
17 Jan 2025
Event
Applies in full
Date
30 Apr 2025
Event
National supervisors send first registers of information to the ESAs
Date
18 Nov 2025
Event
First 19 CTPPs designated
Date
17 Jan 2026
Event
Commission review deadline on statutory auditors
Date
7 Jul 2026
Event
Commission Action Plan on Cybersecurity and AI
Date
31 Jul 2026
Event
ESA joint statement on frontier-AI ICT risk
Date
17 Jan 2028
Event
Main Commission review (CTPP criteria, scope, oversight)