DORA (Digital Operational Resilience Act)
EU regulation requiring ICT resilience, incident reporting, and third-party risk controls for financial entities.
What is DORA (Digital Operational Resilience Act)?
DORA brings AI vendors used by financial entities into the ICT third-party register, expects aligned incident classification, and requires resilience testing that includes AI workflows. Concentration on a single AI provider is a flagged risk, which is one reason regulated buyers prefer platforms with deployment flexibility. See AI Governance Framework for Regulated Industries.
What is an example of DORA (Digital Operational Resilience Act)?
A bank records its external model and agent-platform providers in the ICT third-party register, maps supported critical functions, negotiates audit and exit rights, tests service disruption, and includes AI dependencies in incident response.
How is DORA (Digital Operational Resilience Act) different from related concepts?
DORA focuses on digital operational resilience in the financial sector. The EU AI Act governs AI-specific risks and market obligations. A financial AI deployment can be subject to both.
What should enterprises evaluate for DORA (Digital Operational Resilience Act)?
- Map every AI service, subprocessor, hosting dependency, supported business function, data flow, and substitutability risk.
- Review contracts for security, incident notification, access, audit, testing, data location, termination, and exit requirements.
- Test realistic failures, including model API outage, degraded outputs, provider compromise, dependency concentration, and recovery.
Related terms
Authoritative sources
Primary sources for the formal meaning, requirements, or original research behind DORA (Digital Operational Resilience Act):
Putting DORA (Digital Operational Resilience Act) to work?
VDF AI runs governed AI agents on your own infrastructure — on-premises, sovereign cloud, or air-gapped. Book a working session to map the architecture.
Talk to VDF AI