Compliance · DORA · ICT and AI

DORA does not name AI. It names ICT. Agents are ICT.

The Digital Operational Resilience Act, applicable since 17 January 2025, is the EU's framework for the operational resilience of the financial sector's information and communications technology. It does not carry first-class AI regulatory text.

§ 01 The ICT framing

Five pillars. The agent ends up under all of them.

DORA organizes operational resilience into five pillars: ICT risk management, incident reporting and major-incident notifications, digital operational resilience testing, ICT third-party risk management, and information sharing.

The third-party pillar is where the framework grows teeth. A financial entity remains accountable for the actions of its ICT third parties, including AI agents and the runtimes they ride on, regardless of where they execute.

DORA does not require an AI policy. It requires that an action on ICT was recoverable, reportable, and attributable. Agents are ICT.

§ 02 The evidence

Recoverable and attributable ICT operations, by construction.

The substrate makes the ICT-operation record a property of the action.

The question a supervisor asks

Without the substrate

With Subnet345

Which agent acted on which ICT operation, under which authorized policy

Reconstructed from logs, if at all

Attributed at the moment of action

What was reportable as a major incident, and who escalated it

Inferred from notification timestamps

The detection, the policy, and the escalation path, on the record

What the agent was refused, and how the third-party risk control caught it

Refusals not durably captured

Every refusal recorded as an attributable event

Keep the record where a competent authority can interrogate it

Ships to a third-party cloud, with caveats

Retained inside your boundary, on your retention schedule

Hand the examiner evidence in a form they can read

A bespoke log export, assembled by hand

Evidence exports in a format your examiner can read, run by your operator inside your perimeter

This material is informational, not legal or regulatory advice. DORA is enforced by EU Member State competent authorities and the European Supervisory Authorities; obligations depend on entity classification, ICT third-party designations, and incident severity. The substrate produces the record; it does not by itself make a financial entity compliant. Assess your specific obligations with qualified EU financial-services counsel. Source: DORA, Regulation (EU) 2022/2554, applicable 17 January 2025, with ICT event-logging detail in the RTS, Delegated Regulation (EU) 2024/1774.

§ 03 Questions

DORA and AI agents, answered.

Does DORA carry AI-specific provisions?

No, not at first-class regulatory text. DORA frames operational resilience for the financial sector around ICT, not AI as a category. The reason it bears on AI agents is that AI agents in financial workflows are ICT, and the agent's actions are ICT operations.

Is this legal or regulatory advice?

No. This material is informational. DORA is enforced by EU Member State competent authorities and the European Supervisory Authorities; obligations depend on entity classification and ICT third-party designations. The substrate produces the record; it does not by itself make a financial entity compliant. Assess your specific obligations with qualified EU financial-services counsel.

When a competent authority asks for the trail, can you produce it?

Request a demo →Financial Services brief →