What DORA means for AI in financial services

Banks, insurers and other financial entities are trying out AI in customer service, in analysis and as support for internal work. Every such tool is also an ICT service. If it is supplied by someone outside the entity, it falls under the EU regulation on digital operational resilience, DORA, which has applied since January 2025. Anyone planning to use AI would do well to read the requirements early, because they shape both the choice of supplier and the contract.

Responsibility stays with the entity

DORA starts from the position that the financial entity always remains fully responsible for complying with the rules, including when a service is bought in. The entity must have a strategy for the risk arising from ICT services provided by third parties. Before a contract is signed, the supplier and the risks of the arrangement must be assessed, including the risk of concentration.

The requirements tighten when the service supports a critical or important function. An AI tool used to prepare material for credit cases, or one that supports compliance, may fall into that category. The assessment rests on what the tool is actually used for and needs revisiting as that use changes.

The AI service in the register of information

Every contract for ICT services from third parties must be entered in a register of information, and AI services are no exception. The register must be available to the supervisory authority. Finansinspektionen, the Swedish financial supervisor, requires it to be reported by 28 February each year, with information as at 31 December of the previous year.

For AI services it is worth looking at the whole chain. A tool may rely on a model from one party, run at another and call services from a third. Subcontractors that support critical or important functions must appear in the register. The contract must also state where the service is provided and where data is processed and stored, and the supplier must give advance notice of any change.

Exit strategy and concentration risk

Services that support critical or important functions require an exit strategy. It must make it possible to leave the supplier without disrupting the business and without harming the quality of services to customers. Exit plans must be documented and sufficiently tested, and the contract must provide for a transition period and for the return of data when it ends.

Concentration risk arises when a supplier is hard to replace, or when many contracts gather with the same supplier or closely connected suppliers. This applies to AI services too. When the model, the operation and the documents all sit with the same party, a switch is bigger than it may first appear. In November 2025 the European supervisory authorities designated, for the first time, critical ICT third-party providers that are directly overseen at EU level. It shows how much rests on a small number of suppliers.

Finansinspektionen is following AI closely

In September 2026 Finansinspektionen announced that it is mapping how AI is used in the financial sector, following up a survey from 2024. The same month it began an in-depth review, with site visits, of how firms handle cyber threats from advanced AI models. The reviews give a picture of what supervisors are interested in. An entity that already has its AI services in the register, and a clear view of its suppliers and its way out, is well prepared when the questions come.

How it works in iSearch

The whole chain in iSearch can run in your own environment, the language model included. You can also hand the operation over to us. We run iSearch for you in Sweden, in a dedicated environment for your organisation. Every customer gets a separate installation of its own, and your questions and documents are never used to train models.

Sign-in uses SSO and MFA, role-based access controls who reaches what and sensitive changes require the four-eyes principle. A tamper-evident audit log can be connected to your SIEM.

Read more about secure AI for the financial sector and data when the contract ends, or book a walkthrough.