DORA + EU AI Act: The Double Compliance Obligation for Financial Institutions

If your institution is DORA-compliant — or working toward it — you likely already have AI systems in scope for the EU AI Act. But scope is narrower and stranger than most teams assume. Annex III names creditworthiness evaluation and credit scoring of natural persons (point 5(b)) and risk assessment and pricing in life and health insurance (point 5(c)) — and it explicitly excludes AI used to detect financial fraud from that same point. Algorithmic trading is not in Annex III at all. Customer-facing chatbots are not high-risk either; they attract transparency duties under Article 50. Getting this classification right is the whole game, and managing the two regimes as separate workstreams is a costly mistake. Our free AI Act exposure check walks the tiers in the order the Act imposes them.

This article maps where DORA and the AI Act converge, and shows how a single compliance programme can satisfy both.

Who faces both obligations?

Any EU financial entity that:

  • Develops or deploys AI systems (provider or deployer role under AI Act Art. 3)
  • Uses those AI systems as part of ICT infrastructure subject to DORA

This covers credit institutions, payment institutions, investment firms, insurance undertakings, and crypto-asset service providers — the full DORA scope — whenever they use AI in regulated activities.

Where DORA and AI Act requirements overlap

Risk management

DORA Art. 5–16 requires an ICT risk management framework: identification, protection, detection, response, recovery. AI Act Art. 9 requires a risk management system for high-risk AI: identification, estimation, evaluation, and mitigation of risks throughout the AI lifecycle.

Dual-mapping approach: Extend your existing DORA ICT risk register to include AI-specific risk dimensions (accuracy, robustness, bias, fundamental rights). A single risk governance process can satisfy both requirements.

Incident reporting

DORA Art. 19–23: major ICT incidents reported to competent authorities within 4h (initial), 72h (intermediate), 1 month (final). AI Act Art. 73: providers of high-risk AI must report serious incidents to market surveillance authorities without undue delay.

Dual-mapping approach: A single incident classification decision tree can determine whether an incident triggers DORA reporting, AI Act reporting, or both simultaneously. Build this into your existing DORA incident management workflow.

Third-party and supply chain

DORA Art. 28–44: comprehensive third-party ICT risk management, contractual requirements, concentration risk monitoring. AI Act: deployers must verify that AI systems they procure have completed conformity assessment (CE marking) and are accompanied by the required technical documentation.

Dual-mapping approach: Add AI Act conformity verification to your existing DORA third-party ICT due diligence questionnaire. One vendor questionnaire, two compliance requirements satisfied.

The 2027 deadline you cannot miss

DORA has applied since 17 January 2025. The AI Act prohibited practices have applied since 2 February 2025. Transparency obligations (Article 50) land on 2 August 2026 — the nearest deadline, and the one that catches any institution running a customer-facing chatbot. The critical date for high-risk financial AI is 2 December 2027, after the Digital Omnibus on AI deferred it: that is when stand-alone Annex III systems (credit scoring, insurance pricing, HR screening, biometric identification — not fraud detection, which Annex III carves out) must be fully compliant: conformity assessment complete, QMS in place, technical documentation filed, EU database registration done. A full breakdown of what this adds to an existing DORA programme is on our AI Act hub for financial institutions.

A realistic compliance programme for a single high-risk AI system takes 12–24 months. Institutions that have not started their AI Act gap analysis in 2026 will not be ready by 2027.

Practical starting point

  1. AI inventory — catalogue every AI system touching regulated activities. Map each to Annex III categories.
  2. Risk register extension — add AI Act risk dimensions to your existing DORA ICT risk register.
  3. Incident procedure update — add dual-threshold assessment (DORA + AI Act Art. 73) to your incident classification tree.
  4. Third-party questionnaire update — add AI Act conformity verification to your DORA vendor questionnaire.
  5. Gap analysis — assess each high-risk AI system against Art. 9–17 AI Act requirements.

For detailed AI Act compliance guidance — deadlines, obligations by system type, GPAI rules — see our sister site regulation-ai.eu, including the dedicated AI Act × DORA convergence guide.

This article is analytical guidance for compliance and legal teams, not legal advice. References: EU AI Act (Regulation 2024/1689), DORA (Regulation 2022/2554), Digital Omnibus 2026.