financial · DORA Article 17 · DORA Article 19 · DORA Article 28
DORA / Financial Operational Resilience
ICT third-party AI provider = critical function — register + audit or supervisory fine
—DORA in force — ICT risk management
Regulatory exposure — commonly overlooked:
Bank uses cloud AI — bank owns DORA compliance, cloud vendor owns shared responsibility matrix gap. · Japan soft-law approach hardening — FSA now expects bank AI documentation like BaFin.
TAM / Exposure
EU financial entities · DORA applies now
Insurance lines
Cyber · D&O · Professional indemnity
Exhibit authority
Japan METI AI Pack — DORA Art 17/28 ICT Incident Pack
Global leaders
EBA · Deutsche Bank · BNP Paribas · Critical ICT providers · METI · SoftBank · Toyota · FSA
Art 28 register
Critical ICT providers must be registered — AI vendors increasingly on list.