financial · DORA Article 17 · DORA Article 19 · DORA Article 28
DORA / Financial Operational Resilience
ICT third-party AI provider = critical function — register + audit or supervisory fine
—DORA in force — ICT risk management
Regulatory exposure — commonly overlooked:
Bank uses cloud AI — bank owns DORA compliance, cloud vendor owns shared responsibility matrix gap. · CMA: you are liable for your AI agent like an employee — applies to every agentic commerce vertical.
TAM / Exposure
EU financial entities · DORA applies now
Insurance lines
Cyber · D&O · Professional indemnity
Exhibit authority
UK CMA Agent Liability Pack — DORA Art 17/28 ICT Incident Pack
Global leaders
EBA · Deutsche Bank · BNP Paribas · Critical ICT providers · CMA · ICO · FCA · Lloyd's
Art 28 register
Critical ICT providers must be registered — AI vendors increasingly on list.