financial · DORA Article 17 · DORA Article 19 · DORA Article 28
DORA / Financial Operational Resilience
ICT third-party AI provider = critical function — register + audit or supervisory fine
—DORA in force — ICT risk management
Regulatory exposure — commonly overlooked:
Bank uses cloud AI — bank owns DORA compliance, cloud vendor owns shared responsibility matrix gap. · CPRA ADM opt-out requires proof of what automated system decided — receipt is opt-out infrastructure.
TAM / Exposure
EU financial entities · DORA applies now
Insurance lines
Cyber · D&O · Professional indemnity
Exhibit authority
California CPRA ADM Pack — DORA Art 17/28 ICT Incident Pack
Global leaders
EBA · Deutsche Bank · BNP Paribas · Critical ICT providers · CPPA · CA AG · Silicon Valley insurers
Art 28 register
Critical ICT providers must be registered — AI vendors increasingly on list.