financial · DORA Article 17 · DORA Article 19 · DORA Article 28
DORA / Financial Operational Resilience
ICT third-party AI provider = critical function — register + audit or supervisory fine
—DORA in force — ICT risk management
Regulatory exposure — commonly overlooked:
Bank uses cloud AI — bank owns DORA compliance, cloud vendor owns shared responsibility matrix gap. · Florida property insurers using AI for claims while Citizens backs up market — AI claim denial = political lightning rod.
TAM / Exposure
EU financial entities · DORA applies now
Insurance lines
Cyber · D&O · Professional indemnity
Exhibit authority
Florida OIR AI Pack — DORA Art 17/28 ICT Incident Pack
Global leaders
EBA · Deutsche Bank · BNP Paribas · Critical ICT providers · Florida OIR · Citizens Property · Universal Property
Art 28 register
Critical ICT providers must be registered — AI vendors increasingly on list.