DORA and AI: what EU banks actually have to prove.
DORA does not ban foreign clouds or require data localization. It requires control: over ICT risk, third parties, data locations and exits. What that means for AI services.
DORA, the EU's Digital Operational Resilience Act, does not require data to stay in the EU and does not mention AI explainability. It requires financial firms to control their technology risk: know every ICT provider, state where data is processed, test resilience and be able to leave. AI services fall under the same rules, and that is where sovereign infrastructure helps.
Resilience, not localization.
DORA has applied since 17 January 2025 to banks, insurers, investment firms and other financial entities in the EU. Its core: ICT risk management, incident reporting, resilience testing and the management of ICT third-party risk.
The part that touches AI.
Any AI service a bank uses is an ICT service. DORA requires a register of these providers, contracts that state where data is processed and stored and give notice before that changes, and tested exit strategies. Large cloud providers can be designated as critical ICT third-party providers under direct EU oversight.
Two common mistakes.
DORA does not require data localization. And the right to an explanation of automated decisions comes from GDPR and the EU AI Act, not from DORA. Mixing them up is the fastest way to lose a compliance officer's trust.
Control you can show.
A deployment bound to one jurisdiction by VISUM, with a stated and enforced data location, a post-quantum transport and a model whose decisions are recorded, makes the third-party questions answerable: where is the data, who can reach it, how do we leave, and why did the system decide what it decided.
Short answers
Straight answers to what investors and partners ask us first.
No. It requires contracts to state where data is processed and stored, with notice of changes, but it does not mandate that data stays in the EU.
Yes, indirectly: AI services used by financial entities are ICT services, so DORA's ICT risk and third-party rules apply to them.
On 17 January 2025.
See it working.
We show the PRISM proof of concept live, and share the technical brief and data room with qualified investors and partners.
Nothing on this website is an offer to sell or a solicitation to buy securities.