Yes. DORA does not regulate AI as such, but an AI agent run by an EU financial entity is an ICT system, and its platform and model providers are ICT third parties. So the agent falls inside the entity's ICT risk management, incident reporting, resilience testing and third-party oversight from day one.
Who does DORA apply to?
DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025 to financial entities in the EU: banks, payment and e-money institutions, investment firms, insurers, crypto-asset service providers and others listed in the regulation. It sets four areas of duty: ICT risk management, ICT incident reporting, digital operational resilience testing, and ICT third-party risk.
The duties sit with the financial entity, not with the agent's vendor. A platform that hosts your agents does not become regulated by DORA in its own right, but your contract with it must meet DORA's terms, and very large providers to the sector can come under direct oversight. A walk-through of what DORA is covers the basics.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What changes when the ICT system is an agent that acts?
Most ICT systems do what their code says. An agent decides, within bounds, what to do next. That shifts each DORA area:
- ICT risk management. You must identify and classify ICT assets and the functions they support. An agent that can post journal entries or release payments supports a different function from one that drafts emails, so each capability needs its own classification.
- Incident reporting. An agent can fail without anything going down: it can act wrongly, at volume, while every system reports healthy. Your incident classification has to catch behaviour, not just outages.
- Resilience testing. Testing must show the agent stays within its bounds under stress, bad inputs and a failing dependency, and that a manual fallback works.
- Third-party risk. Behind one agent there may be a platform, a model provider and several data feeds. Each belongs in the register of ICT third-party arrangements, with exit plans.
The practical consequences are set out in DORA and AI agents: what financial entities must do.
What may the agent do, and what stays with a person?
DORA does not set depth limits. It requires you to manage the risk of whatever depth you choose. A defensible split looks like this:
- Agent may: read and reconcile, draft incident notes, classify routine ICT events, prepare evidence for testing.
- Agent may, within limits: execute routine changes with automatic rollback, such as retrying failed batch jobs.
- Stays with a person: declaring and reporting a major ICT incident, approving changes to critical or important functions, invoking business continuity, and terminating a third-party arrangement.
An illustrative example
Take a mid-sized payment institution in the EU. It uses an agent to match incoming transfers to open invoices for its merchant customers and to post the matches. One evening, the model provider changes how a date field is returned. Nothing errors. The agent starts matching payments to the wrong month's invoices, at full speed.
Under DORA, this is an ICT incident affecting a service to clients, and it has to be classified like any other. The institution detects it because its monitoring checks the agent's outcomes against the ledger, not just whether the agent is running. The agent drops to read-only, staff reverse the postings, and the incident is assessed against the reporting criteria. The post-incident review records the model provider as the third party involved, which feeds the next concentration risk review.
Which controls meet DORA for an agent?
| DORA area | Control for the agent | Evidence it leaves |
|---|---|---|
| ICT risk management | Asset entry per agent, with each capability and its depth | Register and depth log |
| Incident reporting | Outcome monitoring with thresholds that trip a hold | Alerts, holds and classification decisions |
| Resilience testing | Scenario runs: bad input, slow dependency, model change | Test reports and pass criteria |
| Third-party risk | Contract terms and exit plan for platform and model provider | Register of information, exit plan |
Firms with operations elsewhere often ask how this compares to other markets. The answers differ for which UAE rules apply to AI agents in financial services and for Nigerian rules on AI agents in financial services, where no equivalent single resilience regulation exists. For the full cross-regulation map, see AI agent regulation, mapped to controls.
Questions people ask
Does DORA require us to tell our regulator we use AI agents?
Not as a separate notification. The agent appears in the ICT risk framework, the register of ICT third-party arrangements, and in incident reports if it is involved in a major incident.
Is a model provider a critical ICT third-party provider?
That designation is made by the European supervisors, not by you. Whether or not a provider is designated, you must still assess its importance to your critical or important functions and manage the dependency.
Does DORA apply alongside the EU AI Act?
Yes. They overlap but answer different questions. The AI Act looks at the AI system's risk to people; DORA looks at the entity's operational resilience. An agent in a bank may need to satisfy both.