DORA requires EU financial entities to manage ICT risk, report major ICT incidents, test their digital resilience, control ICT third-party providers and train staff in security awareness and resilience. An AI agent is an ICT system and usually a third-party service, so the people around it need ICT skills: incident recognition, fallback, supplier awareness and good records.
What does DORA ask of staff?
The Digital Operational Resilience Act, Regulation (EU) 2022/2554, applies from 17 January 2025. In substance, it requires financial entities to:
- keep an ICT risk management framework, with the management body responsible for it and expected to keep enough knowledge to understand ICT risk;
- run ICT security awareness programmes and digital operational resilience training for all staff and senior management;
- detect, classify and report major ICT-related incidents to their supervisor;
- test their digital operational resilience, with advanced testing for some larger entities;
- manage risks from ICT third-party providers, including contract terms, a register of arrangements and exit plans.
The staff duties are not only for IT teams. An operations reviewer who notices an agent misbehaving is often the first to detect an ICT incident. A team lead who moves work to people when an agent's provider fails is carrying out a continuity plan. The firm-level view is in the DORA ICT risk management framework for AI agents.
Who does it apply to?
DORA covers a wide range of EU financial entities: banks, insurers and reinsurers, investment firms, payment and e-money institutions, crypto-asset service providers, fund managers, trading venues and others. It also brings the most important ICT providers to the financial sector under EU-level oversight. A short definition is in what is DORA.
AI agents fit DORA's categories naturally. The agent runs on ICT systems, often provided by a third party, and typically depends on a model provider as well. Each is an ICT dependency the firm must manage.
Which ICT skills do employers need around agents?
DORA creates demand for a specific set of ICT skills in non-IT roles. Employers look for people who can do five things.
- Recognise an ICT incident. An agent producing strange outputs in bulk, timing out, or acting at unusual times may be an ICT incident, not just a quality problem. Spot it and report it through the incident route.
- Classify and record. Supervisors expect firms to classify incidents by impact. Staff who record what happened, when, how many customers were affected and what was done make classification possible.
- Execute fallback. When an agent or its provider fails, work moves to people or to read-only mode. Staff who know the fallback and can run it keep critical services going.
- Understand third-party dependency. The agent platform and model provider are suppliers. Staff who understand that know whom to tell when something on the supplier side changes.
- Take part in testing. Resilience tests may involve operations staff running scenarios. Being calm and precise in a test is a skill employers notice.
Two of these skills are easy to underrate. Keeping a timeline during an incident can feel like a distraction while customers wait, but the firm cannot classify or report the incident without one. And knowing the fallback before you need it matters more than speed on the day; teams that have rehearsed it tend to make fewer mistakes under pressure.
None of this requires coding. It requires understanding systems as systems. These skills overlap with the analyst profile described in what skills an AI operations analyst needs.
How can you show employers you have these skills?
| Requirement | What employers will expect of you | How to show it |
|---|---|---|
| ICT security awareness and resilience training | Complete training and apply it | Training records with dates |
| Incident detection | Notice and report possible ICT incidents promptly | An incident or near miss you raised |
| Incident classification and reporting | Record facts that support classification | A timeline you kept during an incident |
| Business continuity and fallback | Run the fallback when an agent fails | A description of a time you moved work to manual handling |
| ICT third-party risk | Treat the agent platform and model provider as suppliers | A supplier issue you noticed and escalated |
| Resilience testing | Take part in tests and follow scenarios precisely | A test or exercise you joined |
Employers' training programmes for these skills are covered in DORA and ICT training for teams running AI agents.
What might an interviewer ask?
- "The agent stops responding in the middle of the morning payment run. What do you do in the first fifteen minutes?" Stop dependent actions, move urgent work to people, report to the incident owner, and start a timeline.
- "How would you tell an ICT incident from an agent quality problem?" Look for system-wide symptoms, sudden changes, and errors that are not explained by the case facts. When in doubt, report it as possible ICT.
- "Who is our ICT third-party provider here?" Show you understand that the agent platform and model provider are both suppliers.
A payments operations analyst we will call Elif prepared by describing a past outage of a card processor and how her team had run a manual fallback. Interviewers recognised DORA skills even though she had never used the word.
What does DORA not cover?
DORA does not apply to non-financial firms; NIS2 covers cybersecurity in other critical sectors. It does not set AI-specific rules such as human oversight, which the EU AI Act covers for high-risk systems. It does not certify individuals or prescribe a course. And it does not apply outside the EU, though firms elsewhere face comparable operational resilience expectations.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Do I need an IT background to work under DORA?
No. Many DORA duties fall on operations staff. You need to understand systems, incidents and suppliers, not to build them.
Are these skills useful outside the EU?
Yes. Many financial regulators expect operational resilience and ICT risk management. Employers in Qatar, for example, expect similar disciplines under their own rules; see what AI skills employers in Qatar ask for.
Where can I see the wider skills picture?
The guide to AI skills for job seekers sets out what employers will ask you to prove.