DORA requires EU financial entities to run ICT security awareness and digital operational resilience training for all staff and for the management body. If your teams run AI agents, those agents are ICT systems, often supplied by ICT third parties, and the training must cover how they fail, how incidents are spotted and how operations continue without them.
What does DORA require, in plain words?
DORA, Regulation (EU) 2022/2554, applies from 17 January 2025 and sets one framework for digital operational resilience across EU finance. It has four main strands: ICT risk management, ICT incident reporting, digital operational resilience testing, and ICT third-party risk. Woven through the first is a people duty. Financial entities must run ICT security awareness programmes and digital operational resilience training for their staff, and the management body, which is responsible for the ICT risk framework, must keep its own knowledge and skills current enough to understand and assess ICT risk.
DORA does not single out AI. It does not need to. An agent that reads a core ledger, drafts payment instructions or executes routine changes is an ICT system in every sense DORA uses, and its failure modes are ICT risks.
Who does it apply to?
Most of the EU financial sector: credit institutions, payment and e-money institutions, investment firms, insurers and reinsurers, crypto-asset service providers, trading venues, central counterparties and others, with proportionality for smaller entities. Providers of agent platforms to those entities are ICT third-party service providers, a point developed in DORA makes agent providers your ICT third parties.
Inside a financial entity, the training duty reaches everyone, but three groups need content specific to agents:
- Operations teams who run agents daily and approve held actions;
- ICT risk, security and incident teams who must classify and report agent-related incidents;
- The management body, which approves the ICT risk framework that now includes agents.
What does ICT training mean for teams running agents?
Generic awareness training covers phishing and passwords. Teams running agents need more, because agents create ICT risks that look different from ordinary system faults.
Agent-specific threats. An agent that reads external content can be targeted with instructions hidden in that content, the risk the OWASP Top 10 for LLM Applications calls prompt injection. Staff should know that on a governed platform every fact reaching the agent carries provenance, and that an external claim, such as an emailed instruction, cannot authorise a payment. They should also recognise excessive agency: an agent given more reach than its job needs.
Reading verdicts as signals. A sudden rise in refused actions may mean an attack is being blocked or a source has changed. A rise in held actions may mean the agent is meeting cases it was not certified on. Staff who read verdicts as operational signals detect problems earlier than those who read them as noise.
Incident recognition. DORA requires major ICT incidents to be classified and reported. Teams must know what an agent incident looks like: wrong actions executed within bounds, an agent drifting from its certified behaviour, a provider outage, or a data leak through a draft. They must know who to call and what to preserve. Every verdict filed in an append-only record makes reconstruction possible, but only if someone knows how to read it.
Continuity when the agent stops. An agent's certificate lapses after 90 days, and a run that clears no depth drops it to depth 1 the same day. Either event turns automated work back into manual work at once. Teams need people trained to take it over, and a tested plan for how long that can last. This is a resilience question DORA's testing strand is built to probe.
How do you meet DORA's training duty for agents?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| ICT security awareness for all staff | Module on agent threats: injection through external content, provenance, excessive agency | Completion records by team, with dates |
| Digital operational resilience training | Drills where an agent drops to depth 1 and staff take over the work | Drill reports with timings and gaps found |
| Management body knowledge and skills | Board briefing on agent depth, verdicts, lapses and third-party dependence | Board minutes and attendance; questions raised |
| Incident classification and reporting | Incident team trained to classify agent incidents and pull the record | Incident files with timelines reconstructed from the record |
| ICT third-party risk | Staff trained to review the provider's certification evidence and exit plans | Provider review notes; register entries |
| Testing | Agent scenarios included in resilience testing | Test reports covering agent failure and recovery |
Budget for this from the start. Training and drills are recurring costs of running agents, not a one-off, a point picked up in how to budget for running AI agents. The framework the training supports is described in the DORA ICT risk management framework for AI agents.
What will a supervisor ask?
National supervisors and, for significant banks, ECB banking supervision will look for evidence that training is real and current. Expect: show the training programme and how agents appear in it; show the management body's training; walk through the last agent-related incident and how it was classified; show the last drill where an agent stopped and how long manual operations lasted; show how staff know which facts the agent may act on. An internal auditor will add a sample test: pick reviewers at random and check their training dates against the dates they approved held actions.
What does DORA not cover?
DORA does not regulate what an agent decides, only the ICT risk of running it. Fairness, explanation and human oversight of decisions sit with the EU AI Act, conduct rules and the GDPR. DORA does not prescribe training hours, content or credentials. It does not cover firms outside the financial sector; those may fall under NIS2 instead. And it does not move responsibility to providers: the financial entity stays fully responsible for ICT risk even when an agent platform is outsourced. Some firms use external credentials as part of the evidence, such as those from Pryme Intelligence Academy, but the training duty remains the entity's own. For how training sits within wider AI literacy, see AI literacy and certification for people who work with agents, and for a non-EU parallel on proving training, SOC 2 and evidence of training for teams running AI agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is an AI agent platform a critical ICT third-party provider?
Designation as critical is made at EU level against set criteria, and most providers will not be designated. Whether designated or not, the provider is still an ICT third party, and your third-party risk duties apply.
Do all staff need agent-specific training under DORA?
All staff need ICT awareness training. Agent-specific content matters most for those who run, review or depend on agents, and for the management body. Others need enough to recognise and report an agent incident.
How often should drills be run?
Often enough that the team can take over an agent's work within the time your continuity plan allows. Aligning drills with the agent's 90-day certificate cycle is a practical rhythm, since a lapse is the most likely real trigger.