An AI agent supports a critical or important function under DORA if its failure, or its defective performance, would materially impair the entity's financial performance, the continuity of its services, or its ability to meet its regulatory obligations. If it does, stronger contract terms, pre-contract assessment, notification, exit planning and testing all apply to the agent and its providers.
What does DORA mean by a critical or important function?
DORA (Regulation (EU) 2022/2554), which applies from 17 January 2025, uses the idea of a critical or important function to decide where its strictest requirements apply. In substance, a function is critical or important if its disruption would materially impair the financial entity's financial performance, or the soundness or continuity of its services and activities, or if its discontinued, defective or failed performance would materially impair the entity's continuing compliance with the conditions of its authorisation or its other obligations under financial services law.
Two details matter for agents. The test is about the function, not the technology, so the question is whether the agent supports a function that is critical or important. And the test includes defective performance, not only failure. For DORA's wider structure, see what DORA is.
Who has to make the classification?
Every financial entity in DORA's scope classifies its own functions, applying proportionality. Most entities already have a list from business impact analysis and outsourcing work. The task now is to place agents against that list.
The short answer on whether DORA reaches agents at all is in does DORA apply to AI agents in financial services. Australian readers will find a parallel concept in APRA CPS 230 critical operations and AI agents, with different words and similar logic.
How do you decide whether an agent supports one?
Work through four questions for each agent capability.
- Which function does this capability serve? Name it in the entity's own function list: payments execution, customer onboarding, claims handling, transaction monitoring, regulatory reporting.
- Is that function already critical or important? If so, any agent materially supporting it is in scope.
- Would the function be materially impaired if the agent stopped? If people could absorb the work within tolerance, the agent's support may be less material, though still relevant.
- Would the function be materially impaired if the agent ran but performed defectively? This is the question most teams skip. An onboarding agent that wrongly clears customers keeps running while undermining AML compliance.
The fourth question often decides it. An agent that drafts suspicious activity alerts may seem peripheral because an analyst reviews them. But if the agent systematically fails to raise alerts, nobody reviews what was never raised, and the entity's compliance is impaired. That agent supports an important function.
The opposite also holds. An agent that drafts internal meeting notes, even for a critical team, does not support the function in a material way. Record the reasoning either way, because the classification will be challenged, and a written rationale made at the time is easier to defend than one rebuilt during an examination.
What changes once an agent supports a critical or important function?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Pre-contract risk assessment | Assess vendor, model provider, concentration and substitutability before signing | Assessment and decision record |
| Notify the competent authority | Planned arrangements for critical or important functions reported as required | Notification records |
| Stronger contract terms | Precise service levels, contingency plans, full audit rights, testing participation, exit transition | Contract mapped to DORA terms |
| Register of information | Arrangement recorded as supporting a critical or important function | Register entry |
| Exit strategy | Documented, tested plan to move off the vendor or model | Exit plan and test results |
| Business continuity | Fallback that keeps the function within tolerance if the agent fails or errs | Continuity plans and test reports |
| Resilience testing | Agent scenarios included; threat-led testing scope considered | Test plans and findings |
| Monitoring of defective performance | Outcome checks that catch the agent running but wrong | Monitoring reports and thresholds |
The last row deserves emphasis. Availability monitoring will not detect the onboarding agent that wrongly clears customers. You need outcome checks, sampling and a record of every verdict, so defective performance is found early. Frameworks such as the NIST AI RMF can structure this; see NIST AI RMF for AI agents: the four functions applied.
What will a supervisor ask?
- Which agents support critical or important functions, and how did you decide?
- Did you consider defective performance, or only outage?
- Show us the contract terms and exit plan for this agent's vendor.
- Did you notify us of this arrangement?
- How quickly would you detect that the agent was producing wrong outcomes?
What does the classification not settle?
It does not decide whether the agent is high-risk under the EU AI Act; that is a separate test based on use. It does not set how much autonomy the agent may have. It does not remove DORA duties for agents outside critical or important functions; those still sit within the ICT risk framework, with lighter third-party requirements. For how the regimes fit together, see AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme grants authority per capability, so a single agent can carry one depth for a capability that supports a critical function and another for one that does not. Every verdict is filed, which gives you the outcome record needed to detect defective performance rather than only outages.
Questions people ask
Is every customer-facing agent in a critical or important function?
No. It depends on the function and the impact of failure or defects. A chat agent answering branch opening hours is not; one that executes payments almost certainly is.
Can an agent move into a critical function over time?
Yes. Agents gain capabilities and users rely on them more. Review classification whenever a capability or depth changes.
Does human review of every output keep the agent out of scope?
Not necessarily. If reviewers depend on what the agent surfaces, defects in what it fails to surface can still impair the function.