← Mandate Registry · 7 mandate layers · dora

financial · DORA Article 17 · DORA Article 19 · DORA Article 28

DORA / Financial Operational Resilience

ICT third-party AI provider = critical function — register + audit or supervisory fine

—DORA in force — ICT risk management

Regulatory exposure — commonly overlooked:
Bank uses cloud AI — bank owns DORA compliance, cloud vendor owns shared responsibility matrix gap. · Annex III high-risk list covers 8 domains — one vertical per domain minimum for compliance.

TAM / Exposure

EU financial entities · DORA applies now

Insurance lines

Cyber · D&O · Professional indemnity

Exhibit authority

EU AI Act Conformity Pack — DORA Art 17/28 ICT Incident Pack

Global leaders

EBA · Deutsche Bank · BNP Paribas · Critical ICT providers · EU AI Office · EDPB · European Parliament

Art 28 register

Critical ICT providers must be registered — AI vendors increasingly on list.

Incident reporting

4-hour initial notification — AI-caused incident needs decision receipt.

TLPT

Threat-led penetration testing includes AI attack paths.

[European Union] FRIA requirement

Fundamental rights impact assessment for public/high-risk — exhibit pack maps to FRIA.

[European Union] PLD strict liability

Dec 2026 product liability directive — software and AI explicitly included.

[Text / Chat] Modality hook

Baseline — all frameworks apply to text decisions.

7 mandate layers (live)

Regulatory Clock Countdown to operative regulatory deadline — NAIC adoption, GSE mandate, EU transposition. Open →

Domain Classifier Industry-specific SAFE/CRISIS/VIOLATION with regulatory framework mapping. Open →

Exhibit / Filing Pack Regulator-ready external validation — NAIC Exhibit D, Fannie QC, EU FRIA, FDA Part 11. Open →

Mandate Registry Enroll deployers/insureds under vertical-specific governance mandate. Open →

Bind / Action Gate ALLOW/BLOCK before consequential action — bind policy, sell loan, deactivate worker. Open →

Compliance Certificate Deployer-facing downloadable cert — forward to counsel, auditor, regulator. Open →

Actuarial / Risk Feed Anonymized asymmetry signals for pricing, reserving, reinsurance correlation. Open →

Run dora demo Regulatory calendar Download exhibit pack Verify independently