← Mandate Registry · 7 mandate layers · dora

financial · DORA Article 17 · DORA Article 19 · DORA Article 28

DORA / Financial Operational Resilience

ICT third-party AI provider = critical function — register + audit or supervisory fine

—DORA in force — ICT risk management

Regulatory exposure — commonly overlooked:
Bank uses cloud AI — bank owns DORA compliance, cloud vendor owns shared responsibility matrix gap. · Local Law 144 requires annual bias audit — Velaru receipts are continuous audit, not annual snapshot.

TAM / Exposure

EU financial entities · DORA applies now

Insurance lines

Cyber · D&O · Professional indemnity

Exhibit authority

New York AI Governance Pack — DORA Art 17/28 ICT Incident Pack

Global leaders

EBA · Deutsche Bank · BNP Paribas · Critical ICT providers · NYDFS · NYC DCWP · Goldman Sachs · MetLife

Art 28 register

Critical ICT providers must be registered — AI vendors increasingly on list.

Incident reporting

4-hour initial notification — AI-caused incident needs decision receipt.

TLPT

Threat-led penetration testing includes AI attack paths.

[New York] Financial capital

NYDFS regulates insurers AND banks — same receipt primitive for both books.

[New York] Hiring audit law

NYC AEDT law is template for other cities — receipt architecture scales municipally.

[Text / Chat] Modality hook

Baseline — all frameworks apply to text decisions.

7 mandate layers (live)

Regulatory Clock Countdown to operative regulatory deadline — NAIC adoption, GSE mandate, EU transposition. Open →

Domain Classifier Industry-specific SAFE/CRISIS/VIOLATION with regulatory framework mapping. Open →

Exhibit / Filing Pack Regulator-ready external validation — NAIC Exhibit D, Fannie QC, EU FRIA, FDA Part 11. Open →

Mandate Registry Enroll deployers/insureds under vertical-specific governance mandate. Open →

Bind / Action Gate ALLOW/BLOCK before consequential action — bind policy, sell loan, deactivate worker. Open →

Compliance Certificate Deployer-facing downloadable cert — forward to counsel, auditor, regulator. Open →

Actuarial / Risk Feed Anonymized asymmetry signals for pricing, reserving, reinsurance correlation. Open →

Run dora demo Regulatory calendar Download exhibit pack Verify independently