Topic starter
06/06/2026 2:32 am
TL;DR: AI adoption is widening the ICT surface area that DORA must govern, and financial institutions are struggling to translate the regulation’s five pillars into defensible operational controls, according to WitnessAI. The compliance problem is no longer policy intent but evidence, inventory, and third-party visibility across AI-driven systems.
Editorial analysis by NHI Mgmt Group, based on content published by WitnessAI: “What Are DORA Compliance Requirements?”.
Key questions
Q: What breaks when AI tools are outside DORA inventories?
A: When AI tools, models, or agents are missing from inventories, the institution cannot prove which services, vendors, and dependencies are in scope.
Q: Why do AI vendors create DORA third-party risk even when procurement is approved?
A: Approved procurement does not eliminate DORA risk if the provider uses subcontractors, shared infrastructure, or hidden model dependencies that the contract does not disclose.
Q: How do organisations know whether DORA controls are actually covering AI risk?
A: They should test whether AI-related assets appear in the inventory, whether contracts include audit and exit terms, and whether monitoring detects AI-specific failure modes.
Practitioner guidance
- Build a complete AI and ICT asset inventory Identify every AI tool, model, and agent in use, including shadow AI adopted outside formal procurement.
- Map AI systems to DORA control functions Connect each AI tool, model, and vendor relationship to identify, protect, detect, respond, and learn.
- Extend incident detection to AI failure modes Update monitoring and classification rules for model failures, data poisoning, prompt injection, and unauthorized AI access so incidents can be classified fast enough for DORA reporting.
Bottom line: DORA compliance becomes fragile when AI systems are adopted faster than inventory, vendor, and incident processes can track them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 4:16 am
Shadow AI is now a DORA scope problem, not just an innovation problem. When AI tools sit outside procurement and asset inventory processes, the institution loses the evidence chain DORA requires across ICT risk, third-party oversight, and resilience. That means compliance can fail even where written policy exists, because the regulated surface area is larger than the governed one. The practitioner conclusion is to treat discovery as the first control.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when AI failure modes do not fit legacy incident workflows?
A: They should expand detection, classification, and escalation logic to include AI-specific failures such as prompt injection, data poisoning, and unauthorized AI access. If those events cannot be recognised early, the institution may miss the DORA reporting clock and lose the ability to explain impact, cause, and scope.
👉 Read our full editorial: DORA compliance gaps widen as AI expands ICT risk scope