Banks, fintechs, and insurers face the toughest AI compliance requirements in the market. Aegis Firma gives your team a single platform to manage obligations across DORA, EU AI Act, GDPR, and FCA rules.
2%
global turnover DORA fine
Jan 2025
DORA effective date
High-risk
AI Act classification for credit AI
€20M
GDPR max fine for financial data
Financial services is subject to the EU Digital Operational Resilience Act (DORA, effective Jan 2025), the EU AI Act (high-risk for credit scoring and underwriting), GDPR, and FCA Principles for Businesses — all simultaneously. Non-compliance carries fines up to 2% of global turnover under DORA and, under the AI Act, up to €35M or 7% for prohibited practices / €15M or 3% for high-risk non-compliance.
Credit scoring AI is high-risk
AI used for credit decisions, loan approvals, or underwriting is classified as high-risk under EU AI Act Annex III §5(b). Conformity assessment and human oversight requirements apply.
DORA ICT third-party risk
DORA requires detailed registers of all ICT third parties including AI providers, with contractual requirements and concentration risk monitoring.
Explainability requirements
Under GDPR Article 22 and the AI Act, automated decisions affecting creditworthiness must be explainable to customers. Black-box models need a wrapper explanation layer.
Algorithmic bias and discrimination
FCA and EBA guidance requires firms to assess AI models for protected characteristic bias in credit, insurance, and employment decisions, with annual reviews.
Model risk management
SR 11-7 (US) and PRA/FCA equivalents require model validation, inventory, and ongoing monitoring. Many AI deployments bypass this governance entirely.
AI in market activities
AI used for trading, investment recommendations, or market surveillance may be subject to MiFID II transaction reporting and algorithmic trading requirements in addition to AI Act rules.
DORA ICT third-party register
Catalogue all AI and ICT vendors with DORA-required contract monitoring, concentration risk flags, and audit event logging.
AI risk register
Classify every model by EU AI Act risk tier, track validation status, and generate the technical documentation required by regulators.
Automated decision audit trail
Maintain a cryptographically-signed log of every AI-assisted credit or underwriting decision for regulatory inspection.
DPA builder for AI vendors
Generate GDPR Article 28 DPAs and DORA-compliant service agreements for all AI data processors in your chain.
GDPR Article 22 explainability notices
Generate per-decision explainability notices for customers affected by automated credit decisions — legally required under GDPR.
Policy and training management
Deploy AI use policies to all staff, track acknowledgment, and generate evidence for FCA SM&CR and DORA capability requirements.
Does DORA cover AI systems as ICT third-party services?
Yes. AI-as-a-service tools provided by third parties fall within DORA's definition of ICT third-party services. You must maintain a register of these providers, assess their resilience, and include DORA-specific contractual provisions in your agreements.
Is our credit scoring model definitely high-risk under the EU AI Act?
If your model outputs a score or recommendation that influences whether an individual is offered credit or on what terms, it is classified as high-risk under Annex III §5(b). This triggers conformity assessment, human oversight, and database registration requirements before deployment.
How quickly can we get a compliant AI risk register in place?
With Aegis Firma, you can build your initial AI risk register in under a day using the guided setup wizard. The system auto-classifies AI tools by risk tier and generates required technical documentation templates.
Can Aegis Firma help with the FCA Consumer Duty AI implications?
Yes. Consumer Duty requires firms to deliver good outcomes for customers, including when using AI for product recommendations or customer service. Aegis Firma helps you document how AI is used in customer journeys and build the governance required to demonstrate compliance.
Cancel anytime · 7-day refund eligibility · no contracts