EU AI Act vs DORA
How AI-specific regulation meets the financial sector's digital operational resilience framework
Snelle vergelijking
Overzicht naast elkaar van de belangrijkste regelgevende dimensies
| Dimensie | EU AI Act | DORA |
|---|---|---|
| Primary focus | Regulating AI systems in every sector according to their risk, from prohibited practices to transparency duties for limited-risk systems | Ensuring the digital operational resilience of financial entities by managing ICT risk, incidents, testing and third-party dependencies |
| Scope | All sectors: any provider, deployer, importer or distributor of AI systems placed on the EU market or affecting people in the EU | Financial sector only: banks, insurers, investment firms, payment institutions, crypto-asset service providers and critical ICT third-party providers |
| Risk approach | Four tiers by intended use: unacceptable risk (banned), high-risk (strict conformity requirements), limited risk (transparency) and minimal risk (voluntary) | Proportionality: requirements scale with the entity's size, risk profile and the criticality of its ICT services, but every entity must meet a baseline |
| Assessment requirements | Conformity assessments for high-risk AI (internal or by a notified body, depending on the category), fundamental rights impact assessments for certain deployers, and post-market monitoring | Mandatory digital operational resilience testing programme, including vulnerability assessments, scenario-based tests and threat-led penetration testing (TLPT) for significant entities |
| Governance | Quality management systems, risk management systems, technical documentation, human oversight and transparency requirements for AI providers and deployers | The management body must approve the ICT risk strategy, take regular ICT risk training, allocate budget and remain accountable for DORA compliance |
| Penalties | Prohibited practices: up to EUR 35 million or 7% of global turnover; high-risk non-compliance: up to EUR 15 million or 3%; incorrect information to authorities: up to EUR 7.5 million or 1% | Set by Member States; for critical ICT third-party providers, a periodic penalty of up to 1% of average daily worldwide turnover per day of non-compliance (max 6 months) |
| Third-party provisions | Value chain obligations: providers must give downstream deployers adequate information, importers and distributors have due diligence duties, and general-purpose AI model providers have transparency and safety obligations | Dedicated ICT third-party risk framework: a register of all ICT providers, mandatory contractual provisions, concentration risk management and direct EU oversight of critical ICT providers through the Lead Overseer |
Belangrijkste verschillen
Wat deze regelgeving van elkaar onderscheidt
- EU AI Act
The AI Act regulates a technology; DORA regulates a sector
The AI Act applies wherever AI systems are used, in every industry. DORA applies to financial entities whatever technology they use. A financial institution using AI must comply with both: the AI Act for its AI systems and DORA for its overall ICT resilience.
- DORA
DORA mandates continuous resilience testing
DORA requires ongoing testing programmes, including vulnerability scanning, scenario testing and threat-led penetration testing (TLPT) every three years. The AI Act requires conformity assessment before a high-risk system reaches the market and post-market monitoring afterwards, but not the same continuous operational testing.
- EU AI Act
The AI Act bans certain AI practices outright
The AI Act prohibits AI systems that pose an unacceptable risk, such as social scoring, real-time remote biometric identification in public spaces for law enforcement (with narrow exceptions), exploitation of vulnerable groups and emotion recognition in workplaces. DORA does not ban technologies; it requires resilience whatever technology is used.
- DORA
DORA addresses ICT concentration risk
DORA addresses concentration risk: the danger of too many financial entities relying on the same ICT provider. Entities must assess whether outsourcing creates systemic dependencies, and critical ICT providers are overseen at EU level. The AI Act has no equivalent rule on concentration among AI providers.
- EU AI Act
The AI Act sets higher fixed fine ceilings
The AI Act's maximum fine of EUR 35 million or 7% of global turnover for prohibited practices is one of the highest fine ceilings in EU digital regulation. DORA sets fewer amounts at EU level and leaves most to Member States, apart from the periodic penalties on critical ICT providers.
Waar ze overlappen
Gebieden waarop beide regelingen raakvlakken hebben
- Both require solid risk management frameworks (the AI Act for AI systems, DORA for ICT systems), and financial institutions need to fold both into their enterprise risk management
- Both impose governance duties: the AI Act requires human oversight of AI systems, while DORA makes the management body accountable for ICT resilience
- Both address third-party risk: the AI Act through value chain obligations for providers, deployers and distributors, DORA through its ICT third-party risk framework
- Both require documentation and record-keeping: technical documentation and logs for high-risk AI under the AI Act, and documented ICT risk management and incident reports under DORA
Welke is op u van toepassing?
Veelvoorkomende scenario's en welke regeling voorgaat
You are a bank using AI for credit scoring and fraud detection
Both apply. AI used to assess the creditworthiness of natural persons or set their credit score is high-risk under the AI Act (Annex III), which requires conformity assessment, transparency and human oversight; AI used only to detect financial fraud is expressly excluded from that category. DORA requires you to manage every AI system as part of your ICT risk framework, with resilience testing and third-party oversight if the AI comes from an external provider.
You are an AI start-up selling to companies outside the financial sector
The AI Act applies to your AI systems according to their risk class. DORA does not apply, since your clients are not financial entities. Focus on the AI Act's conformity requirements, particularly if your products fall into a high-risk category (for example, AI for recruitment, education or law enforcement).
You are an insurance company using AI in underwriting and claims
Both apply. AI used for risk assessment and pricing of natural persons in life and health insurance is high-risk under the AI Act (Annex III), with conformity assessment, explainability and human oversight; other uses, such as claims automation, need to be checked case by case. DORA requires every AI system to sit within your ICT risk management framework, with resilience testing and third-party risk management if the provider is external.
You are a payment institution that does not use AI systems
Only DORA applies. As a financial entity, you must meet DORA's ICT risk management, incident reporting, resilience testing and third-party oversight requirements whether or not you use AI. The AI Act does not apply if you do not develop, deploy or use AI systems.
Veelgestelde vragen
Veelgestelde vragen over deze regelgeving
Lees de volledige gidsen
Meer vergelijkingen
Align AI Act and DORA compliance with Reversa
Financial institutions using AI answer to both frameworks. Reversa brings AI governance into your ICT resilience work, with the same controls and the same team.
- 01Kennismakingsgesprek
- 02Demonstratie op uw casus
- 03Uitrol binnen enkele weken