Key dates
- 01 February 2024
- - Related BaFin/Bundesbank supervisory notice on cloud outsourcing (contextual reference)
- 18 December 2025
- - Guidance issuance date
Suggested considerations
- Develop and approve AI strategy integrated with ICT roadmap and governance.
- Embed AI in existing ICT risk framework, ensuring lifecycle coverage with safeguards (e.g., testing, monitoring, decommissioning).
- Conduct third-party due diligence and contractual reviews for AI/cloud providers, including exit/portability testing.
- Implement AI-specific testing, documentation, and incident processes proportionate to criticality.
- Ensure management accountability for oversight, training, and interdisciplinary controls.
What changed
- The guidance does not introduce new binding rules but clarifies AI as ICT systems requiring DORA-compliant treatment, including:
- AI strategy: Management-approved, aligned with overall strategy, defining responsibilities, competencies, and interdisciplinary collaboration for critical functions.
- ICT risk management integration: Cover identification, protection, detection, response, recovery, training; apply to AI lifecycle (data acquisition, development, operation, retirement).
- Development and testing: Robust standards, documentation, testing proportionate to criticality; special focus on generative AI/LLMs, open-source, and code generation risks.
- Operational processes: Asset classification, monitoring, access controls, logging, anomaly detection, business continuity, secure decommissioning.
Compliance impact
Urgency: High – DORA is live (effective Jan 17, 2025), and AI use is widespread; this guidance operationalizes ICT requirements for AI, exposing non-compliant firms to supervisory scrutiny, fines, or remediation orders under CRR/Solvency II. It heightens focus on third-party/cloud risks amid EU AI Act rollout, demanding immediate gap assessments to avoid operational resilience failures.