The compliance-AI tension: why now matters
Regulators and banks face a fundamental conflict. Banks deploy AI to accelerate fraud detection, streamline customer onboarding, and automate compliance monitoring—tools that promise to handle growing regulatory complexity at lower cost. At the same time, two major EU frameworks—the Digital Operational Resilience Act (DORA) and the EU AI Act—now demand that every AI system be explainable, tested, monitored and ultimately controllable by humans who bear accountability for its output. The gap between AI's promise and regulatory reality forces compliance leaders, chief technology officers and chief risk officers to reconcile innovation with control.
This tension is especially acute in banking because both frameworks interlock. DORA, which took effect on 17 January 2025, governs ICT risk, cyber resilience and third-party technology risk. The EU AI Act, which entered force on 1 August 2024 and phases in high-risk requirements from 2 December 2027 onwards, adds a horizontal layer of AI-specific governance. Neither replaces the other. Both apply, and they demand different disciplines working in parallel.
DORA: the operational resilience baseline
DORA applies to almost all EU financial entities—banks, insurers, brokers, payment institutions, investment firms and crypto-asset service providers. Its core requirement is that organisations manage ICT risk according to common rules across information security governance, asset inventory, business continuity planning and incident reporting.
For AI systems, DORA's third-party management pillar is the immediate pressure point. Financial entities must ensure contracts with AI providers and cloud vendors include specific DORA-mandated clauses. Those clauses govern data access, audit rights, breach notification, and the right to terminate if a vendor's security posture deteriorates. DORA also designates certain vendors as 'critical ICT service providers', drawing tighter scrutiny from European Supervisory Authorities.
DORA also imposes testing obligations. Financial institutions must run regular threat-led penetration testing and demonstrate that digital operational resilience controls remain effective. For AI systems, this means banks must validate that models perform as expected under stress and that drift in model behaviour is caught before it creates a compliance or financial crime risk.
The governance implication is immediate: DORA requires that the management board oversee the ICT risk framework, that cybersecurity training reaches the board level, and that incident escalation is documented and trackable. This shifts AI governance from a technical concern to a board responsibility.
The EU AI Act: risk-based AI governance
The EU AI Act classifies AI systems into four risk tiers. Prohibited systems are banned outright. Limited-risk systems (such as chatbots) require transparency disclosure. High-risk systems face the strictest regime. Minimal-risk systems face no specific obligations, though voluntary codes are encouraged.
In banking, two AI use cases are explicitly classified as high-risk under Annex III of the Act. AI systems used to evaluate creditworthiness or establish credit scores carry high-risk status. So do systems used to assess risk and price life and health insurance. That designation matters because it triggers comprehensive compliance obligations: risk management frameworks, training data validation, bias testing, documentation of decisions, human oversight protocols and real-time monitoring of model performance.
High-risk status does not prohibit the technology. It means every such system must be registered, its training data must be audited for quality and bias, its decisions must be explainable to regulators on request, and humans must retain the ability to intervene before a final decision is made. A credit decision generated by AI cannot be deployed without human review—and that human reviewer must have the authority and tools to reject the model's recommendation.
The European Banking Authority (EBA) conducted a mapping exercise in 2025 comparing EU AI Act requirements against existing banking regulation. It found no significant contradictions, meaning banks can build AI governance that satisfies both regimes at once. However, the EBA also noted that existing prudential controls often focus on financial stability while the AI Act prioritises protection of fundamental rights. Banks will need to evidence compliance with both objectives in parallel, even where there is overlap.
Creditworthiness assessment: high-risk territory
Credit scoring and credit decisioning systems sit at the intersection of DORA and the AI Act. Under the AI Act, these systems must meet high-risk safeguards starting from 2 December 2027 (the Annex III deadline, updated following the Digital Omnibus in 2026).
What that means in practice: before a bank deploys an AI system to assess whether a customer qualifies for a loan or what interest rate they pay, it must document the system's purpose, the training data used, the quality checks performed on that data, and the process for detecting and remediating bias. The bank must also establish a testing regime that validates model performance across demographic groups and identifies any disparate impact.
Once deployed, the system must be monitored continuously. Model drift—the gradual degradation of performance as real-world data changes—must be caught and remediated. If the system's error rate rises, or if it begins to treat applicants from particular regions or income groups differently, that pattern must be detected, logged and escalated to decision-makers.
The bank must also maintain logs of every decision the system contributes to, the inputs that drove that decision, and any human override. These logs are the evidence regulators and auditors will review. They prove that the bank treated the AI system as a tool, not as an autonomous agent freed from human judgment.
Human-in-the-loop: the non-negotiable control
Across both DORA and the AI Act, regulators emphasise a single requirement: humans must remain in meaningful control of consequential decisions. This is not a suggestion. It is a hard constraint that reshapes how AI can be deployed.
The Office of the Comptroller of the Currency (OCC) in the United States recently published guidance clarifying that banks deploying autonomous AI systems must calibrate human oversight to the potential consequences of failure. If an AI model makes a decision that could harm a customer or breach a regulatory requirement, human oversight is mandatory. The OCC distinguishes between AI use cases where humans pre-approve actions versus cases where AI takes action and humans monitor it afterwards. Higher-consequence use cases require pre-approval.
For compliance teams, this means AI cannot be a black box that generates recommendations. The system must explain why it flagged a transaction as suspicious, why it scored a loan application a certain way, or why it flagged a new customer for additional due diligence. That explanation must be clear enough for a non-technical compliance officer to review and potentially override.
Research from KPMG shows that targeted AI use cases can automate 50 to 70 percent of suspicious activity report (SAR) narratives and eliminate 80 to 90 percent of false-positive alerts in sanctions screening. But those gains are only sustainable if humans still make the final judgment. Automation that frees analysts from manual data collection—allowing them to focus on judgment calls—is compliant. Automation that removes human judgment from the final decision is not.
Building compliant AI governance in practice
Compliance leaders now face a four-part governance challenge. First, map every AI system in use against DORA and AI Act requirements. This inventory must distinguish between systems the bank built in-house (which make it both provider and deployer, triggering the full compliance burden) versus third-party systems (where the bank is primarily a deployer with narrower but still demanding responsibilities).
Second, design model risk management frameworks that explicitly cover bias testing, data governance and continuous monitoring. Existing financial institutions already manage model risk through frameworks that validate accuracy, back-test performance and log decisions. The AI Act and DORA do not replace these—they extend them. Banks must add formal bias testing, demonstrate that training data meets quality standards, and embed continuous monitoring alongside existing validation practices.
Third, establish clear governance roles and escalation paths. The board must own AI risk. Line business owners must own the use case (the credit decision, the AML alert, the customer onboarding process). Risk and compliance functions must own the control framework. And data and technology functions must own the infrastructure. This separation prevents any single function from both developing and independently validating an AI system.
Fourth, contractual clarity with third-party providers is essential. If a bank uses an AI system supplied by a vendor—whether a credit-scoring model or a sanctions screening tool—the contract must specify who bears responsibility for each requirement. Who retrains the model if performance drifts? Who conducts bias testing and at what frequency? Who owns the data and controls how it is used? Who is liable if the model causes harm? DORA explicitly requires these provisions in vendor contracts. The AI Act imposes equivalent obligations on both the AI provider (the vendor) and the deployer (the bank).
Third-party risk and contractual reality
A significant gap separates DORA's contractual requirements from what most vendor standard terms currently offer. DORA mandates specific contract language governing audit rights, incident notification, data handling and termination rights. Many service providers have updated their templates, but not all versions fully satisfy DORA or the AI Act. Banks should not assume a vendor's 'DORA-compliant' contract amendment delivers compliance without careful review.
The practical challenge is especially acute for AI systems. When a bank sources a pre-built AI model (such as a credit-scoring system or document verification tool), it depends on the vendor's training data, architecture and ongoing model maintenance. DORA and the AI Act do not absolve the bank of responsibility. The bank, as deployer, remains accountable for ensuring the system operates safely and complies with regulations.
This creates a three-layer governance problem. The vendor (provider) bears obligations to validate training data, document model decisions and report incidents. The bank (deployer) bears obligations to oversee vendor performance, validate the system before first use, monitor it continuously and escalate issues. And the bank's management and board bear ultimate accountability if something goes wrong. That cascading responsibility means contracts must be clear about who does what, when, and to what standard.
The timeline: what regulators expect when
DORA's major provisions took effect on 17 January 2025. Financial institutions must now comply with ICT risk management, third-party risk management, and incident reporting requirements. For most banks, this has meant updating vendor contracts, refreshing business continuity plans and embedding cyber governance at board level. Compliance is not optional; examiners are assessing banks against these requirements now.
The EU AI Act entered force on 1 August 2024, but its requirements phase in over time. High-risk requirements for systems like creditworthiness assessment must be implemented by 2 December 2027. That gives banks and vendors a window, but not a long one. Regulators expect planning to begin immediately.
For financial institutions, the implication is clear: waiting for final regulatory guidance is not viable. Every AI system must be inventoried and classified now. Governance frameworks should be designed to accommodate both DORA and AI Act obligations. Third-party contracts should be reviewed and updated. By the time the Annex III high-risk deadline arrives in December 2027, banks must have already implemented controls that can survive regulatory examination.
Frequently asked questions
Does DORA apply to all AI systems banks use?
DORA applies to all ICT and digital operational resilience risks, including those posed by AI systems and the cloud platforms, data platforms and model-serving infrastructure they run on. If a bank uses an AI system supplied by a third-party vendor, DORA requires the bank to perform due diligence on that vendor, include DORA-specific contract terms and monitor vendor performance. The depth of oversight must be proportionate to the criticality and risk of the system. If the vendor is designated as a 'critical ICT service provider' by European Supervisory Authorities, oversight intensifies further.
Can a bank use AI for credit decisions under the AI Act?
Yes, but only with comprehensive safeguards. AI systems used to assess creditworthiness or establish credit scores are classified as high-risk under the EU AI Act Annex III, triggering requirements for documented risk management, trained and approved data, bias testing, explainability and human oversight before final decisions. The system must be registered and monitored continuously. From 2 December 2027, non-compliance with these requirements is a regulatory violation. Compliance is complex but achievable with proper governance; prohibition is not the regulatory path.
What does human-in-the-loop actually mean in practice?
Human-in-the-loop does not mean humans click 'approve' on every AI recommendation without reading it. It means humans retain the authority and practical ability to intervene before a consequential decision is made. In credit decisioning, that might mean a specialist reviewer can override an automated approval or rejection. In transaction monitoring, it means a compliance officer must validate a suspicious activity report before it is filed with regulators. In customer onboarding, it means identity verification must include a human review step if the AI flags uncertainty or risk. The human's role is judgment, not rubber-stamping.
How can banks demonstrate compliance to regulators?
Through documentation, logs and testing. Banks must maintain an inventory of AI systems, their purpose, the data they use and their regulatory classification. For high-risk systems, banks must document risk assessments, bias testing, training data validation and monitoring metrics. They must keep logs of model decisions, inputs and any human overrides. They must run periodic tests to confirm the system still performs as validated. And they must document how they responded to any incidents or performance drift. Regulators will review this evidence during examinations. Transparency and completeness are the foundation of demonstrating control.
Where to learn more
Excellence in Digital Banking 7.0, an international three-day summit running 25–27 November 2026 in Amsterdam, brings together senior banking leaders, regulators and technology experts to explore AI, digital identity and next-generation banking architecture. The event features sessions on compliance, regulatory strategy and responsible AI deployment. Register for in-person or online attendance, or explore pass options to attend sessions directly relevant to your compliance and risk mandate.
For more information, visit pulsecore-digital.com.
Sources
- Cybersecurity in the Financial Sector: EU's Digital Operational Resilience Act Takes Effect
- AI regulation in financial services: navigating the EU AI Act in a layered regulatory landscape
- AI Act implications for the EU banking sector
- 10 Ways AI is Revolutionizing Compliance in Banking
- AI for Regulatory Compliance in Banking: From SOX to Real-Time Monitoring
- 5 Ways AI is Helping Financial Regulatory Compliance
- Mind the gaps: Scaling agentic AI in financial compliance
- OCC: Banks need strong controls when delegating to AI agents