Question 1

What does DORA mean for AI systems in banks?

Accepted Answer

DORA (Digital Operational Resilience Act) has applied to EU financial entities since January 2025. AI systems that access external model providers (OpenAI, Azure, AWS) qualify as ICT third-party provider arrangements and must be documented accordingly: third-party risk assessment, contractual requirements (Art. 30 DORA), exit strategy, and incident reporting processes.

Question 2

Which AI systems fall under the EU AI Act?

Accepted Answer

The EU AI Act classifies AI systems by risk level. Particularly relevant for financial services: High-Risk systems include AI-powered credit scoring, insurance risk assessment, or biometric recognition. Internal chatbots and RAG systems typically fall under Limited Risk (transparency obligations) — but classification depends on the specific use case and must be documented.

Question 3

What does MaRisk require for AI systems?

Accepted Answer

MaRisk AT 7.2 governs requirements for outsourcing — and external model providers (cloud AI APIs) qualify as outsourcing. Requirements: risk analysis before outsourcing, appropriate contractual arrangements, service provider monitoring, exit strategy. BAIT and VAIT elaborate these requirements specifically for banks and insurers.

Question 4

Do I need a DPIA for every internal chatbot?

Accepted Answer

Not always — but frequently. A DPIA (Data Protection Impact Assessment under Art. 35 GDPR) is mandatory when processing poses a high risk to individuals. Internal chatbots accessing employee or customer data often meet this threshold. The question of whether a DPIA is required should be aligned with the Data Protection Officer early in the project.

Question 5

When is AI in financial services 'safe enough' for production?

Accepted Answer

There's no absolute safety — but clear quality thresholds: hallucination rate below a defined threshold (project-specific), source attribution with every answer, documented escalation paths, completed DPIA, and regulatory clearance. I help define these criteria concretely and make them testable — as the foundation for go-live decisions.

Question 6

How long does an AI compliance project for financial services take?

Accepted Answer

A regulatory assessment (DORA check, EU AI Act classification, DPIA pre-review) typically takes 2–4 weeks. A complete AI requirements specification with integrated compliance framework takes 6–12 weeks, depending on the number of stakeholders and regulatory complexity. I'll provide a concrete proposal after an initial call.

Question 7

Do we need to train our own models?

Accepted Answer

In most cases: no. For typical enterprise use cases (chatbot, policy search, document analysis), RAG with an existing foundation model (GPT-4, Claude, Gemini) is more efficient than fine-tuning. Custom training only makes sense for highly specific language domains or high data volume. I evaluate the approach systematically: feasibility, cost, governance effort, and regulatory implications — and recommend the most pragmatic path.

Question 8

How do I prevent vendor lock-in with AI providers?

Accepted Answer

Three levers: First, an architecture with an abstraction layer (e.g., LangChain, LlamaIndex) that enables switching model providers. Second, documented exit strategies — mandatory for regulated institutions under MaRisk anyway. Third, contractual provisions for data portability, deletion, and migration support. I integrate these aspects into every architecture evaluation and provider governance from the start.

AI Consulting for Financial Services: GenAI Integration with Compliance Built In — From Day One

Typical Situations

Deliverables

Steering & Governance

Regulatory Requirements: DORA · EU AI Act · MaRisk · GDPR

Project Examples (Anonymized)

German Financial Institution: Compliance Chatbot with DORA and GDPR Clearance

Insurance Group: EU AI Act Risk Classification and RAG Governance

Frequently Asked Questions

Related Services

GenAI Integration

Chatbot Consulting

DORA Implementation

Let's talk about your project