For banks, lenders and insurers
Credit scoring and life or health insurance pricing are high-risk, and DORA adds incident and ICT rules.
What's high-risk
- AI that evaluates creditworthiness or sets a credit score for individuals. AI used only to detect financial fraud is not, on that basis alone.
- AI used for risk assessment and pricing of life and health insurance for individuals.
As a deployer of these systems, you must also complete a fundamental rights impact assessment before first use (Art. 27).
Reuse what you already have
Model risk management, model validation, data quality and outsourcing controls cover much of the AI Act. V77 Trust maps controls across the AI Act, DORA, GDPR and ISO standards so you document each control once.
DORA
DORA applies to ICT risk, including AI services. For a major ICT-related incident, send an initial notification within 4 hours of classifying it as major (and no later than 24 hours after becoming aware), an intermediate report within 72 hours of the initial one, and a final report within a month. Log incidents in V77 Trust with the DORA option on and the clocks run for you.
Third-party AI providers are ICT third-party service providers under DORA: keep them in your register and assess them, for example with the vendor questionnaire.
Fairness testing on credit models is evidence for both AI Act data governance and consumer-credit fairness expectations. Test by protected characteristics where you lawfully hold the data, and by proxies such as postcode.