Digital operational resilience for financial services, enforced since January 2025.

"The management body bears ultimate responsibility for defining, approving, overseeing, and being responsible for the ICT risk management framework."

Pillar 1: ICT Risk Management (Articles 5-16) Financial entities must maintain a complete, up-to-date inventory of all ICT assets, including AI systems, cloud services, and third-party integrations. The framework requires systematic risk identification, documented risk appetite levels, protection and prevention measures, detection capabilities (SIEM, IDS, anomaly detection), and response and recovery plans tested at least annually. Board members must maintain adequate knowledge of ICT risks through specific training. Detailed specifications are set out in Commission Delegated Regulation (EU) 2024/1774.

→ Nexovern discovers and inventories every AI system across your environment, providing the asset-level visibility and continuous risk evidence that Article 5 assigns to the management body, without relying on manual cataloguing that misses shadow deployments.

"Initial notification within four hours of classification as major. Intermediate report within 72 hours. Final report with root cause analysis within one month."

Pillar 2: ICT Incident Reporting (Articles 17-23) Major incidents trigger a mandatory three-stage reporting timeline: initial notification within four hours of classification (hard outer limit: 24 hours after detection), intermediate report within 72 hours, and a final report including root cause analysis within one month. Incidents are classified by severity, impact, duration, geographic spread, data losses, and criticality of affected services, per Commission Delegated Regulation (EU) 2024/1772. Financial entities must also voluntarily report significant cyber threats, even when no incident has yet occurred. Standardised reporting formats took effect February 20, 2025.

→ Nexovern's correlated app-layer and OS-layer telemetry provides the prompt-level visibility into AI operations needed to classify an incident and assemble the initial notification within the four-hour window, rather than reconstructing events after the deadline has passed.

"Threat-led penetration testing on live production systems, using external testers, at least every three years for significant entities."

Pillar 3: Digital Operational Resilience Testing (Articles 24-27) All in-scope entities must maintain a comprehensive testing programme conducted at least annually, covering vulnerability assessments, network security assessments, scenario-based testing, and penetration testing. Entities identified by competent authorities as systemically significant must undergo TLPT at least every three years, following the TIBER-EU framework, conducted on live production systems by external, independent testers. AI systems supporting critical or important functions fall within TLPT scope. The first mandatory TLPT cycle must be completed by January 17, 2028. Technical standards are defined in Commission Delegated Regulation (EU) 2025/1190.

→ Nexovern provides the runtime evidence and AI system mapping that resilience testing teams need to scope their engagements accurately, ensuring that AI red teaming, prompt injection testing, and adversarial assessments cover every critical AI component.

"Maintain a Register of Information documenting all contractual arrangements with ICT third-party service providers."

Pillar 4: ICT Third-Party Risk Management (Articles 28-44) Financial entities must conduct thorough due diligence on all ICT providers, assess concentration risk, and maintain a Register of Information covering every contractual arrangement with ICT third-party providers. Contracts supporting critical functions must include service-level descriptions, data location requirements, encryption standards, incident notification aligned to Article 19 timelines, audit and inspection rights, exit strategies with tested transition plans, and subcontracting conditions. AI vendors must disclose their subcontracting chains, including foundation-model providers and hosting infrastructure, per Regulation (EU) 2025/532. Exit strategies must be operationally tested, not merely documented.

→ Nexovern's automated discovery identifies which AI vendors your organization relies on in production, mapping inference dependencies and subcontracting chains so your Register of Information reflects what is actually deployed, not what procurement records suggest.

"Financial entities may exchange cyber threat intelligence and information among themselves."

Pillar 5: Information Sharing (Article 45) DORA establishes a voluntary framework for financial entities to share cyber threat intelligence, including indicators of compromise (IoCs), tactics, techniques, and procedures (TTPs), vulnerability assessments, and configuration tools. Sharing must respect confidentiality, data protection under GDPR, competition law, and intellectual property. For AI-driven financial services, this extends to sharing new prompt injection techniques, observed agent compromise patterns, AI-specific indicators of compromise, and model vulnerability disclosures through trusted communities and sector-wide intelligence platforms.

→ Nexovern's telemetry generates the structured, shareable threat intelligence that information-sharing arrangements require, converting raw AI interaction data into indicators of compromise and behavioral patterns that peer institutions can act on.