Skip to main content
Audact
See the offer

DORA

DORA: an AI agent in a regulated conversation is part of your ICT estate.

Directly applicable since 17 January 2025

Last reviewed: 5 October 2026

DORA harmonises ICT risk management across the EU financial sector. It applies directly, without national transposition, and it does not carve out AI. The moment a voice agent handles a KYC call, a claims intake, a mortgage qualification or a payment dispute, that interaction belongs to the firm's ICT estate, with the same documentation, testing, incident-reporting and record-keeping expectations as any other system in it.

What the law requires

A documented ICT risk management framework, reviewed at least annually and after every major incident.
Regulation (EU) 2022/2554, Art. 5 and 6
ICT-related incidents must be classified against set criteria, and major ones reported to the competent authority within the prescribed windows.
Regulation (EU) 2022/2554, Art. 17-19
A digital operational resilience testing programme, with threat-led penetration testing for entities identified as significant.
Regulation (EU) 2022/2554, Art. 24-27
Contractual requirements for every ICT third-party arrangement, and a register of information covering all of them, kept at entity, sub-consolidated and consolidated level.
Regulation (EU) 2022/2554, Art. 28-30
ICT third-party providers designated critical fall under direct oversight by the European Supervisory Authorities, with periodic penalty payments of up to 1% of average daily worldwide turnover.
Regulation (EU) 2022/2554, Art. 31 and 35(8)
It is a regulation, applicable since 17 January 2025. There is no national transposition step to wait for.
Regulation (EU) 2022/2554, Art. 64

What Audact does about it

Every governed interaction is written to the same chain that carries the Article 50 attestation: one substrate, with the controls set per regime.
Working today
Without any key, an auditor can recompute the input and output hashes and check that each receipt links to the one before it. Merkle inclusion is the fourth check, and it is checked against the published root with the inclusion proof from the call's Article 50 report. Confirming the keyed authentication code needs the key held by Audact.
Working today
The published sub-processor and dependency list names the function each entry performs and where it runs. Filling the register of information remains the financial entity's own duty.
Planned
One export shaped for a supervisory request: incident records, policy verdicts, interaction logs and residency attestations in a single package.
In development

Where it lands

The conversations that pull an agent into scope.

DORA does not name AI, which is exactly why it reaches it. The test is whether the system supports a regulated function, and a voice agent that takes a claim, verifies an identity, qualifies a mortgage or triages a payment dispute plainly does.

The practical consequence is not a new obligation but a new place to look for evidence of an existing one. Incident classification, resilience testing and third-party records already applied to your telephony and your CRM. The agent sits between them, and until it produces its own record it is the gap in the chain.

What an auditor can check

Three fields anyone can recompute, a fourth checked with the inclusion proof, and one that needs the key.

The receipt for an interaction carries an input hash, an output hash, the link to the receipt before it, and a Merkle inclusion path. The first three can be recomputed by anyone holding the record: no key, no account, no request to us. The fourth, inclusion in the Merkle root, is checked against the published root with the inclusion proof from the call's Article 50 report.

The receipt also carries a keyed authentication code, and that one is a different kind of statement: it is computed with a symmetric key held by Audact. Say that plainly to a supervisor and the fields above carry more weight, not less.

Note

Information, not legal advice.

This page sets out the rules as we read them, with the article numbers so you can check us. It is not legal advice, and your own position depends on facts this page cannot know. Take advice from qualified counsel before you rely on it.

Questions

Does DORA apply to us if we only use an AI agent for inbound support?
If your firm is an in-scope financial entity, DORA applies to the firm and to the ICT it relies on. The channel does not change that. What changes with the use case is which requirements bite hardest: an inbound support line usually lands in incident classification and third-party records rather than in threat-led testing.
Is Audact a critical ICT third-party provider?
No. That designation is made by the European Supervisory Authorities under Article 31 and applies to providers whose failure would affect financial stability at scale. Audact is an ordinary ICT third-party provider, which means the contractual requirements of Article 30 apply to the arrangement between us.
What do you give us for the register of information?
The published sub-processor and dependency list, with the function each one performs and where it runs. Filling the register of information remains the financial entity's own duty.
How long are the records kept?
For the retention window agreed in the contract. Compliance metadata and hashes are what a receipt is made of and are kept for that full window; audio is a separate setting and is not retained by default.

Look at a real record before you plan the audit

Proof walks through an actual receipt field by field, and marks which fields a third party can recompute and which need Audact's key.

See a receipt

Related