AI Evidence under the EU AI Act and DORA · Triodian

European Union · AI Act and DORA

In the EU, the evidence question has statute behind it. DORA already applies.

DORA already requires a register of every ICT third-party service and audit rights in the contracts behind them. The AI Act, as amended in July 2026, applies its high-risk duties to credit and insurance uses from 2 December 2027. The AI Use Assessment extends one register to answer both.

What applies

One regulation in force, one with dated high-risk duties.

The texts below are the EU's. What each requires of your institution is for your counsel to grade.

InstrumentWhat it asksWhat it means for evidence
AI Act (Regulation 2024/1689), as amended by the Digital Omnibus (Regulation 2026/1744)Annex III high-risk uses, including creditworthiness assessment of individuals and risk assessment and pricing in life and health insurance, apply from 2 December 2027. Deployers use them as instructed, with human oversight, monitoring and kept logs; credit and insurance deployers carry out a fundamental rights impact assessment.A register of high-risk uses, including those inside providers, with oversight and log evidence for each.
AI Act transparency duties (Article 50)Applied since 2 August 2026. Generative systems already on the market before then have until 2 December 2026 to add machine-readable marking.A record of where generative AI faces customers.
DORA (Regulation 2022/2554), applied since 17 January 2025A register of information covering every ICT third-party service and its sub-outsourcing. Article 30 contract terms, including access, inspection and audit rights for you and your supervisor.The register extended into the AI inside each ICT provider, and audit rights that reach it.
SupervisionNational authorities remain competent for financial institutions under the amended AI Act.Your existing supervisor is the one who will ask.

The seven questions, in EU terms

DORA asks the first four. The AI Act sharpens the last three.

1Is the AI part of an ICT service you receive, directly or through sub-outsourcing?An ICT third-party service on your register of information, or a platform behind one
2Does the service support a critical or important function?DORA's stricter contract terms apply where it does
3What rights do you hold?Access, inspection and audit rights (Article 30) · alternative assurance where an audit would affect other clients · none
4Where is each party, and does location change what can be obtained?Enforceability, data access and audit rights; providers outside the EU
5What authority has been delegated to the AI?Productivity · analytical · decision · transactional · agentic · actuating
6What could failure do?Immaterial · contract breach · financial loss · customer harm · critical-operation disruption
7What evidence can reasonably be required?None · disclosure · attestation · event notification · audit · continuous telemetry · deterministic control

"No reasonable reach" is a documented conclusion, not a gap. The determination at each step is yours and your counsel's.

One register, two duties

Answer DORA and the AI Act from the same entries.

Duty 1 · DORA

The register of information, extended

Each ICT service already on your register gains the AI inside it: the model, the platform behind it, the authority delegated, and the evidence obtainable at that boundary.

Duty 2 · AI Act

The high-risk uses a deployer oversees

The same entries mark which uses fall in Annex III, and what oversight, monitoring and log evidence exists for each before 2 December 2027.

Who it is for

Financial entities, and the groups they belong to.

Credit institutions

Creditworthiness models are an Annex III high-risk use.

Insurers

Life and health insurance risk assessment and pricing are Annex III high-risk uses.

Investment firms and payment institutions

DORA's register and contract terms apply to their ICT providers.

Groups with EU subsidiaries

One group framework, read by each supervisor.

Several supervisors →

For operators and manufacturers

AI built into products follows from 2 August 2028.

High-risk AI embedded in products covered by EU product safety law applies from 2 August 2028, and the EU's machinery and product liability rules are being updated for AI. Operators and OEMs selling into the EU face the same question: what evidence can the AI inside the product produce?

For operators →

Regulatory position as at 26 October 2026. Not legal advice: every legal determination is yours and your counsel's.

This page summarises published texts for orientation. Your counsel grades what is a requirement and what is an expectation for your institution.