Specific ICT risks are not related to the location of AI systems in a financial entity’s value chain. Rather, they arise from the integration of the AI system into the entities’ ICT landscape. For this reason, the guidance does not address ICT risks along the value chain, but rather along the “AI lifecycle”.
The security and resilience of an AI system should be ensured throughout this cycle, from data acquisition and model development down to ongoing operation and retirement. In addition to specific safeguards for ICT assets, it is crucial for AI systems to be included within the existing ICT risk management framework.
This guidance deals exclusively with ICT risks and their treatment under DORA and supplementary regulatory technical standards. Important principles in DORA are the risk-based approach and the proportionality principle (Article 4 of DORA), which must be observed in the implementation of the requirements. This means that in particular those AI applications that are integrated into critical or important functions require more extensive security and control measures than, for example, AI-based self-service assistants that are completely under human supervision and are not involved in decision-making processes.
This guidance document, which is intended to provide non-mandatory advice, does not define any supervisory expectations. As in DORA, the risk-based approach and the principle of proportionality must always be observed.