The ICT risk management framework lies at the heart of ICT risk management for AI systems (Article 6 of DORA). This framework serves to effectively manage the ICT risks faced by financial entities.
In Chapter II, DORA sets out harmonised, uniform requirements for ICT risk management across the financial services sectors. In addition to the governance and organisational requirements already outlined above, this also includes the ICT risk management framework. This is intended to ensure that financial entities achieve an appropriate degree of digital operational resilience. In other words, they should become sufficiently resilient and adaptable to be able to maintain their digital operational processes both during and after an ICT-related incident.
As part of overall risk management, the ICT risk management framework includes the following requirements, among others:
- identification under Article 8 of DORA,
- protection and prevention under Article 9 of DORA,
- detection under Article 10 of DORA,
- response and recovery under Article 11 of DORA,
- learning and evolving under Article 13 of DORA and
- communication under Article 14 of DORA.
As in the case of other ICT assets, AI systems must also be integrated into the ICT risk management framework. This includes identifying vulnerabilities (for example in model training, data pipelines or inference) and assessing quantitative and qualitative risk criteria (Article 8 of DORA). Additionally, measures for addressing identified risks, such as the use of adversarial training methods or the monitoring of model drift, must be documented and reviewed regularly (Article 9 of DORA).
The ICT risk management framework must be reviewed at least once a year (Article 6(5) sentences 1 and 2 of DORA). In addition, financial entities must be able to submit a report on the review of their ICT risk management framework in a searchable electronic format at the request of the competent authority. Among other things, the report must document the current risk status, the measures taken and any weaknesses identified (Article 27 of the RTS RMF). If required, this report can also be supplemented with specific information on AI systems.