In the supervisory statement on outsourcing to cloud service providers, published on 1 February 20247, BaFin and the Deutsche Bundesbank presented their joint assessment of this outsourcing. Some of these aspects can also be applied to AI systems when AI is operated in the cloud. The following section highlights overlaps and selected AI characteristics.
Risk assessment and due diligence (Cloud supervisory statement, Chapter III.2). Before entering into a contract with a cloud service provider, financial entities should conduct a comprehensive risk assessment (Article 28(4)(c) of DORA) that considers technical, operational and regulatory aspects. This assessment should also consider changes to the AI system (e.g. retraining or adaptation of the model structure), even if all changes to the model are made by the service provider. Before entering into a contract with a cloud provider, entities are encouraged to perform a risk inventory of the AI application (materiality, data sensitivity, technical requirements). It is also expedient to comply with the required due diligence obligations (Article 28(4)(d) of DORA) and to ensure the suitability of the cloud service provider. This also extends to potential conflicts of interest (Article 28(4)(e) of DORA). When using cloud services, the financial entity should also consider the risks of unauthorised data leakage, including to the cloud service provider.
Cyber- and information security (Cloud supervisory statement, Chapter IV.2). In the context of cybersecurity, potential risks from attack vectors (including adversarial attacks and data poisoning) in externally hosted training or inference environments should be identified. In addition, ICT third-party service providers (e.g. cloud service providers, external data science services) should be evaluated in terms of security standards, certifications and data protection before contracts are entered into. These ICT third-party service providers must comply with information security standards that are, as a minimum, appropriate (Article 28(5) of DORA). If critical or important functions are to be supported, financial entities must consider the most up-to-date and highest quality information security standards when selecting them (Article 28(5) of DORA).
Contracts and subcontracting (Cloud supervisory statement, Chapter III.5). There must be clear arrangements governing whether and under what conditions the cloud service provider may use further subcontractors (subcontracting, sub-delegation) (Article 30(2)(a) of DORA). In the case of AI-specific subcontracting that supports critical or important functions (e.g. specialised ML libraries, GPU farms, AI security services), the entity must at all times maintain an overview of which parties are involved in data processing (Article 3(6) of the ITS Register of Information), where (location/region) this takes place (Article 30(2)(b) of DORA) and how potentially long or complex chains of subcontracting may impact the process (Article 29(2) of DORA).
For AI applications that support critical or important functions, financial entities must enter into clear service level agreements (SLAs) and security agreements with ICT third parties (Article 30(3)(a) and (c) of DORA). The SLAs should clearly and unambiguously define how performance, availability and security requirements will be met. Since AI systems are particularly sensitive to latency and computing power, these SLAs typically also cover these aspects.
Furthermore, audit and control rights should also apply without exception to subcontracts that support critical or important functions (Article 3(1)(d) and Article 4(1)(j) of the RTS Subcontracting) in order to obtain insight into relevant AI logs, training environments and security measures, for example in the event of an audit. In addition, a review should be conducted to establish whether the provider meets regulatory expectations (e.g. Cloud supervisory statement, SLA requirements, subcontractor transparency) (Article 3(1)(c) and (j) of the RTS Subcontracting).
Exit strategy and portability (Cloud supervisory statement, Chapter IV.4). An important aspect of using the cloud is the termination or migration of cloud outsourcing. As part of an exit strategy for AI applications that support critical or important functions, financial entities should ensure that they can maintain operations or migrate promptly in the event of problems, such as non-compliance with supervisory requirements by the cloud service provider or a change of provider (Article 28(7) and (8) of DORA). Entities are encouraged to ensure that models, training data and configuration scripts can be exported seamlessly to ensure portability to another environment.
Financial entities should be aware that proprietary cloud functions (e.g. specialised AI offerings) can significantly increase the costs, duration and technical expertise required for a change (known as “vendor lock-in”). These should therefore be explicitly considered in the risk assessment. Before a contract is entered into, the formats in which training data, models and metadata can be exported (e.g. Docker images, storage snapshots) must be clarified to ensure that the entity can remain operational in the event of failure or change of cloud service provider (Article 28(8) and Article 30(3)(f) of DORA). This data should be saved regularly to a storage location that is independent of this cloud service provider.
Tests of scenarios for emergencies (e.g. cloud failure, data corruption, problems with a subcontractor) must be performed regularly for AI applications that support critical or important functions, see Article 28(8) third subparagraph of DORA.
Audit and inspection rights (Article 30(3)(e) of DORA; Cloud supervisory statement, Chapter III.5.3). For significant outsourcing or contractual arrangements for the use of ICT services to support critical or important functions, the competent authority (in particular BaFin) and the outsourcing entity must be granted the right to audit the cloud service provider.