Financial entities process personal data. It is important that they protect this data, including when deploying AI systems.
Data classification, transfer and encryption. Classification is the most important basis for secure processing and storage of an entity's data. Requirements for confidentiality, integrity and availability must be considered. This classification determines how and where data can be processed and stored (Article 5(2)(b) of the RTS RMF). Such a classification is an additional valuable means of protecting data when AI systems are operated in the cloud. DORA requires financial entities to classify all their data accordingly (Article 11(2)(k) of the RTS RMF).
AI systems are encrypted in compliance with the defined requirements, i.e. following appropriate data classification and ICT risk assessment. This covers data that is stored, transmitted or, where necessary, used. If encryption cannot be carried out during processing, as a minimum other measures, such as processing the data in a separate and protected environment, are necessary (Article 6(2) of the RTS RMF). Secure management of cryptographic keys, for example to protect communication channels between AI system components, is recommended. DORA explicitly requires the use of appropriate encryption methods, cryptographic controls and key management (Articles 6 and 7 of the RTS RMF).
Transferring data between AI system components, as well as between AI systems and external services, is also typically secured in order to protect against e.g. data leaks. Procedures for monitoring and assessing compliance with these requirements must be established (Article 14 of the RTS RMF).
Practices have emerged that can be adapted to individual entities:
- encryption and signing of models to prevent unauthorised modifications;
- use of secure environments (e.g. containers);
- implementation of a zero-trust model for access to AI services;
- securing AI systems against injection attacks, rate limiting to prevent denial-of-service attacks.
Data quality. The term “data quality” typically encompasses several aspects, such as completeness, accuracy, validity, consistency, appropriateness or representativeness, and integrity.
While ensuring data integrity is one of DORA’s protection objectives, the regulation does not contain any provisions for other aspects of data quality. Nevertheless, high data quality, especially for training data, is a key requirement for deploying artificial intelligence, as the accuracy, reliability and performance of AI systems depend on it. Data quality requirements are typical components of governance structures for the use of AI. See the case study for specific details on AI assistants and LLMs.