Frontier Models Under DORA

The Reflex

Ask a German financial institution why employees cannot use frontier models and the answer often arrives as a category, not an analysis: data protection, DORA, the cloud. Press for the article, the clause, the assessed risk, and the answer usually thins out into a policy written before the current tools, contracts, and supervisory posture existed.

The rules matter. DORA exists because finance depends on ICT systems in ways that can break markets. GDPR exists because client data deserves protection. The AI Act exists because capability without literacy creates operational exposure. The point is not to route around the rules. The point is to stop reading every rule as a wall.

That was the method. The deployment question was never "can we use this?" in the abstract. It was "what has to be true before a regulated institution can say yes and defend the decision later?" The answer was narrower, more concrete, and more operational than the reflex suggests.

1. The Vendor File Comes Before the First Prompt

DORA does not need to mention large language models. A frontier-model subscription or API is a digital service delivered through ICT systems. Once employees send prompts to a provider, the question for the financial entity is not whether the word "LLM" appears in the regulation. The question is whether the arrangement is governed as ICT third-party risk.

For a commercial frontier-model deployment, the file has to answer a small set of questions with documentary evidence: what service is being procured, where processing occurs, what data is retained, whether customer data is used for training, which certifications and contractual commitments back the claims, which sub-processors exist, and how the institution exits if the tool no longer fits the risk appetite.

The criticality classification is where most firms accidentally create their own problem. A firm-wide AI assistant for drafting, summarisation, coding, translation, and research support does not have to support a critical or important function. But the usage policy has to make that true. If employees quietly drift from drafting into trade execution, portfolio instruction, regulatory reporting, or client-specific advice, the classification will not survive contact with a supervisor.

This is also where the consumer-versus-commercial distinction stops being procurement trivia. Personal accounts and free tiers are the governance failure mode. Commercial tiers bring data-processing terms, administrative controls, audit logs, training-use restrictions, and the ability to attach a real vendor assessment. Shadow AI is not cheaper. It is simply unfiled risk.

The exit strategy for a non-critical productivity tool can be short: provider-agnostic workflows, no hard dependency in a regulated process, and at least 1 assessed alternative. Write it anyway. A register entry that proves the institution considered exit is worth more in an audit than a meeting-room assurance that everyone knew what they were doing.

2. Training Is a Legal Control

Most rollout plans treat training as adoption work. That is too soft. Since 2 February 2025, Article 4 of the EU AI Act has required providers and deployers to take measures to ensure an adequate level of AI literacy among staff and other people dealing with AI systems on their behalf. For regulated finance, that turns training into evidence.

The useful version is not a feature tour. It is a control surface. Employees need to know which data classes can go where, which tools are approved for which classes, which outputs require review, and which use cases are simply outside the deployment. That policy has to be short enough to remember and precise enough to enforce.

The second part is failure-mode literacy. A fluent model can invent citations, fabricate regulatory references, misread a table, or turn a probabilistic answer into the tone of a certainty. Showing employees those failures changes behaviour faster than another policy PDF. The person who has watched a model invent a BaFin circular is harder to impress and safer to equip.

The third part is lane discipline. Drafting, summarisation, code support, translation, and research preparation are different from unreviewed client communication, investment advice, regulatory filings, or anything touching market-abuse risk. Names matter. Owners matter. Boundary language matters.

3. Validate the Process, Not the Model

A frontier model will produce an error. That is not a residual risk to wish away. It is a system property to engineer around, the same way operational-risk frameworks never assumed humans were infallible either.

The regulated question is not "can the model be wrong?" It can. The useful question is: what stood between the output and the outside world? In this deployment, the line was simple: nothing generated by AI leaves the firm, or enters a regulated process, without a named human owner who reviewed it and is accountable for it.

The gate scales by consequence. Code suggestions go through pull request review. Internal memos stay with the author. Client-facing research, MiFID II material, MAR-sensitive content, or anything used in a regulated process requires a stronger review lane, including disclosure to the reviewer that AI contributed to the draft.

Logs close the loop. DORA third-party-risk governance is not satisfied by a policy that nobody checks. Commercial deployments provide administrative records. Turn them on. Review them. Compare actual usage against approved usage. Use the review to update the criticality decision, because that decision is living, not decorative.

The Posture

Every apparent blocker offered 2 easy exits. The first was to block the tool and call it prudence. The second was to ignore the rule and call it pragmatism. Both avoid the work. The institutional path is to take the rule seriously enough to satisfy it.

That path is slower at the start and faster everywhere after. The firm with the vendor file, literacy programme, output gates, logs, and quarterly review does not re-litigate frontier-model access every time a new release ships. It updates the file, revisits the classification, and moves.

The firm that blocked everything in 2023 may discover that employees never stopped using AI. They moved it to personal devices and personal accounts, outside the controls DORA would have asked for. The blanket ban did not remove the risk. It removed governance from a risk that was already happening.

1. 01 DORA is a specification, not a slogan. It asks financial entities to govern ICT third-party risk. A frontier-model provider can fit that frame if the institution does the work.
2. 02 Consumer AI is the failure mode. The risk is not that employees have access to capable models. The risk is that they use capable models through products the institution cannot assess, contract, log, or exit.
3. 03 AI literacy is a control. Training belongs in the evidence file because trained employees route data better, trust output less blindly, and understand where human judgement begins.
4. 04 The output gate is the liability gate. If the model drafted it, a named human still owns it before it leaves the firm or enters a regulated process.
5. 05 The advantage compounds. Institutions that can show their work will adopt faster because every new model is an update to a governance system, not a new war with compliance.

DORA, the AI Act, and GDPR do not say "no" to frontier models in regulated finance. They say: show your work. In this market, the institutions that learn to show their work fastest will be the ones that make regulation part of the moat.