In application
DORA: Operational resilience rules in application
ICT risk, the third-party register, incident reports and testing.
Financial Services
AI and platforms that stand up to supervisory scrutiny.
We work with banks, insurers, funds and fund administrators and payment firms. That means AI whose output a supervisor can follow, integration that leaves the core stable, and operations planned around DORA from the first design choice.
For banks, insurers, funds and payment firms in Ireland, working under EU supervisory rules and the Irish AI Act 2026.
17 January 2025
DORA in application
Financial entities must manage ICT risk, keep a register of ICT third parties, report incidents and test their resilience.
10 July 2027
AML Regulation in application
A single EU rulebook for customer due diligence replaces national rules, with AMLA as the new EU authority.
2 December 2027
High-risk AI rules reach lending and insurance
Credit scoring of individuals and risk pricing in life and health insurance count as high-risk; the date follows the 2026 amendment of the Act.
What is shifting for Irish financial firms
Resilience has become a legal obligation
Under DORA, operational resilience is a list of concrete duties: manage ICT risk, record every ICT third-party arrangement in a register, classify and report incidents, and test regularly. Your cloud and AI suppliers now sit inside what a supervisor looks at.
Every AI decision needs evidence behind it
The AI Act treats credit scoring and insurance pricing as high-risk. In Ireland, S.I. No. 366 of 2025, as amended by S.I. No. 405 of 2026, gives the Central Bank of Ireland a role as sector market surveillance authority. Model risk management must now cover machine-learning and generative models, with documentation, monitoring and human oversight scaled to the impact.
Customers judge you against the best app on their phone
Instant payments, payee name checks and open banking have made people expect speed and clarity. The payment services rules now on the way will ask more of fraud prevention and of API quality.
The core still carries decades of rules
Mainframes and core platforms continue to keep the books. Change happens around them, through APIs and events, so that stability and regulatory reporting are never put at stake.
Where firms get stuck, and what we build
- The challenge
Onboarding and KYC refreshes rely on analysts reading every document themselves.
What we doDocument intelligence pulls out and checks identity, beneficial ownership and source-of-funds evidence. Analysts look at the cases that are flagged, and each check is logged for audit and for the incoming EU AML rulebook.
- The challenge
To answer one customer question, advisers and service staff open five systems.
What we doAn assistant that respects access rights and searches products, policies and procedures, cites where each answer came from and records what it displayed, so the advice file has no gaps.
- The challenge
Any change to the core takes months, costs a lot and carries risk.
What we doCore functions are made available through APIs and event streams, then moved out one at a time, with reconciliation in place until the old route can be switched off.
- The challenge
The DORA register of information and the incident process sit in spreadsheets.
What we doWe put the register, incident classification and reporting steps into your service management and cloud tools, each linked to the critical or important function it supports.
- The challenge
A model nobody can explain will not get through validation.
What we doWe agree an evaluation framework with your risk and validation teams: test sets, explanations where the decision calls for them, drift monitoring and a human override that is written down.
- The challenge
Each quarter, someone reconciles the regulatory returns by hand.
What we doPipelines with recorded lineage and automatic quality checks, built along the BCBS 239 principles, so every reported figure leads back to its source.
A reference landscape with controls first
AI sits between the channels and the core, every consequential step passes an approval gate, and the DORA controls cover each layer.
Illustrative example
AI services talk to the core only via the integration layer, and the DORA controls cover each component.
Read the diagram as text
Customers, advisers and service staff reach the firm through the app, the website, branches and the contact centre.
Three AI services sit behind those channels: document intake for onboarding and KYC, an assistant for advisers and service staff, and an approval step by an analyst that each consequential decision goes through.
These AI services connect to the core only via an integration layer made of APIs and event streams. Behind it are core banking or policy administration, the CRM and service platform, and a data platform that records lineage.
The DORA controls run beside every layer: ICT risk management, the register of ICT third parties, classification and reporting of incidents, and resilience testing. Model risk management registers, validates and monitors each model.
Sign-off before anything happens
AI drafts, extracts and proposes. A named member of staff decides on credit, claims or restrictions on an account.
Explanation planned in from the start
For each type of decision we settle how much explanation it needs while designing, not in the weeks before validation.
Exit routes and concentration risk
Cloud and model providers are selected with a written exit plan and a substitute in mind, ready for your register.
Logs that serve as evidence
We keep inputs, outputs, model versions and approvals, so an auditor or supervisor can rebuild any single case.
Key dates for banks, insurers, funds and payment firms
Each date changes what your suppliers have to be able to show. Guidelines and technical standards from national supervisors and the European supervisory authorities come on top.
In application
AI Act: Bans take effect, AI literacy expected of staff
In application
AMLA: The EU Anti-Money Laundering Authority begins work
It prepares the single rulebook and its own supervision of selected institutions.
In application
Instant Payments Regulation: Payee name checked on every euro transfer
Before a transfer is executed, payment service providers in the euro area confirm the name of the payee.
In application
AI Act: Transparency duties in application
People have to be told when an AI system is dealing with them.
Position at 2 October 2026
Upcoming
AML Regulation: The single EU rulebook takes effect
Due diligence, beneficial ownership and record keeping follow the same rules everywhere in the EU.
Upcoming
AI Act: Duties for high-risk AI in application
Covers credit scoring of individuals and risk pricing in life and health insurance, following the 2026 amendment.
Upcoming
AMLA: AMLA starts supervising selected institutions itself
Rules and standards at a glance
The legal texts that shape most AI and platform projects at banks, insurers, funds and payment firms, and the effect each one has on delivery.
Use this overview to prepare planning discussions; it is not legal or regulatory advice. Dates checked on 2 October 2026.
- DORAScopeEU-wide
Since 17 January 2025 the Digital Operational Resilience Act has applied to banks, insurers, investment firms, payment institutions and other financial entities. It sets rules for ICT risk management, incident reporting, resilience testing and ICT third-party risk, and lists the clauses a contract with an ICT provider must contain (Article 30).
What changes for your programmeAs your ICT supplier we help you meet these duties: the contract clauses, incident notices, exit plans, our part in testing and the details your register asks for.
SourceRegulation (EU) 2022/2554, EUR-Lex (opens external site)
- EU AI ActScopeEU-wide
AI that assesses whether an individual is creditworthy, or that prices life and health insurance by risk, is high-risk. Providers and deployers need risk management, data governance, logs, human oversight and documentation, from 2 December 2027 under the Act as amended in 2026. Ireland gave the Act national effect through the Regulation of Artificial Intelligence Act 2026. The AI Office of Ireland coordinates, and the Central Bank of Ireland is one of the sector market surveillance authorities.
What changes for your programmeEach use case is classified at the start, human oversight is designed into the workflow and the documentation is written to slot into your model risk framework.
SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)
- EU AML package (AMLR and AMLA)ScopeEU-wide
From 10 July 2027 the Anti-Money Laundering Regulation sets one EU rulebook for customer due diligence in place of national rules. AMLA, the new EU authority, coordinates the national supervisors and will supervise a selection of high-risk institutions itself.
What changes for your programmeOnboarding and periodic reviews need the same handling of evidence and a full audit trail every time. Our document intake and case workflows are designed to that level.
SourceRegulation (EU) 2024/1624, EUR-Lex (opens external site)
- GDPR and automated decisionsScopeEU-wide
Under Article 22 a person may refuse to be subject to a decision taken by automated processing alone when it affects them significantly. The exceptions demand safeguards, among them human intervention and a right to contest. In Ireland the Data Protection Commission supervises, under the Data Protection Act 2018.
What changes for your programmeOur processes let a member of staff review an automated outcome, explain it and change it, and the system records that this happened.
SourceRegulation (EU) 2016/679, EUR-Lex (opens external site)
- MiFID II and IDD advice recordsScopeEU-wide
When firms advise on investments or distribute insurance, they must assess suitability or demands and needs and keep a record of the advice. Once AI helps the adviser, its output belongs in that record.
What changes for your programmeThe assistant keeps a log of what it showed and which sources it drew on, so the advice file is complete and can be reviewed later.
- PSD2 and the next payment services rulesScopeEU-wide
Today PSD2 governs payment services and access for open banking. PSD3 and the Payment Services Regulation, which reached provisional agreement in 2025, will replace it after a transition and raise the bar on fraud prevention and API performance.
What changes for your programmeAn API platform built today should expect tighter duties on performance, monitoring and the sharing of fraud data.
SourceDirective (EU) 2015/2366, EUR-Lex (opens external site)
Example use cases (illustrative)
Illustrative exampleKYC refresh at a fund administrator
Identity and ownership documents read and compared; compliance analysts take the call on each flagged case.
Knowledge assistant for advisers
Answers on products, policies and procedures, each with its source and limited to what the adviser may see.
Sorting and routing complaints
Each complaint tagged by subject and urgency, sent on with a draft summary, and its response deadline tracked.
Claims intake at an insurer
Claim forms, invoices and reports read and checked against the policy; the claims handler signs off the payment.
A payment firm’s core opened up through APIs
Mainframe transactions offered as documented APIs and events, so new channels no longer wait for overnight batch files.
Platforms we use in financial services
Salesforce
Summit PartnerWorkspaces for advisers, onboarding journeys and customer service, linked to the core and to document intake.
SAP
Gold PartnerFinance and group reporting, with SAP data passed to risk and regulatory reporting and its lineage recorded.
The partner levels shown are FromNine’s own. Product names belong to their owners as trademarks.
Ireland
Irish firms, EU rulebooks
Many financial firms in Ireland are the Irish operation of an international group, so a supervisor in Ireland and a group function abroad may both ask for the same evidence. DORA, the AI Act and the AML package are EU law; the AI Act already has its Irish implementing law, the Regulation of Artificial Intelligence Act 2026, and S.I. No. 366 of 2025, as amended by S.I. No. 405 of 2026, names the Central Bank of Ireland among the sector market surveillance authorities.
Our delivery produces each piece of evidence once and keeps it current as the system changes: architecture and model documentation, logs, test results and exit plans, ready to show whoever asks for them.
- DORADigital Operational Resilience Act, Regulation (EU) 2022/2554 (opens external site)
- EU AI ActArtificial Intelligence Act, Regulation (EU) 2024/1689 (opens external site)
- Regulation of Artificial Intelligence Act 2026Regulation of Artificial Intelligence Act 2026, with the AI Office of Ireland as central coordinating authority (opens external site)
- AML RegulationAnti-Money Laundering Regulation (EU) 2024/1624 (single rulebook), with AMLA (opens external site)
- GDPRGeneral Data Protection Regulation (EU) 2016/679 (opens external site)
Questions we are often asked
As an ICT supplier, how do you help with our DORA duties?
We sign up to the contract terms DORA asks for, report incidents through the channel we agree with you, write down exit plans, join your resilience tests and give you what your register of ICT third parties needs. In Ireland, the Central Bank of Ireland supervises the financial entities it regulates under DORA and receives their reports of major ICT-related incidents; our evidence is built for that supervision.
May we use AI in lending or underwriting decisions?
Yes, but the AI Act treats it as high-risk, so risk management, data governance, logs, human oversight and documentation are required. In Ireland the Central Bank of Ireland is one of the sector market surveillance authorities for the AI Act. We design the process so a member of staff takes the decision and can explain it, within the GDPR safeguards on automated decisions.
Where are the models and the data hosted?
Wherever your risk appetite permits: in your own cloud tenancy, in an EU region of a public cloud, or on your own premises for sensitive workloads. The data is hosted in the EU, and each model and hosting choice is written up with an exit option for your third-party register.
Will we need a new core platform?
Usually not. We integrate first and modernise step by step: APIs and events around the core, functions moved out only where the business case holds, and reconciliation running until the old route is closed.
How do you test generative AI used in a regulated process?
Before go-live we agree test sets and quality thresholds with your risk and validation teams. After go-live we monitor, and output the system is unsure about goes to a person for review. We start from the assumption that some answers will be wrong and send those to staff.
Talk through your next financial-services project
Bringing AI into onboarding, advice or claims, or getting your systems ready for DORA resilience testing? Speak to engineers who design for supervisors and users alike.