DORA, the EU AI Act and FCA Consumer Duty: What Every Financial Services Leader Needs to Know
Three major regulations are now shaping how financial services firms can use AI. Most leaders know they exist. Fewer have asked the harder question: are we actually ready to meet them today, not in theory?
17 January 2025
The date DORA became law across every EU financial entity
What is DORA?
DORA stands for the Digital Operational Resilience Act. It is an EU law that came into force on 17 January 2025. It applies to banks, insurers, investment firms and the technology providers that support them.
In plain terms, it requires firms to prove they can keep critical systems running, manage ICT risks continuously, and respond properly when things go wrong. It is not a one-off audit. It is an ongoing operational obligation.
What does DORA actually require from your team?
Under DORA, firms must demonstrate continuous ICT risk management, classify and report incidents, and maintain oversight of third-party technology providers.
That sounds like a compliance task. In practice it is a people and programme challenge.
Only 1 in 4 UK financial services firms have a clear internal owner for operational resilience at senior leadership level. Most have the framework on paper. Far fewer have the right person to run it, with the authority and the team to make it work.
What is the EU AI Act?
The EU AI Act is an EU regulation that classifies AI systems by level of risk. For financial services, the most important category is high-risk, which includes AI used in credit scoring, insurance underwriting and fraud detection.
High-risk AI systems must have documented human oversight, clear audit trails and named accountability at senior level. Obligations are already being phased in, with requirements tightening as programmes go live.
What does the EU AI Act mean for credit, underwriting and fraud teams?
If your firm uses AI to make or inform credit, underwriting or fraud decisions, the obligations are already being phased in. The time to prepare is now.
The requirements are specific: a named person accountable for the AI's outputs, documented human oversight at each decision point, and an audit trail that holds up to regulatory scrutiny.
The AI model being excellent is not the question. If the governance around it is missing, the firm is non-compliant, regardless of how well the model performs.
The people who can set this up, model risk managers with AI knowledge and governance leads who understand both innovation and FCA compliance, are already scarce. The firms ahead started hiring for these roles 12 to 18 months before they needed them.
Alongside DORA and the EU AI Act, there is a third obligation that is already live for every FCA-regulated firm using AI: Consumer Duty.
Workforce Readiness for AI in Financial Services
Get the Whitepaper and Score Your Organisation
What is FCA Consumer Duty?
FCA Consumer Duty is a regulation from the UK's Financial Conduct Authority. It requires firms to demonstrate that their products and services deliver good outcomes for customers.
For firms using AI in pricing, claims or lending decisions, this means proving those decisions are fair, not just stating they are. Accountability sits with named individuals inside the firm.
What does FCA Consumer Duty mean for AI-assisted decisions?
Consumer Duty requires firms to prove that AI-assisted pricing and claims decisions are fair. Not assumed fair. Evidenced on request, with a named individual accountable for the outputs.
In many firms, that individual has not been formally appointed. If the FCA investigates, they ask for a name and a paper trail. Firms that cannot produce both have a governance gap, not a technology problem.
Four practical steps for senior leaders
- Name the individual accountable for DORA, EU AI Act and Consumer Duty, and confirm they have authority, team and capacity to act
- Check whether your compliance and change functions are resourced for what you have committed to deliver, not what you delivered last year
- Map the specialist roles your programme needs against what you actually have in place
- Ask honestly: if an FCA audit arrived tomorrow, could we produce the right name and the right documentation?
The organisations already ahead of this did not have more resource. They just asked these questions earlier, and built the capability before the pressure arrived.
Workforce Readiness for AI in Financial Services
If this raises questions about your own position, the full whitepaper goes further.
It covers the Execution Readiness Diagnostic, scorecard, readiness profiles and seven strategic questions.
Frequently Asked Questions
What is DORA in financial services?
DORA is the EU Digital Operational Resilience Act. It came into force on 17 January 2025. It requires banks, insurers and other financial entities to prove they can manage ICT risks continuously, respond to incidents and oversee their technology providers, on an ongoing basis, not just at audit time.
Which AI systems does the EU AI Act classify as high-risk?
AI used in credit scoring, insurance underwriting and fraud detection is classified as high-risk. These systems must have documented human oversight, audit trails and named senior accountability, with obligations already being phased in.
What does FCA Consumer Duty require for AI-assisted decisions?
Firms must be able to demonstrate that AI-assisted pricing and claims decisions are fair. That means a named accountable individual and a documented evidence trail, available on request from the FCA.
How do I know if my organisation is ready for these obligations?
Hydrogen Group's Execution Readiness Diagnostic, included in the full whitepaper, helps senior leaders assess readiness across five dimensions: strategic clarity, delivery capacity, specialist capability, AI governance and leadership alignment.
--------------------
We're committed to enabling our clients and candidates to thrive in a constantly changing world. By helping businesses grow and supporting people in leading more fulfilling lives both at work and beyond, we aim to make a lasting impact. Our ultimate goal is to become the world’s most valued and trusted workforce solutions company, trusted by our people, our clients and our communities.
Our latest insights
