How financial institutions manage AI supply chain risk under DORA — third-party AI vendor obligations, model provenance requirements, AI SBOM for banking, operational resilience testing for AI dependencies, and the specific evidence artefacts regulators expect.
Traditional financial services third-party risk management was built for a world where dependencies were bounded and auditable: a cloud provider, a payment processor, a market data vendor. The security team could enumerate every third party, classify their risk tier, review their SOC2 reports annually, and conduct periodic on-site assessments. The supply chain was a list you could manage.
AI supply chain risk is different in kind, not just degree. A large language model's supply chain includes: the base model weights (trained on data from thousands of unverifiable sources), the fine-tuning datasets (which may contain manipulated examples planted to create specific behaviors), the orchestration framework (an open-source package with hundreds of transitive dependencies), the vector database (which stores semantic representations of confidential financial data), the retrieval connectors (which bridge the AI to internal systems), and the plugins used by autonomous agents (each with its own permission scope and supply chain). Any compromise in any component can affect AI behavior in ways that traditional security tools cannot detect, at a speed that outpaces traditional incident response timelines.
DORA, the EU Digital Operational Resilience Act, reflects regulatory recognition of this reality. Its supply chain provisions — Articles 28-30 — were written with AI's interconnected dependency ecosystem in mind, even if the specific word "AI" doesn't appear in every article. The complete financial services regulatory compliance guide: AI Security for Financial Services: LLM Compliance Guide →
DORA's ICT third-party risk management provisions apply to every technology provider that the financial entity is dependent on for its operations. In 2026, this explicitly includes AI model providers, vector database vendors, AI orchestration framework providers, and any SaaS platform that delivers AI capabilities. The EBA, ESMA, and EIOPA's joint guidelines on ICT third-party risk management (published under DORA) confirm that AI providers are in scope.
Article 28 — ICT Third-Party Risk Policy: Financial entities must maintain a policy for managing ICT third-party risk that covers the full lifecycle of the relationship: pre-engagement risk assessment, contractual requirements, ongoing monitoring, and exit planning. For AI providers, this policy must specifically address: how AI model behavior will be validated before deployment (HexTyx pre-deployment scan as the validation mechanism), how ongoing behavioral monitoring will detect changes in the provider's model (Aegis runtime monitoring + calibration loop), and how the financial entity will exit the relationship if the provider fails to meet security or compliance requirements (model version rollback procedure, alternative provider evaluation).
Article 29 — Contractual Provisions for ICT Third-Party Service Providers: Every contract with an ICT third-party provider must include specific provisions. For AI providers, mandatory contractual provisions include: data processing scope (what data the provider can process and for what purposes), no-training attestation (customer data not used to train foundation models), audit rights (the financial entity's right to audit the provider's AI security practices), incident notification (the provider must notify the financial entity of security incidents affecting the AI services within defined timeframes), and business continuity (the provider must maintain BCP/DR for AI inference services with defined RTO/RPO).
For the Anthropic API (used for AXIOM, the LLM evaluator, and the Playground proxy in AIZA-HexTyx), verify the commercial agreement includes all Article 29 provisions. The no-training attestation and data processing scope are available in Anthropic's enterprise agreement. Audit rights may require negotiation for smaller financial entities — include this in procurement.
Article 30 — Register of ICT Third-Party Service Providers: Financial entities must maintain a register of all ICT third-party providers. The AI SBOM (AI Software Bill of Materials) is the AI-specific implementation of the DORA Article 30 register. Structure the AI SBOM to satisfy Article 30 requirements: provider name, service description, criticality classification, DPA status, last security assessment date, exit plan reference, and concentration risk assessment (whether the same provider is used across multiple critical AI functions). The AI supply chain security guide covering SBOM construction: AI Supply Chain Security: Protecting Models, Plugins, Dependencies →
Financial institutions deploying AI are increasingly dependent on a small number of foundation model providers — OpenAI, Anthropic, Google, Mistral, and a handful of others. This concentration creates systemic risk: a security incident, service disruption, or regulatory action affecting one of these providers simultaneously impacts every financial institution using that provider. DORA's concentration risk provisions (Article 29(4)) require financial entities to assess and mitigate this concentration.
The AI-specific concentration risk assessment for a financial institution deploying the Anthropic API across multiple AI functions should document: which AI functions are dependent on Anthropic API specifically (list all applications), what the financial impact would be if the API became unavailable for 1 hour / 1 day / 1 week, what alternative model providers are available for each function (and what re-testing would be required to switch), and what the minimum viable AI capability would be if the provider relationship terminated. This assessment is part of the DORA Article 30 register entry for each AI provider.
Model provenance validation for financial AI: Financial institutions face a specific model provenance challenge that other industries don't: any AI model used to generate trading signals, produce risk assessments, or automate financial decisions is subject to the MiFID II requirement that firms understand the models they use. "Understanding the model" for AI means: knowing its training data sources, its known failure modes, its adversarial resilience (documented through HexTyx scan output), and its behavioral characteristics under market stress conditions. Model provenance documentation for financial AI must include all of these — not just the vendor's marketing documentation.
DORA Article 25 requires financial entities to conduct threat-led penetration testing (TLPT) on critical ICT systems. The EBA's TIBER-EU framework, adapted for DORA compliance, is the primary methodology for TLPT in EU financial services. AI systems that support critical banking functions — fraud detection, credit decision support, algorithmic trading — are in scope for TLPT.
TLPT for AI systems must go beyond traditional application penetration testing because AI attack surfaces include semantic and behavioral dimensions that traditional pentests don't cover. DORA TLPT for AI should include:
Prompt injection attack simulation: Systematic adversarial testing across all user-facing AI input surfaces, all RAG retrieval pipelines, and all inter-agent communication channels. HexTyx's 21-category scan with the full 6-strategy mutation engine covers this requirement. The TLPT evidence package: HexTyx PDF report + SARIF + MITRE ATT&CK Navigator layer, generated by POST /reports/generate.
Supply chain compromise simulation: Red team exercises that simulate a compromised model API response, a poisoned dependency update, and adversarial content in a retrieved data source. These scenarios test whether the financial institution's runtime controls (Aegis CP1-CP5) would detect and contain the compromise before it affected financial operations.
Operational resilience testing: DORA requires that entities test their ability to continue critical functions during ICT disruptions. For AI-dependent functions, this means: testing the fallback to non-AI processing when the AI service is unavailable, testing the rollback to a previous model version when the current version fails validation, and testing the Dead Man's Switch (DMS) behavior when the Aegis monitoring service is disrupted. The agentic runtime governance guide covering DMS architecture: AI Autonomous Agentic Runtime Governance: Complete Enterprise Control Guide →
Financial institutions conducting AI vendor due diligence in 2026 should require the following from every AI provider before production deployment:
Security evidence:
DORA-specific requirements:
The DORA, MiFID II, FCA, and SEC regulatory evidence guide: AI Compliance in Financial Services: DORA, MiFID II, FCA and SEC Requirements →
The AI SBOM — adapted for financial services — must satisfy DORA Article 30 register requirements while also meeting the more granular documentation requirements of SR 11-7 (for US operations), the FCA's operational resilience requirements, and internal MRM committee governance. A financially-calibrated AI SBOM has five sections:
Section 1 — Foundation Models: Provider name, model name and version string, API endpoint, DPA execution date, no-training attestation date, last security test date (HexTyx scan ID), SR 11-7 model approval status (for US operations), and criticality tier (which financial functions depend on this model).
Section 2 — Orchestration Frameworks: Package name, version hash (not semantic version — hash), last vulnerability scan date (Dependabot/Snyk), last behavioral test (HexTyx scan after last package upgrade), known security issues and mitigation status.
Section 3 — Vector Databases and Storage: Database name and version, deployment type (self-hosted or managed cloud), data classification of indexed content, tenant isolation architecture, encryption configuration, last access control review date.
Section 4 — Plugins and Agent Tools: Tool name, version, permissions granted (read/write/execute scope), last security review, DORA criticality classification, exit plan (alternative tool if this plugin is compromised or discontinued).
Section 5 — Data Sources (RAG and Training): Source name, source type, data classification, last validation date, provenance documentation, contractual basis for use, and whether the source is shared with any other AI systems (concentration risk).
The SOC2 evidence generation guide that produces the technical artefacts for the SBOM's security sections: SOC2 for AI Products: Practical Guide for LLM Platforms →
Run a HexTyx scan and generate the complete DORA Article 25 TLPT evidence package — adversarial validation report, MITRE ATT&CK Navigator layer, supply chain risk assessment, and calibration history for your MRM committee and regulators.
Generate DORA AI Evidence Package →