The rules that reach the action.

Article 12(1) requires that high-risk systems technically allow the automatic recording of events — logs — over the system’s lifetime, and Article 12(2) requires that logging support the identification of risk situations, post-market monitoring under Article 72, and the deployer’s own monitoring under Article 26(5).

Article 26(2) requires deployers to assign human oversight to natural persons with the competence, training and authority to exercise it; Article 26(5) requires them to monitor operation and suspend use where risk appears; Article 26(6) requires automatically generated logs to be kept for at least six months.

Penalties run to EUR 35 million or 7% of worldwide annual turnover for prohibited practices (Article 99(3)), and to EUR 15 million or 3% for breaches of listed operator obligations, including Articles 16, 26 and 50 (Article 99(4)).

DORA does not mention AI by name; AI tooling a financial entity relies on falls to be assessed under its provisions on ICT services. Article 28(1)(a) puts the principle plainly: a financial entity using ICT services remains fully responsible, at all times, for discharging its own obligations under the regulation. Responsibility does not move to the vendor.

Article 28(3) requires a register of information covering all contractual arrangements with ICT third-party providers, distinguishing those supporting critical or important functions, reported annually to the competent authority. Article 30(2)–(3) prescribes what those contracts must contain, including — for critical or important functions — unrestricted access, inspection and audit rights and mandatory exit transition periods.

Articles 17–23 impose a unified reporting regime for major ICT incidents, and Articles 31 onwards place critical third-party providers under direct EU oversight.

The Duty is built around four outcomes — products and services, price and value, consumer understanding, and consumer support — with cross-cutting rules that apply across the whole relationship between the firm and the people it serves.

The rules do not distinguish an outcome produced by staff from one produced by software. The Duty applied to new and open products and services from 31 July 2023 and to closed books from 31 July 2024; both dates have passed, so it now applies across open and closed books alike.

The regime attaches accountability to named individuals. Six Individual Conduct Rules apply to staff, including rule 2 — due skill, care and diligence — and rule 6, added with the Consumer Duty and in effect since July 2023, which requires individuals to act to deliver good outcomes for retail consumers; senior managers carry four further conduct rules on top.

Accountability sits with the named senior manager for their area of responsibility, however the work inside it is done. An automated system does not move it.

The regime is being reformed: PS26/6 (21 April 2026) finalised phase-one changes that took effect in stages between 24 April and 1 September 2026, and a second phase depends on Treasury legislation, with further consultation expected later in 2026.

It applies to UK-incorporated banks, building societies and PRA-designated investment firms that hold internal model approval for regulatory capital — not to every UK bank.

It sets five principles: model identification and risk classification; governance; model development, implementation and use; independent model validation; and model risk mitigants. The principles apply to all models used to inform business decisions, in-house or vendor-supplied, regardless of technology; the sub-principles expressly include identifying and managing the risks of AI and machine learning in modelling, and allocate responsibility for the framework to the appropriate senior management function holder.

The framework’s core is four functions — govern, map, measure and manage — each broken into categories and subcategories, with govern designed as a cross-cutting function that informs the other three.

For an organisation using the framework to structure its AI risk work, govern is where the questions about authority over actions, and the records they leave, get answered.

The full text is purchased from ISO. This page cites the public catalogue record only, and gives no clause numbers for that reason.