DORA and the EU AI Act for AI agents
DORA already applies to financial entities, and the EU AI Act’s high-risk duties apply from December 2027. Both ask
the same thing of an AI agent: show that it is under control, and keep the evidence.
EU AI Act: what a deployer must do
Regulation (EU) 2024/1689 · Article 26
Applies to most high-risk systems (Annex III) from 2 December 2027, and to high-risk AI in regulated products (Annex I) from 2 August 2028, under the Digital Omnibus on AI.
- Use a high-risk system as its instructions say
- Give human oversight to people with the competence, training and authority to use it
- Monitor how the system runs, and report serious incidents
- Keep the logs it generates for at least six months
Where Coalex fits: routing to named reviewers, a record of every decision, and retention you set.
DORA: what a financial entity must do
Regulation (EU) 2022/2554
In application since 17 January 2025.
- Run an ICT risk-management framework that covers every ICT system, agents included
- Classify and report major ICT-related incidents
- Test digital operational resilience
- Manage ICT third-party risk, and keep a register of those arrangements
Where Coalex fits: a control on every agent action, and records your incident and audit teams can use.
Next: What Legal and Risk will ask, Human oversight for AI agents, AI clauses in supplier contracts
15 minutes with an expert
Bring one agent. We go through which obligations apply to it, and what evidence each one needs. Or write to onboarding@coalex.ai.