Banking sector compliance: GDPR, AI Act, NIS2 & DORA

Why the 'Banking' sector is concerned

The bank processes personal data at large scale and for sensitive purposes: customer due diligence (KYC), credit granting, fraud detection, and anti-money laundering. These processing activities require maximum GDPR rigour, particularly since scoring and profiling produce decisions with a direct impact on individuals.

The use of AI is a structural factor here. The assessment of individual creditworthiness by an AI system is among the high-risk use cases under the AI Act, carrying the most demanding obligations. Other use cases (fraud detection, conversational assistants) fall under lighter regulatory regimes.

In terms of resilience, banks are subject to both NIS2 (essential sector) and DORA. In practice, DORA constitutes the lex specialis for ICT risk management and incident notification for financial entities: it structures the framework, with NIS2 applying on a residual basis.

DORA — digital operational resilience

DORA imposes a comprehensive framework on banks: ICT risk management, incident management and reporting, resilience testing (including threat-led penetration testing for significant entities), management of risks arising from third-party ICT providers via an information register, and cyber threat information sharing.

It is the pivotal text for digital banking compliance since 17 January 2025.

Key obligations

• ICT risk management framework steered by senior management.
• Classification and notification of major ICT incidents.
• Resilience testing programme (including TLPT for significant entities).
• ICT provider information register and contractual governance.

AI Act — high-risk credit scoring

The assessment of creditworthiness and the establishment of credit scores for natural persons are expressly classified among high-risk uses (with the exception of fraud detection). The banks concerned bear significant obligations: risk management, data quality, transparency, human oversight, and documentation.

Other uses (chatbots, internal automation) most often fall under limited or minimal risk.

Key obligations

• Classifying AI systems (credit scoring = high risk).
• Data quality and representativeness, bias management.
• Human oversight and information for individuals.
• Technical documentation and conformity assessment.

GDPR — KYC, scoring and anti-fraud

The bank is the data controller for high-stakes processing purposes: KYC/AML, credit granting, scoring, and fraud detection. Profiling and automated decision-making call for particular vigilance (information obligations, right to human intervention).

The legal basis, retention period and security must be managed with precision, within a framework where banking secrecy is layered on top of GDPR.

Key obligations

• Legal basis and enhanced information notice for profiling.
• Governance of automated decisions (human intervention).
• Tailored retention periods (credit, AML-CFT).
• High-level security and traceability.

NIS2 — essential sector, articulated with DORA

Banking is among the essential sectors under NIS2. However, for ICT risk management and incident notification, DORA prevails as the specific sectoral regulation. NIS2 retains residual scope, and understanding the interplay between the two texts is essential to avoid duplication.

Key obligations

• Understanding the NIS2 / DORA interplay (DORA prevails for ICT).
• Security measures consistent with DORA.
• Coordination of incident response mechanisms.

Comparative overview of regulations

How these regulations interact

The key issue for a bank is the articulation between NIS2 and DORA. Both target cybersecurity, but DORA, as sector-specific legislation, takes precedence for ICT risk management and incident notification by financial entities. In practice, a bank structures its resilience around DORA and applies NIS2 only residually, without duplicating arrangements.

Furthermore, the scoring AI creates a GDPR / AI Act overlap: a credit score relies on personal data (legal basis, information, right to human intervention under the GDPR) and constitutes a high-risk system (data quality, oversight, documentation under the AI Act). Both sets of requirements must be addressed jointly.

Application timeline

• 1DORA. Applicable since 17 January 2025.
• 2GDPR. In force; regular checks on profiling and scoring.
• 3AI Act. High risk: Main obligations from 2 August 2026 for credit scoring.
• 4NIS2. Applicable on a residual basis, DORA prevailing for ICT risk.

Applicable penalties

The regimes are cumulative. GDPR exposes organisations to €20M or 4% of global turnover, the AI Act to €35M or 7%. DORA falls under a prudential regime: competent authorities have supervisory and sanctioning powers, and a critical ICT provider may be subject to periodic penalty payments. NIS2 provides for up to €10M or 2% for essential entities, but its application is residual in the banking sector.

Beyond fines, the stakes are prudential and reputational: a major resilience incident can trigger supervisory authority measures and an immediate loss of trust.

Compliance roadmap

• 1Structuring resilience around DORA. Build the ICT risk management framework, incident classification and testing programme, articulating NIS2 on a residual basis.
• 2Mastering high-risk AI. Identify credit scoring systems and deploy risk management, data quality controls, oversight, and documentation.
• 3Securing sensitive GDPR processing activities. Govern profiling, automated decisions, retention periods, and security for KYC, credit, and fraud use cases.
• 4Manage ICT providers. Maintain the information register and govern service providers contractually (DORA clauses).
• 5Steer at management level. Embed resilience and compliance at board level, in line with prudential requirements.

How Data Comply One supports the sector

Data Comply One covers GDPR, AI Act, NIS2 and DORA on a single platform, with outsourced DPO and CISO — the full spectrum of banking regulatory requirements. The integrated approach streamlines the NIS2/DORA interface and the joint management of GDPR/AI Act overlap in scoring use cases.

DCO provides templates tailored to financial entities (ICT provider information register, incident procedures, AI Act documentation for scoring).

Frequently asked questions