Financial sector compliance: GDPR, AI Act, DORA & NIS2

Why the 'Financial Sector' is concerned

What unites the financial sector is its status as a financial entity within the meaning of DORA and the intensity of the resulting digital obligations. All these entities rely on critical information systems and depend on ICT providers, which DORA has regulated since 17 January 2025.

AI is a structural element here and is often high-risk: individual credit scoring (banking), risk assessment and life/health underwriting (insurance), as well as anti-fraud and anti-money laundering. The GDPR governs particularly sensitive processing activities, from KYC to profiling.

DORA — the common denominator

All financial entities are subject to DORA: ICT risk management, incident management and reporting, resilience testing, third-party ICT provider management via an information register, and information sharing. It is the sector's pivotal regulation.

Proportionality adjusts obligations according to size and risk profile.

Key obligations

• ICT risk management framework.
• Notification of major ICT incidents.
• Resilience testing (including TLPT for significant entities).
• ICT providers information register.

AI Act — use cases that are often high-risk

The sector concentrates several high-risk use cases: credit scoring of natural persons, and risk assessment and pricing in life and health insurance. Fraud detection is explicitly excluded from this classification. High-risk obligations (data quality, oversight, documentation) apply.

Key obligations

• Classifying uses (scoring, pricing = high risk).
• Data quality and bias control.
• Human oversight and information.
• Documentation and compliance assessment.

GDPR — sensitive processing activities

KYC, anti-money laundering, scoring, profiling and, in insurance, health data: the financial sector processes high-stakes personal data. Details are provided in the 'Banking' and 'Insurance' pages.

Key obligations

• Legal bases and information requirements (profiling, automated decisions).
• Security and retention periods.
• Governance of sensitive data (health data in insurance).

NIS2 — residual

The financial sector falls within the scope of NIS2, but DORA takes precedence as the sector-specific regulation for ICT risk and incidents. NIS2 plays only a residual role; both frameworks must be coordinated without duplication.

Key obligations

• Acknowledging DORA's prevalence for ICT risk.
• Ensuring consistency of measures.
• Coordinating notifications.

Comparative overview of regulations

How these regulations interact

The financial sector illustrates two key articulations. NIS2 / DORA: DORA, as a sector-specific text, prevails for ICT risk and incidents; NIS2 is residual. GDPR / AI Act: high-risk use cases (scoring, pricing) combine personal data and high-risk systems and must be addressed jointly.

Application timeline

• 1DORA. Applicable from 17 January 2025 for all financial entities.
• 2GDPR. In force.
• 3AI Act. High risk: From 2 August 2026 (scoring, pricing).
• 4NIS2. Residual, DORA prevailing for ICT risk.

Applicable penalties

Regimes accumulate: GDPR (€20M / 4%), AI Act (€35M / 7%), DORA (prudential regime), NIS2 (€10M / 2%, residual). The sector is also subject to the prudential supervision of its authorities.

The risk is as much prudential and systemic as it is financial: a resilience failure can trigger regulatory measures and a loss of confidence.

Compliance roadmap

• 1Structuring resilience (DORA). Building the ICT framework, incident management, testing and the third-party provider register.
• 2Mastering high-risk AI. Identify scoring and pricing, deploy high-risk obligations.
• 3Securing GDPR processing activities. Govern KYC, profiling, automated decisions, and sensitive data.
• 4Articulate NIS2. Handle the residual without duplicating DORA.
• 5Deep-dive by vertical. Refer to the 'Banking' and 'Insurance' pages.

How Data Comply One supports the sector

Data Comply One covers GDPR, AI Act, NIS2, and DORA on a single platform, with outsourced DPO and CISO — covering the full spectrum of the financial sector. The integrated approach facilitates the NIS2/DORA articulation and the joint GDPR/AI Act treatment.

DCO offers templates tailored to financial entities (ICT third-party provider information register, incident procedures, AI Act documentation).

Frequently asked questions