DORA Compliance Architecture for Energy AI Systems

Frequently Asked Questions

01.Does DORA apply to grid load forecasting AI at a bank?

Yes, if the model runs inside a financial entity in scope of DORA under Regulation EU 2022/2554 Article 2, such as a bank energy trading desk, an insurer underwriting grid assets, or an asset manager holding tokenized energy RWAs. The forecasting model is an ICT system supporting a critical function, so it falls inside the ICT risk management framework in Article 6, regardless of the fact that the underlying subject matter is a physical power grid.

02.Who owns DORA liability when a grid AI vendor is a third party?

The financial entity retains full liability under DORA even when the grid load forecasting model is built or hosted by an external vendor. Article 28 requires the financial entity to maintain a register of information for every ICT third-party arrangement and to run pre-contractual risk assessments. Article 30 requires exit strategies and audit rights to be written into the contract before go-live.

03.What has a real institution done before us in this space?

Ancilar has architected compliance controls for regulated tokenized asset issuance where identity and eligibility logic had to update in real time without redeploying contracts, the same pattern DORA Article 6 demands for ICT risk controls that must adapt without downtime. That MiCA Article 68 identity registry project is the closest documented proof point institutions can reference before committing budget to a grid AI compliance build.