On 2 August 2026 the general application date of the EU AI Act arrives and the Commission's enforcement powers over general-purpose AI providers become live. For every EU buyer with an ICT supplier that embeds generative AI, the third-party register needs a new column. This page is the buyer-side audit — the three questions to answer this month, the DORA Article 28 intersection for financial services, and the ESRB frontier-AI cyber warning that sits on top.
Regulation (EU) 2024/1689 — the EU AI Act — entered into force on 1 August 2024. Article 113 stages the application of its provisions. The prohibited-practices articles have applied since 2 February 2025. The obligations on providers of general-purpose AI models (Chapter V) have applied to new models placed on the market since 2 August 2025. The remainder of the Regulation, including the high-risk system regime, the market surveillance framework, and the penalty regime, enters full application on 2 August 2026.
Three practical shifts happen on that date for European buyers. First, the Commission's AI Office moves from a supervisory-preparation posture to full enforcement powers over GPAI providers under Chapter IX — investigations, requests for information, evaluations, and, ultimately, penalties. Second, the Article 50 transparency obligations on providers of generative AI systems, deployers of emotion-recognition and biometric-categorisation systems, deployers of deep-fake and public-interest AI-generated text bind. Machine-readable output marking, disclosure to natural persons interacting with AI, and disclosure of AI-generated content on matters of public interest are no longer aspirations. Third, the penalty regime under Articles 99 to 101 is fully operative: up to EUR 35 million or 7% of worldwide annual turnover for infringements of the prohibited-practices articles, up to EUR 15 million or 3% of turnover for other provider, importer, distributor, deployer, notified-body, or representative infringements, and up to EUR 15 million or 3% of turnover for GPAI-specific infringements under Article 101.
For buyers, the consequence is that the AI dependency in the supply chain — until now a diligence question — is a supervisory question. If an ICT supplier embeds GPAI in the delivered service, the buyer's Register of Information and DORA Article 30 contractual arrangements need to reflect it before the enforcement clock crosses zero.
Every buyer with EU regulatory exposure should be able to answer three questions about its supplier portfolio before 2 August 2026. The answers do not need to be perfect. They do need to exist in the register.
How to answer: issue a targeted supplier attestation — one page, ten fields — covering (a) whether AI is embedded in any component of the delivered service, (b) whether any embedded component is a general-purpose AI model as defined in Article 3(63), (c) whether any component is classified as a high-risk AI system under Annex III (biometric identification, critical infrastructure, employment, essential private services, law enforcement, migration and border control, administration of justice), and (d) the supplier's role — provider, deployer, importer, distributor. Cross-reference the attestation against the supplier's own public statements, product documentation, and the AI Office's public list of GPAI models with systemic risk. Where the supplier is a downstream deployer of a third-party GPAI, capture the identity of the upstream provider — the sub-processor chain visibility problem you already have under DORA Article 30(2)(a) now extends to the AI supplier chain.
How to answer: for every supplier that answers "yes" to Question 1, request and file (a) the machine-readable output marking specification the supplier has implemented for generative AI outputs, (b) the training-data summary where the supplier is a GPAI provider under Article 53(1)(d), (c) the copyright policy required under Article 53(1)(c), (d) the disclosure protocols for AI interactions with natural persons, and (e) any deep-fake or public-interest content disclosure text where the supplier is a deployer. If the supplier is redistributing a GPAI from an upstream provider, capture the upstream provider's documentation trail as well. A supplier that cannot produce these documents within 30 days of request is a documented finding, not a shrug.
How to answer: add three fields to every supplier record — AI embedded (yes/no), AI Act classification (GPAI / high-risk / limited-risk / minimal-risk), and Article 50 documentation status (received / pending / not applicable). For financial entities in scope of DORA, these fields should extend the ESAs ITS Register of Information template as internal columns; the ITS taxonomy does not yet mandate AI fields, but supervisory reviews will ask, and a register that surfaces the answer without a manual re-crawl is materially stronger than one that does not. Date every field, name an owner, and route material changes through the same three-lines-of-defence sign-off chain you already use for critical-or-important arrangements.
For a financial entity in scope of DORA — Regulation (EU) 2022/2554, applicable since 17 January 2025 — the intersection with the AI Act is not academic. It is the same supplier, the same contract, the same supervisory desk. Four practical points where the two frameworks meet.
(a) The Register of Information. DORA Article 28(3) requires a maintained register of all ICT third-party contractual arrangements, in the ESAs Joint Committee Implementing Technical Standards template. The template does not yet include an AI-embedding sub-flag. From 2 August 2026, a defensible register nevertheless needs to identify — in an internal column, a supplementary attestation register, or both — which ICT arrangements involve AI, whether the AI is GPAI, and whether any component is high-risk under Annex III. Supervisory teams at the Central Bank of Ireland, BaFin, De Nederlandsche Bank, ACPR, and CSSF have signalled the AI-supplier chain will be a review topic during 2026-2027 cycles.
(b) Article 30(2) baseline contractual clauses. DORA Article 30(2) requires every ICT contract to include a clear description of functions and services, locations of performance and data processing, data availability and integrity provisions, incident-assistance obligations, cooperation-with-authorities clauses, and termination rights. For an AI-embedded ICT service, the "clear description" must now name the AI capability and its role. For a GPAI-embedded service, the description must also identify the GPAI model in operation, its provider, and the mechanism by which changes to the underlying model are notified. Where the supplier is a deployer of a third-party GPAI, the sub-outsourcing consent regime under Article 30(2)(a) applies to changes in the upstream AI provider.
(c) Article 30(3) enhanced clauses for critical-or-important functions. DORA Article 30(3) layers on quantitative and qualitative service-level targets, reporting, business contingency, ICT security, Threat-Led Penetration Testing participation, and unrestricted audit rights. For an AI-embedded critical-or-important ICT service, the enhanced clauses must reconcile with AI Act Article 50 transparency — the buyer's Article 30(3)(e) audit right must reach the AI-marking, training-data-summary, and copyright-policy documentation the supplier holds under Article 53(1). Contracts pre-dating 2 August 2026 that omit the intersection are the most common gap.
(d) Concentration risk under Article 29. DORA Article 29 requires financial entities to assess concentration risk across ICT third-party arrangements. The AI supply chain is highly concentrated — a small number of foundation-model providers underpin a very large share of downstream GPAI. The concentration-risk assessment that already identifies shared cloud Tier-2 dependencies must now identify shared upstream GPAI-provider dependencies. The concentration-risk report to the management body should surface that view.
On 25 June 2026 the European Systemic Risk Board (ESRB) adopted a warning on systemic cyber risks from frontier artificial intelligence models. The warning was released publicly on 7 July 2026 with cross-authority backing from all three European Supervisory Authorities — the European Banking Authority, the European Securities and Markets Authority, and the European Insurance and Occupational Pensions Authority. It is the first coordinated ESA position on frontier AI as a source of systemic financial risk.
The risk the ESRB identifies is that frontier AI models — the most capable general-purpose systems on the market — can independently discover software vulnerabilities and run autonomous cyber-attacks at speed and scale against financial infrastructure and its supply chain. The threat is not future-tense: the ESRB positioned it as an active supervisory concern for 2026. Financial entities flagged by their Joint Supervisory Team owe an action plan by 31 October 2026 setting out how the firm identifies, monitors, and mitigates its exposure to autonomous AI-driven attacks in its own environment and across its third-party estate.
The practical read for buyers is that AI capability in the supplier chain now has two supervisory frames sitting on the same page. The AI Act asks: are your suppliers on the right side of Article 50, and is the GPAI in your chain compliant with Chapter V? The ESRB warning asks: does your ICT supplier chain resist an autonomous adversary that has read the code? DORA Articles 24 to 26 (digital operational resilience testing, including Threat-Led Penetration Testing) is the joining tissue. Buyers with a critical-or-important AI-embedded ICT supplier should expect Threat-Led Penetration Testing scoping conversations to include the AI attack surface. The action plan due 31 October 2026 for flagged firms will read badly if the supplier register has no AI column, no Article 50 documentation status, and no line of sight to the frontier-model upstream provider.
FiorLab is a supplier risk intelligence platform purpose-built for regulated EU buyers. It is not an AI Act compliance tool for AI providers. It is the buyer-side workflow — the register, the evidence chain, the audit-ready output — that makes the AI Act supplier audit a byproduct of business-as-usual vendor management rather than a two-week war-room the week before enforcement lands.
Three ways the platform supports the audit today. Six-dimension scoring includes a compliance dimension, evaluated against regulatory framework mapping that already covers DORA Article 28, EBA outsourcing (with CBI, BaFin, DNB, ACPR, CSSF national variants), GxP, MiFID II, and CSRD. Article 50 transparency documentation, GPAI-provider status, and Annex III classification attach to the supplier record as evidence items and score through the same 5-tier verification multiplier (registry_verified 1.0x through self_declared 0.65x). A supplier that returns a supplier attestation with signed Article 50 documentation scores materially higher than one that returns a self-declaration.
Registry-verified evidence chain. FiorLab verifies suppliers live against CRO Ireland, UK Companies House, German Handelsregister, VIES, and GLEIF, and cross-references declared ISO certifications against the IAF CertSearch global accredited-body database. Every score traces to a registry record, certification body lookup, or OCR-verified document with a timestamp. The evidence chain is the same one a National Competent Authority accepts under DORA Article 28(3); adding Article 50 documentation items to the same chain extends the pattern.
Audit-ready PDF report. One click produces a supplier assessment report suitable for the supervisory file — six-dimension scores, verification level per dimension, staleness decay, cross-reference integrity checks, and the full evidence chain. For financial entities in scope of DORA, the report sits alongside the ESAs ITS Register of Information export.
An optional AI-exposure sub-flag on the ICT dimension — a first-class register field for AI embedded / GPAI in use / Annex III classification / Article 50 documentation status — is on the 60-90 day roadmap. The regulatory radar drives priority; today the fields can be captured on the supplier record and referenced in the audit trail.
Regulation (EU) 2024/1689 — the EU AI Act — entered into force on 1 August 2024. Article 113 stages application: prohibited practices from 2 February 2025, obligations on providers of general-purpose AI (GPAI) models from 2 August 2025, and general application of the remainder of the Regulation from 2 August 2026. From 2 August 2026 the Commission's AI Office has full enforcement powers over GPAI providers, national market surveillance authorities enforce the rules on downstream AI system providers and deployers, and the penalty regime under Articles 99–101 is fully operative. For GPAI-specific infringements the ceiling under Article 101 is up to EUR 15,000,000 or 3% of the provider's total worldwide annual turnover in the preceding financial year, whichever is higher.
Article 50 imposes transparency obligations on providers and deployers of certain AI systems. Providers of AI systems intended to interact directly with natural persons must design them so the person is informed they are interacting with AI unless obvious from context. Providers of generative AI systems (including GPAI systems) must ensure outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. Deployers of emotion-recognition and biometric-categorisation systems must inform natural persons of the operation. Deployers of AI systems generating deep fakes must disclose that the content has been artificially generated or manipulated. Deployers publishing AI-generated text on matters of public interest must disclose it unless human-reviewed and under human editorial responsibility. Providers of GPAI models have additional documentation, copyright-policy, and training-data-summary obligations under Chapter V.
For financial entities in scope of DORA Regulation (EU) 2022/2554, ICT third-party suppliers that embed GPAI in delivered services now sit inside two frameworks simultaneously. DORA Article 28(3) requires a maintained Register of Information for all ICT third-party arrangements; from 2 August 2026 a defensible register needs to identify which contractual arrangements involve AI, whether the AI is a high-risk system under the AI Act Annex III, and whether GPAI models are used in the supply chain. DORA Article 30(2) baseline contract clauses interact with Article 50 transparency obligations — the buyer's duty to know how the service works, and the supplier's duty to mark and document AI output, must be reconciled contractually. National competent authorities (Central Bank of Ireland, BaFin, DNB, ACPR, CSSF) have signalled the AI-supplier chain will be a supervisory focus during the DORA review cycle.
The European Systemic Risk Board issued a warning dated 25 June 2026, publicly released with cross-ESA backing on 7 July 2026, on systemic cyber risks from frontier AI models. All three European Supervisory Authorities (EBA, ESMA, EIOPA) supported the warning. The risk identified is that frontier AI models can discover software vulnerabilities and run autonomous cyber-attacks against financial infrastructure and its supply chain. Financial entities flagged by their Joint Supervisory Team owe an action plan by 31 October 2026. Buyers should read this alongside DORA Articles 24–26 (threat-led penetration testing) and Article 28 (ICT third-party risk): the AI-supplier chain, and any AI capability embedded in an ICT supplier's own operations, now sits on the same supervisory desk as the rest of the ICT risk framework.
The primary penalty risk under the AI Act sits with the provider or deployer that has committed the infringement, not automatically with the downstream buyer. Article 99 sets penalty ceilings for infringements of the prohibited-practices articles at up to EUR 35,000,000 or 7% of worldwide annual turnover. Article 99 also sets ceilings up to EUR 15,000,000 or 3% of turnover for non-compliance with obligations by providers, importers, distributors, deployers, notified bodies, and authorised representatives. Article 101 sets GPAI-specific fines up to EUR 15,000,000 or 3% of turnover. The indirect risk to the buyer is real: a GPAI provider suspended by the Commission, or a downstream AI system provider fined and forced to withdraw, becomes a business continuity, DORA Article 28 concentration-risk, and exit-strategy problem the buyer must have documented in advance.
Practical fields to add to the third-party register per arrangement: (1) does the supplier embed AI in the delivered service, yes / no; (2) if yes, is any component classified as high-risk under the AI Act Annex III (e.g. biometric identification, critical infrastructure, employment, essential private services, law enforcement, migration, administration of justice); (3) is any GPAI model used, and if so is it identified in the AI Office public list of GPAI models with systemic risk; (4) has the supplier provided Article 50 transparency documentation, including the training-data summary where applicable and the copyright policy; (5) is the marking of AI-generated output implemented; (6) date of last supplier attestation. FiorLab is scoping an optional AI-exposure sub-flag on the ICT dimension as part of the 60-90 day roadmap; today the fields can be captured in the supplier record and referenced in the audit trail.
We built FiorLab for the buyer sitting between three regulators and a supplier who will not answer the phone. The AI Act does not change that shape — it adds a column to the register and a paragraph to the contract. What it does change is the size of the fine at the far end of the chain, and the number of supervisory desks with a live interest in your Article 28 register. If you are wondering how the AI Act supplier audit maps onto your operating model — funds, insurers, payment firms, fintech, or any regulated EU entity with ICT dependencies — we are happy to talk it through. Write to us at hello@fiorlab.com.
— Word from our founder
DORA is enforced across all 27 EU states · EBA Outsourcing Guidelines apply · AI Act general application 2 August 2026. Six-dimension scoring with live EU registry verification, audit-ready PDF from day one, EU-hosted, customer-owns-data.
Start Your Assessment