Credit institutions, payment institutions, e-money institutions, investment firms, crypto-asset service providers, central counterparties, trading venues, insurance and reinsurance undertakings, insurance intermediaries, IORPs, credit rating agencies, crowdfunding service providers, securitisation repositories — and ICT third-party service providers serving any of the above. DORA has been applicable since 17 January 2025.

Yes. AI inference services that support, enable or contribute to a financial activity are ICT services under DORA Article 3(21). The financial entity must therefore flow through DORA Article 28-30 obligations to the AI vendor, including audit rights, exit strategy and incident reporting cooperation.

Yes. We provide ICT third-party agreements aligned with DORA Articles 28-30. Hardware sealing through Intel TDX directly evidences confidentiality and integrity. Per-request ECDSA attestation gives the financial entity a tamper-evident audit trail. Exit strategy is supported by open-weight base models and customer-encrypted LoRA adapters.

Our sub-processor list is limited to Targon (compute) and Chutes (TEE inference). Both EU-aligned, both substitutable. The hardware-sealing layer means the financial entity is not locked into any one provider — TDX attestation evidence is portable across compatible operators.

If we reach the thresholds set by the European Supervisory Authorities, yes — and in that case we would be subject to direct oversight by ESAs. The technical architecture (hardware sealing, EU jurisdiction, attestation) is already aligned with the obligations Article 31 designation would impose.