MiFID II and DORA: AI Compliance for Financial Services

Financial services firms are among the heaviest adopters of AI — from algorithmic trading to credit scoring to client advisory. But MiFID II and the Digital Operational Resilience Act (DORA) impose specific requirements on how these AI-assisted decisions must be governed.

MiFID II: Suitability and Best Execution

MiFID II requires financial advisors to ensure that investment recommendations are suitable for each client. When AI generates recommendations, firms must document:

• The AI model used and its version
• The input data and client profile considered
• The recommendation generated
• The human review and any modifications
• The rationale for the final decision

DORA: Operational Resilience

DORA, which took effect in January 2025, requires financial entities to manage ICT risk comprehensively. For AI systems, this includes:

• Model governance and change management procedures
• Ongoing monitoring of AI system performance
• Incident reporting when AI systems produce anomalous outputs
• Third-party risk management for AI vendors

The Compliance Framework

Building a compliant AI governance framework for financial services requires three pillars:

1. Decision Audit Trail: Every AI-assisted decision must be recorded with full context
2. Model Governance: AI models must be versioned, tested, and monitored
3. Explainability: Clients and regulators must be able to understand why a decision was made

Firms that build these capabilities now will be positioned to meet both current regulations and the incoming EU AI Act requirements for the financial sector.