Concept card

DORA Operational Resilience for SAP AI

As of 2026-07-24T14:00:00Z

Edited by Cédric-Olivier Mâry, sole editor and publication director — 27 years in the SAP ecosystem. How these pages are produced, and where automation is used.

What is DORA Operational Resilience for SAP AI?

DORA's incident-reporting clock is unforgiving for anything AI-adjacent — a major ICT incident requires initial notification within 4 hours of classification, an intermediate report within 72 hours, and a final report within one month.

What it is

The Digital Operational Resilience Act, known as DORA, Regulation (EU) 2022/2554, is the EU regulation that applies to financial-sector entities and requires them to run a comprehensive ICT risk-management framework, with specific obligations that reach directly into how AI and automated systems are built, tested, and operated. It has been fully applicable since January 2025. For anyone advising or delivering SAP analytics work inside banking, insurance, or investment management, DORA is the regulatory frame that determines how Joule agents, Datasphere pipelines, and other BTP-hosted AI components must be architected and governed — it is not an optional overlay on top of a normal SAP project, it is a binding constraint on the project itself.

Why it matters

Financial-sector operational failures increasingly originate in technology dependencies rather than in the traditional risks the sector was built to manage — third-party cloud providers, AI models that drift, and automated pipelines running without a human in the loop. A series of high-profile incidents across the sector — core-banking migration failures, AI model-drift events that went undetected until they had already affected customer-facing decisions, cloud-provider outages that froze payment processing — showed that ICT risk in financial services had outgrown the patchwork of national guidelines that previously governed it. DORA replaces that patchwork with a single, binding EU-wide regulation covering ICT risk management, incident reporting, resilience testing, third-party ICT risk, and information sharing.

How it works

Why it matters in practice

Named real incidents (TSB Bank's 2022 migration failure, Bank of Ireland's 2023 AI model drift) show DORA responds to failures that already happened, not hypothetical risk
Every BTP subaccount hosting AI workloads, Datasphere tenant feeding regulatory reporting, and Joule agent processing financial transactions must appear in the ICT asset register with risk classification and RTO
The 4-hour initial notification window for major incidents leaves little room to investigate before reporting to authorities

Key points

DORA (Regulation (EU) 2022/2554) fully applicable since 17 January 2025; applies to EU financial sector entities and their ICT third-party providers — including SAP BTP.
Five pillars: ICT Risk Management (Art. 5-15) · Incident Management and Reporting (Art. 17-23) · Resilience Testing (Art. 24-27) · Third-Party ICT Risk (Art. 28-44) · Information Sharing (Art. 45).
SAP BTP is an ICT third-party service provider under DORA for financial entities hosting AI workloads; verify DORA-aligned contractual clauses (audit rights, incident notification SLAs, subprocessor transparency) in BTP enterprise agreement.
AI-specific obligations: model accuracy threshold = ICT risk appetite; threshold breach = ICT incident; LLM concentration risk mitigated by BTP AI Core multi-model routing; decision rationale must be logged (not just output) for DORA audit trail.
Incident reporting SLAs: major ICT incident → 4h initial notification → 72h intermediate → 1 month final report to competent authority.
Resilience testing: adversarial input testing, data poisoning tests, and failover tests are required for AI systems in TLPT scope for significant entities.
Failsafe design: AI model unavailability must fail visibly (alert + manual fallback), not silently pass through incorrect outputs — the silent failure mode is the DORA non-compliance risk.
DORA Operational Resilience for SAP AI is mastered only when it changes a named buyer decision.
Start with the semantic contract and control model before demonstrating the tool.
Use current SAP, analyst, study, KG, and news signals as evidence, not decoration.

Terms used on this page

DORA (Digital Operational Resilience Act): EU Regulation 2022/2554, fully applicable since 17 January 2025. Mandates ICT risk management, incident reporting, resilience testing, third-party ICT risk, and information sharing for EU financial sector entities.
ICT Third-Party Risk (Art. 28–44): DORA pillar requiring financial entities to maintain a register of all ICT third-party service providers (including SAP BTP), assess concentration risk, and ensure contractual DORA alignment including exit plans.
TLPT (Threat-Led Penetration Testing): DORA Art. 26 requirement for significant financial entities: intelligence-led penetration testing of live production systems, including AI-targeted attack scenarios, conducted by certified external testers.
ICT Asset Register: Mandatory inventory under DORA Art. 8 listing all ICT assets (including BTP subaccounts, Datasphere tenants, Joule agents) with risk classification, data sensitivity, and RTO/RPO.
Model Risk (under DORA): DORA treats AI model accuracy degradation below documented thresholds as a materialised ICT risk event, triggering incident management obligations — not merely an operational quality issue.
Significant Entity (DORA): Financial entities designated as significant by their national competent authority (typically large banks, major insurers, payment system operators). Subject to TLPT and stricter oversight requirements.
RTO/RPO: Recovery Time Objective (maximum acceptable system downtime) and Recovery Point Objective (maximum acceptable data loss). Must be documented per DORA Art. 11 for critical ICT systems including AI workloads.
Decision owner: The accountable person who accepts the trade-off and funds the next action.

Sources

Full card available to members. What the full card adds: the full decision framework · the SAP vs Snowflake / Databricks / Fabric comparison · the common pitfalls and their fix · the cheat sheet · the architecture schemas · the code blocks · the facts worth quoting.

Open in the app →