Finance & Insurance

By producing the evidence continuously rather than ahead of the inspection. DORA has applied since 17 January 2025 and expects three things kept current: the register of ICT providers, down to subcontractors and dependency chains, the incident log, and continuity tests genuinely replayed. We feed those artefacts from your systems, so the register reflects the real estate rather than a spreadsheet rebuilt from memory. Threat-led penetration testing, required of entities designated as significant, stays with independent external testers: we prepare the scope and the scenarios, we do not sign off the test.

The timing has moved. Regulation 2026/1744 of 24 July 2026 pushed the obligations for high-risk systems to 2 December 2027, and to 2 August 2028 for AI embedded in an already regulated product. Credit scoring for lending decisions clearly falls in that category ; fraud detection does not automatically, as it depends on what the decision produces for the person concerned. That extra time is for building the technical documentation, the robustness testing and the decision trail while the models run, not for picking the subject back up in 2027. Our founder Anis Zouaoui set out that method at La Matinale IT for Business in April 2026, alongside EY, Salesforce and Informatica.

The right question is not model latency but the decision window of your payment chain, network hops and enrichment included. We start from that window and size the inference to sit inside it with headroom, plugged into the message bus you already run. Two things matter as much as speed: a fallback to business rules when a model becomes unavailable, so an inference outage never stops a payment, and the false positive rate measured before and after, because a fast model that blocks legitimate customers costs more than the fraud it prevents.

By sorting before hosting. We first classify data by what it exposes, then route accordingly: sensitive data stays inside your perimeter or on qualified cloud, the rest can go through an external model under a processing agreement with guaranteed data residency. An open-weights model operated on your own infrastructure already covers a large share of internal use cases. That breakdown matters for DORA too: it is what makes an exit strategy credible, and an exit only becomes real on the day it has been rehearsed.

Since 9 October 2025, every payment service provider in the euro area must check that the payee name matches the IBAN, on both standard and instant transfers, and without charging for it. The check does not block the payment: it returns three outcomes, exact match, close match or no match, and your journey decides what happens next. That is where the real work sits: wording the alert so it gets read, calibrating the close-match threshold, and handling false positives on trading names, which are the first volume to absorb.

Framing takes 2 to 6 weeks depending on scope and the level of compliance required. A first version tested by a group of advisers follows in 4 to 10 weeks, depending on the quality of your document base, which is almost always the deciding factor. Rolling out across the network, with governance and training, runs to 3 to 6 months. These ranges are the ones we apply everywhere, and each comes with what makes it vary: a duration announced without its variable only exists to be exceeded.