EIOPA Urges DORA and AI Act Implementation Over New Rules to Manage AI Systemic Risk

Key Takeaways

• EIOPA's Eurofi article finds that AI adoption in European insurance is outpacing risk controls, and that systemic cyber, concentration, and third-party dependency risks are growing.
• It argues the EU needs rigorous implementation of DORA and the AI Act, not a new layer of AI regulation for finance.
• Compliance teams should expect supervisors to focus on dependency mapping, failure testing, and exit-plan validation.

Deep Dive

EIOPA's Eurofi article finds that AI adoption in European insurance is outpacing risk controls, and that systemic cyber, concentration, and third-party dependency risks are growing. It argues the EU needs rigorous implementation of DORA and the AI Act, not a new layer of AI regulation for finance. Compliance teams should expect supervisors to focus on dependency mapping, failure testing, and exit-plan validation.

The article's main message is that existing frameworks are sufficient if enforced. DORA covers ICT risk management, testing, incident reporting, contractual safeguards, concentration risk, exit strategies, and oversight of critical ICT third-party providers. The AI Act adds requirements for AI systems and general-purpose AI (GPAI) model providers, including additional obligations for models presenting systemic risk. EIOPA acknowledges that these frameworks do not explicitly address correlated model behavior, common dependencies across models and integrators, or simultaneous AI-driven market reactions, but says they enable supervisors to address them. The ESAs also endorsed the ESRB's warning on systemic cyber risk from frontier AI models, which can identify and exploit high-severity vulnerabilities very quickly. They encouraged financial entities to strengthen cybersecurity and to improve detection and response speed. Advanced AI may also make cyber risk harder to model with traditional actuarial approaches.

No new deadlines are set. The only timeline is the Cloud and AI Development Act (CADA) goal of tripling EU data-centre capacity within five to seven years. CADA, the AI Continent agenda, and the Technological Sovereignty Package are supply-side measures. They would also create an EU-wide framework for assessing cloud and AI sovereignty. EIOPA cautions that sovereignty is not the same as resilience: replacing a few non-EU providers with a few EU providers leaves concentration risk largely unchanged. Competition, interoperability, and portability remain essential.

Recommended actions for compliance teams:
- Map material AI, cloud, and model dependencies, including fourth-party and integrator relationships, and align them with the DORA register of information.
- Test provider and model failure scenarios and verify that exit plans work in practice.
- Update cyber resilience, detection, and response capabilities for AI-enabled threats such as automated fraud and social engineering.
- Retain human expertise, fallback capacity, and sufficient provider diversity, and avoid single-model reliance in critical processes.
- Confirm AI Act readiness, including provider obligations and use-case classification.
- Improve information-sharing with peers and supervisors, and review cyber risk models for AI-driven threat dynamics.
- Monitor CADA and sovereignty developments, but do not treat sovereign sourcing as a substitute for diversification.

The direct regulatory burden is low, but supervisory scrutiny is likely to rise. Firms with concentrated AI or cloud dependencies, untested exit strategies, or weak AI governance face the greatest exposure. Because EIOPA rejects new legislation, enforcement and supervisory findings under existing rules are the most probable consequence of weak preparation.

Source: European Insurance and Occupational Pensions Authority