KNF and DORA requirements for AI are the rules under which a bank, an insurer or a fund management company (TFI) must manage the risk of AI tools just like any other ICT service: with a contract, a register of providers, an exit plan and evidence for the supervisor. Since 17 January 2025 the basis has been the EU DORA Regulation, which replaced Recommendation D and the KNF IT guidelines. On 22 July 2026 UKNF added recommendations on Frontier AI models, and from 2 December 2027 AI that assesses the creditworthiness of natural persons must meet the requirements for high-risk systems
AI supervision in finance does not rest on a single act. It consists of four layers:
Regulation 2022/2554 has applied since 17 January 2025. From that day Recommendation D and the KNF IT guidelines for insurers, fund management companies, investment firms and market infrastructure ceased to apply, and UKNF withdrew its cloud communication
An AI model used through an API or in the cloud must be entered in the register of information on ICT contractual arrangements. The contract must contain the clauses of Art. 30 DORA, and critical functions also need an exit strategy
UKNF expects institutions to include AI-enabled attacks in risk analysis and testing, assess how providers manage AI risk and limit dependence on a single ICT and AI provider. What counts is evidence, not procedures alone
AI for creditworthiness assessment of natural persons and for risk assessment and pricing in life and health insurance is high-risk. From 2 December 2027 it requires human oversight and a fundamental rights impact assessment
DORA applies, and Recommendation D, the KNF IT guidelines and the cloud communication no longer apply. ICT and AI policies are now based on DORA
DORA Art. 64; KNF resolutions 6-8/2025The number of ICT third-party providers, including the operators of the largest clouds on which AI models run, that the European Supervisory Authorities designated as critical on 18 November 2025 and now oversee directly
DORA Art. 31For the initial notification of a major ICT incident from its classification, and no later than 24 hours after detection. A data leak through an AI tool can also be such an incident
DORA Art. 19; Reg. 2025/301 Art. 5The DORA Regulation applies directly, and Recommendation D and the KNF IT guidelines cease to apply
In its priorities for 2026 UKNF states that it will itself analyse institutions’ reports and documents with the help of AI
UKNF publishes recommendations on the impact of Frontier AI models on the cybersecurity of the financial sector
The Commission for the Development and Security of Artificial Intelligence, which includes a member designated by KNF, can inspect the application of the AI Act
AI Act obligations for creditworthiness assessment of natural persons and pricing of life and health insurance
A contract with the clauses of Art. 30 DORA, an entry in the register of information, a concentration risk assessment and an exit strategy. Customer data goes to the provider’s infrastructure, so you need to know where it is processed and how long it is stored
The model, including a Polish one such as Bielik, runs in the bank’s or insurer’s server room. Customer data does not leave the institution, and leaving the model provider does not stop work. The software provider is still a third party, so the contract and the register remain
customer data sent to an external model when AI runs in the institution’s infrastructure. This is a simpler answer to the supervisor’s questions about data location and dependence on a single provider
Two questions, and the result is a calendar of obligations for your institution: what already applies and what is coming. The tool runs in the browser and sends nothing
Choose the type of institution and how you use AI - the calendar of obligations will appear immediately
The supervisor asks for evidence, not declarations. Seven areas in which AI must leave a trail:
Every provider of an AI model or service as an entry in the register, with critical functions marked (Art. 28(3) DORA)
Data location, audit rights, incident reporting, rules for ending the arrangement (Art. 30)
What happens when the model stops working or the provider changes the terms, e.g. switching to a local model (Art. 28(8))
Who used which model, when and with what data, in a record that cannot be changed. This is the basis for incident analysis (Art. 13 and 19)
AI-enabled attack scenarios in digital operational resilience testing, in line with the UKNF recommendations (Art. 24-27)
In creditworthiness assessment and insurance pricing, a competent person who can stop or change the result, and a fundamental rights impact assessment (Art. 26 and 27 AI Act)
The management body is responsible for ICT risk and regularly updates its knowledge, and staff know the rules for using AI (Art. 5 DORA, Art. 4 AI Act)
WORM register, model access policies, personal data masking
AI in the institution’s server room or air-gap, ISO/IEC 27001 and ISO 22301 certificates
AI deployment step by step, with documents to show the supervisor
We will show you the AI usage log the supervisor asks about
This page discusses what the regulations mean for the use of AI and is not legal advice
Yes. An AI model used through an API, in the cloud or as part of software is an ICT service. The institution enters the provider in the register of information and signs a contract with the clauses of Art. 30, and where AI supports a critical function it also prepares an exit strategy
No. KNF repealed it with effect from 17 January 2025, together with the IT guidelines for insurers, fund management companies, investment firms and market infrastructure, and UKNF withdrew its cloud communication. DORA has taken their place
Yes, if it is at least a medium-sized enterprise, but DORA takes precedence in ICT risk management and incident reporting. From the KSC Act a bank applies, among others, the provisions on entry in the register of essential and important entities
The regulations do not ban any specific tool. Each one, including an AI chat, does however require a contract with DORA clauses, an entry in the register of information and a risk assessment. An employee’s private account does not meet these conditions, so a tool approved by the institution is needed, such as TWIN:DESK from the SAIE ecosystem
Yes, if it assesses natural persons. From 2 December 2027 the bank must ensure human oversight, monitor how the system works and assess its impact on fundamental rights before deployment. The same applies to pricing of life and health insurance
KNF supervises institutions, including on DORA and ICT risk. From 28 October 2026 the application of the AI Act can be inspected by KRiBSI, which includes a member designated by KNF
https://www.allclouds.pl/en/wiedza/wytyczne-knf-dora-a-ai/
