New: AI Workspace – Secure AI for Organizations With Sensitive Data. Learn more.
AI Governance under DORA: What Matters Most
Which AI model you use is only half the question. Just as important is how you govern its use in daily work: with clear policies, the right infrastructure, and effective controls.
For DORA-regulated financial institutions, the risk is not AI itself, but uncontrolled AI use without clear data flows, logging, vendor oversight, and internal governance.
Myra AI Workspace addresses exactly this point: as a central, controlled AI work environment for organizations with high requirements for data protection, traceability, and European infrastructure.
Learn more about Myra AI WorkspacePricing: from 13 Euro per user per month, excl. VAT
Features and monthly usage allowance vary by plan; Agents and Workflows are available as premium features.
Why AI Becomes an ICT Risk Issue Under DORA
DORA, the Digital Operational Resilience Act (Regulation (EU) 2022/2554), has applied since January 17, 2025, and requires financial entities to manage their digital operational resilience systematically. This includes, among other things, ICT risk management, incident reporting, digital operational resilience testing, and the management of ICT third-party risk. In addition, there is the voluntary sharing of cyber threat information.
AI systems become relevant for financial institutions when they are used as an ICT service, productivity tool, knowledge system, analytics tool, or integration component. This applies not only to large AI projects but also to everyday use cases: text generation, research, internal documentation, contract analysis, coding support, customer service preparation, or compliance work.
If an AI workspace is procured as a cloud service from an external provider, it is generally an ICT service provided by an ICT third-party service provider. The contractual arrangement must then be included in the register of information under Article 28(3) DORA.
For DORA-regulated organizations, the question is therefore not just whether AI creates value. The central question is:
How can AI be used productively without losing control over data, vendors, models, logging, and regulatory evidence?
The Problem: Uncontrolled AI Use Creates New Risks
Many financial institutions face a practical tension: Business units want to use AI to research faster, create content, evaluate regulatory material, or support internal processes. At the same time, sensitive data must not end up in external systems without control.
Typical risks arise primarily when employees use public or unapproved AI tools.
Sensitive Data in Prompts
Prompts can contain personal data, customer data, internal contract information, risk assessments, security details, technical documentation, or trade secrets. Without safeguards, such information can end up in systems that have not been approved for this purpose.
The Myra AI Adoption Report 2026 shows that this is not a theoretical risk: 30% of surveyed AI users have already processed contracts with AI, 25% personal data, and 23% financial data. 15% state that they have processed explicitly confidential data or data not approved for AI use. At senior management levels, these shares are often significantly above average.
Shadow AI Through Freely Available AI Tools
If organizations do not provide a controlled alternative, employees often turn to freely available services. This creates a blind spot for compliance, IT security, and data protection.
The Myra AI Adoption Report 2026 quantifies this behavior: At 41%, private accounts are the most frequently cited access route for work-related AI use, and 34% use freely accessible services without an account. Even at C-level, 52% work with a private account.
Unclear ICT Third‑Party Risks
AI services can consist of multiple components: model providers, API services, cloud infrastructure, data processing, logging, integrations, and potentially subcontractors. DORA-regulated organizations must assess and manage these dependencies.
Lack of Auditability
When AI use is decentralized and unlogged, it is hardly possible to trace afterward which tools were used, which data was processed, and which organizational controls were in place.
Limited Digital Sovereignty
For regulated organizations, jurisdiction, infrastructure, vendor structure, and data processing are increasingly becoming procurement criteria. Especially with AI, it is not enough to focus only on features and model quality.
What Secure AI Use in the Financial Sector Must Deliver
An AI solution for DORA-regulated financial institutions should do more than provide powerful models. It must be embedded in a controlled operating framework.
Key requirements include:
Central provisioning: Employees use AI through an approved work environment instead of shadow IT.
Controlled data flows: Organizations know which data is processed where.
PII protection: Personal data can be detected and masked before it is passed to models.
Model governance: Administrators can define which models and providers may be used.
Audit logs: Usage, model access, and relevant activities are traceable.
Cost control: Usage and costs can be monitored centrally.
European infrastructure: Operations and data processing meet high requirements for sovereignty and jurisdiction.
Enforceable data residency: Requests to models outside the EU can be blocked technically, not just by policy.
Integration into governance processes: AI use can be integrated into existing ICT, data protection, security, and procurement processes.
Exit capability: Data can be fully exported in open formats at the end of the contract.
Human oversight: AI outputs are reviewed before they are used in critical processes.
Which AI Use Is Acceptable for DORA‑Regulated Organizations?
The following traffic light indicator helps classify typical AI usage scenarios. It does not replace a legal or regulatory assessment, but it shows where central governance controls are required.
Public AI tools used with customer data, contract data, risk assessments, or internal security information
🔴
High risk due to uncontrolled data sharing, missing logging, and unclear third-party relationships.
Freely available AI tools without central approval, policies, role model, or audit logs
🔴
Shadow IT complicates data protection, information security, evidence, and ICT risk management.
Enterprise AI access with a contractual basis, but without consistent data classification or prompt protection
🟡
Better than consumer tools, but of limited reliability for sensitive content.
Central AI workspace with roles, model governance, guardrails, audit logs, and cost control
🟡
Suitable as a controlled entry point, provided organizational processes and internal policies are properly integrated.
Central AI workspace with PII masking, audit logs, EU infrastructure, and the option of sovereign-operated models
🟢
Strong approach for organizations with high requirements for data protection, governance, traceability, and digital sovereignty.
AI use in business-critical decisions without expert review, risk assessment, or human oversight
🔴
Critical AI applications require additional governance, validation, documentation, and approval processes.
Public AI tools used with customer data, contract data, risk assessments, or internal security information
🔴
Freely available AI tools without central approval, policies, role model, or audit logs
🔴
Enterprise AI access with a contractual basis, but without consistent data classification or prompt protection
🟡
Central AI workspace with roles, model governance, guardrails, audit logs, and cost control
🟡
Central AI workspace with PII masking, audit logs, EU infrastructure, and the option of sovereign-operated models
🟢
AI use in business-critical decisions without expert review, risk assessment, or human oversight
🔴
Bottom line: DORA-regulated financial institutions should neither ban AI across the board nor allow it without oversight. The viable path is a controlled, auditable, privacy-focused AI work environment.
Myra AI Workspace: Controlled AI Use for Organizations With Sensitive Data
Myra AI Workspace is a central AI work environment for organizations that want to use generative AI productively without losing control over data, models, and governance.
The platform supports employees in everyday tasks such as research, writing, analysis, summarization, knowledge preparation, and documentation. At the same time, organizations gain technical and administrative controls for secure AI operations.
Chat workspace for employees
Model selection from approved providers
Privacy layer with PII masking
Privacy pill in chat with visible masking status
Request logs and tamper-evident audit log (cryptographic hash chain)
Per-user cost reporting and enforceable budgets
Projects with knowledge base
File import and document generation
MCP connectors to business systems
Agents for reusable AI assistants (depending on plan)
Workflows for multi-step automation (depending on plan)
EU models operated by Myra, integration of self-hosted models, and on-premises option
External models behind a privacy layer
EU region routing: model requests outside the EU are blocked technically
Protection against prompt injection and jailbreaks
SIEM integration (including Splunk, Elasticsearch, OpenSearch, Syslog)
Single sign-on (OIDC, SAML) and SCIM provisioning
Four-eyes approval for changes to agents and the prompt library
Configurable retention periods and full exit export in open formats
Labeling of AI-generated content in line with the EU AI Act
Particularly relevant for financial institutions: The workspace separates employees’ productive AI use from uncontrolled tool use. This creates a defined framework for data processing, model access, and organizational control.
How Myra AI Workspace Supports DORA‑Relevant Requirements
Myra AI Workspace does not automatically make a financial institution DORA-compliant. Regulatory responsibility remains with the respective institution. However, the platform can provide important technical and organizational building blocks that support controlled AI use in a DORA context.
ICT risk management
AI tools are used in a decentralized way without consistent assessment.
A central workspace provides defined, manageable AI access.
ICT third-party risk management
Different AI providers are used without review or as shadow IT.
Administrators provide approved models and providers. A subprocessor register in the Myra Trust Center supports documentation.
Exit strategies (Art. 28(8) DORA)
Data and configurations are locked in to one provider.
Full tenant export in open formats (JSON, CSV); +20 model providers behind a unified interface reduce lock-in.
Data protection
Personal data enters prompts without control.
PII masking helps protect sensitive personal data.
Traceability
Usage, model access, and costs are not transparent.
Structured request logs, a tamper-evident audit log, and cost analytics create transparency.
ICT incident management
AI use is not visible in security monitoring.
SIEM integration and request tracing provide event data for detection and analysis.
Information security
Employees use unapproved tools outside internal security policies.
The workspace provides a central, controlled alternative.
Digital sovereignty
Vendor structure, jurisdiction, and infrastructure are hard to assess.
The platform and guardrails run on Myra’s EU infrastructure; when enabled, EU region routing blocks any model request outside the EU.
Governance
Business units use AI without consistent guardrails.
Guardrails, model governance, and roles support consistent use.
Productivity
Overly restrictive rules prevent AI use or encourage workarounds.
Employees get secure access to AI for their daily work.
ICT risk management
AI tools are used in a decentralized way without consistent assessment.
ICT third-party risk management
Different AI providers are used without review or as shadow IT.
Exit strategies (Art. 28(8) DORA)
Data and configurations are locked in to one provider.
Data protection
Personal data enters prompts without control.
Traceability
Usage, model access, and costs are not transparent.
ICT incident management
AI use is not visible in security monitoring.
Information security
Employees use unapproved tools outside internal security policies.
Digital sovereignty
Vendor structure, jurisdiction, and infrastructure are hard to assess.
Governance
Business units use AI without consistent guardrails.
Productivity
Overly restrictive rules prevent AI use or encourage workarounds.
Audited and operated on Myra infrastructure in the EU
AI Options for DORA‑Regulated Financial Institutions Compared
Central access for employees
🟡 Partially possible, but often not governed company-wide
🟢 Depending on product and licensing model
🟢 Central workspace for organization-wide AI use
Protection of sensitive data
🔴 Highly dependent on user discipline and tool settings
🟡 Depends on contract, region, configuration, and provider
🟢 Privacy-first approach with PII masking and controlled usage paths
Auditability
🔴 Often insufficient for regulated use
🟡 Depends on enterprise configuration
🟢 Audit logs as an integral part of the workspace approach
Model governance
🔴 Limited or not centrally controllable
🟡 Provider-dependent
🟢 Approved models and providers can be provisioned centrally
Digital sovereignty
🔴 Often limited
🟡 Depends on provider, jurisdiction, and operating model
🟢 Operation focused on European infrastructure and data protection
DORA-relevant third-party risk management
🔴 Difficult to control
🟡 Possible, but often with additional review and contracting effort
🟡 Supported by a central operating framework; overall responsibility remains with the institution
Protection against shadow IT
🔴 Low
🟡 Depends on rollout and governance
🟢 Strong controlled alternative for employees
Cost control
🔴 Decentralized and hard to manage
🟡 License- and usage-dependent
🟢 Per-user cost control
Suitable for sensitive content
🔴 Generally not without additional safeguards
🟡 Only with suitable configuration and contractual basis
🟢 Designed for organizations with sensitive data and high compliance requirements
Pricing
🟡 Low entry costs, but limited suitability for regulated use
🟡 Depends on provider, license, and usage
🟢 From €13 per user per month, excl. VAT
Central access for employees
🟡 Partially possible, but often not governed company-wide
Protection of sensitive data
🔴 Highly dependent on user discipline and tool settings
Auditability
🔴 Often insufficient for regulated use
Model governance
🔴 Limited or not centrally controllable
Digital sovereignty
🔴 Often limited
DORA-relevant third-party risk management
🔴 Difficult to control
Protection against shadow IT
🔴 Low
Cost control
🔴 Decentralized and hard to manage
Suitable for sensitive content
🔴 Generally not without additional safeguards
Pricing
🟡 Low entry costs, but limited suitability for regulated use
Conclusion: For DORA-regulated financial institutions, model quality alone is not decisive. What matters is controlled usage, data and vendor governance, auditability, trust in the infrastructure, and integration into existing ICT risk processes.
Why Myra Is Relevant for Regulated Organizations
Myra Security GmbH is a German cybersecurity provider headquartered in Munich. The company protects websites, web applications, APIs, and DNS infrastructures with cloud-based security solutions such as DDoS Protection, Web Application Firewall, CDN, Secure DNS, and Bot Management. Its focus is on regulated organizations, critical infrastructure, and high requirements for security, data protection, and digital sovereignty. With Myra AI Workspace, Myra extends this commitment to security and compliance to AI use across the organization.
Myra-operated infrastructure: Myra runs security-critical services on its own infrastructure. For Myra AI Workspace, this means: the platform, guardrails, and EU models operated by Myra run on Myra infrastructure; for external models, processing takes place at the respective model provider.
BSI C5 Type 2 attestation: Myra’s infrastructure is attested according to BSI C5 Type 2.
BSI-qualified DDoS mitigation provider: Myra Security is listed by Germany’s Federal Office for Information Security (BSI) as a qualified DDoS mitigation provider.
Focus on critical infrastructure and regulated industries: Myra serves organizations with elevated requirements for availability, integrity, confidentiality, and compliance.
European legal and operating framework: For financial institutions, a provider’s location and jurisdiction is a relevant procurement criterion. As a German company, Myra Security is subject to European law.
Security expertise beyond AI: Myra brings experience in DDoS Protection, WAF, CDN, Secure DNS, Bot Management, and protecting business-critical infrastructure.
Use Cases for AI in DORA‑Regulated Financial Institutions
Compliance and Regulatory Monitoring
Compliance teams can use AI to structure regulatory texts, internal policies, control questions, and interpretations more efficiently. It is essential that sensitive content does not end up in uncontrolled public AI services.
Information Security and ICT Risk Management
Security and risk teams can use AI for risk analyses, incident follow-up, awareness materials, technical documentation, or policy drafts. Auditability and access control are key requirements.
Legal, Procurement, and Vendor Risk Management
DORA raises the bar for managing ICT third-party providers. AI can help prepare contracts, supplier documents, control catalogs, and audit requirements. The final assessment remains with the responsible experts.
Customer Service and Internal Knowledge Work
Financial institutions can use AI to provide internal knowledge articles, draft responses, summaries, and process information faster. Customer-facing content requires approval processes and expert review.
Marketing and Communications
Marketing and communications teams can use AI for campaigns, expert articles, product communication, and internal enablement materials. In a regulated environment, fact-based wording, sourcing, and approval processes are essential.
IT and Development
Development teams can use AI for code explanations, technical documentation, test scenarios, or architecture summaries. Source code, vulnerability information, and system details require clear rules for data sharing and model use.
Procurement Questions for AI in the Financial Sector
Before introducing an AI workspace, DORA-regulated financial institutions should clarify the following questions, among others:
Which data classes may be entered into AI systems?
Which AI models and providers are approved?
Where are prompts, files, and responses processed?
Can it be technically enforced that model requests do not leave the EU – including failover and web search?
Which personal data is detected and masked?
Which logs are available for audits, cost control, and security analyses?
How is AI use integrated into existing ICT risk processes?
Which contractual and organizational requirements apply to the provider?
Which subprocessors and model providers are involved, and how are they reflected in the register of information?
Which roles and permissions do business units, IT, data protection, and compliance need?
How are AI outputs reviewed before they are used in critical processes?
What exit strategy is in place in case of a provider change, risk reassessment, or changed regulatory requirements?
These questions show that an AI platform for financial institutions is not just productivity software. It is part of ICT governance.
Why a Central AI Workspace Beats Tool Sprawl
A central AI workspace offers financial institutions three key advantages.
More Control
Instead of assessing many uncoordinated tools individually, organizations can provide AI through a defined environment. This simplifies policies, approvals, training, and technical controls.
More Acceptance
Simply banning public AI tools does not meet business units’ need for productivity. A controlled workspace offers a secure alternative and reduces workarounds.
The demand is clear: According to the Myra AI Adoption Report 2026, 50% of respondents have already refrained from using an AI application or stopped using it because they were unsure about data protection and compliance – by far the most common reason. In companies with revenue of at least €100 million, the share is 59%. At the same time, 92% at least occasionally complete tasks without AI even though it could have helped.
More Traceability
Audit logs, central model governance, and cost control create transparency. This is especially important when AI use later has to be explained to internal or external auditors.
Who Is Myra AI Workspace For?
Myra AI Workspace is particularly suited to organizations that want to introduce AI securely but cannot allow uncontrolled use of public AI tools.
Typical target groups include:
Banks
Insurers
Payment service providers
Fund management companies
FinTechs
InsurTechs
Financial-sector service providers
Critical infrastructure operators
Public institutions
Organizations with high data protection and compliance requirements
Introduce AI Securely — With Control Over Data, Models, and Governance
DORA-regulated financial institutions need an AI approach that enables productivity while taking data protection, auditability, vendor oversight, and digital sovereignty into account.
Myra AI Workspace provides a central AI work environment with a privacy-first approach, PII masking, audit logs, cost control, and operation on European infrastructure.
Discover Myra AI Workspace – from 13 Euro per user per month, excl. VAT
Go to Myra AI WorkspaceFAQ: AI for DORA‑Regulated Financial Institutions
It refers to the controlled use of AI in banks, insurers, payment service providers, FinTechs, and other financial entities subject to DORA. What matters is that AI use is integrated into ICT risk management, data protection, auditability, vendor oversight, and internal governance.