The questionnaire arrives as a long spreadsheet. A bank in the Netherlands wants to buy the credit decision service that a small software company in the United States has sold at home for several years. Before it signs, the bank's third party risk team wants to know where applicant data is processed and stored, which subcontractors touch it, whether the bank and its supervisor may audit the company, and how the bank gets out. Sales forwards the file to the chief technology officer with a deadline.
The questions are the bank's legal duty written out row by row. The Digital Operational Resilience Act of the European Union has applied since 17 January 2025. Under Article 28 the bank remains fully responsible when it uses an outside provider. Article 30 fixes what the contract must contain, including the terms for subcontracting, the locations where data is processed and stored, return of data when the contract ends, and help during incidents at no extra cost or at a cost agreed in advance. Where the service supports a critical or important function the bank also needs unrestricted rights of access and audit and an exit period that lets it move to another provider or bring the work in house. For a provider outside the Union, Article 29 tells the bank to weigh compliance with Union data protection rules and the enforceability of the law in that country. If the service calls a language model from another company, that company is a subcontractor and belongs in the answer.
A second rule is on its way. The European Union Artificial Intelligence Act applies to providers that place a system on the Union market wherever they are established, and to providers in third countries whose output is used in the Union. Systems that evaluate the creditworthiness of natural persons or establish their credit score are on its high risk list, with an exception for systems used to detect financial fraud, and the obligations apply from 2 December 2027. The company is the provider. It will need a quality management system, technical documentation, a conformity assessment, a declaration of conformity and registration, and before the system is made available in the Union it must appoint, by written mandate, an authorised representative established there. The conformity assessment for this category is done by internal control without a notified body, so there will be no certificate to send the bank. Fines run up to 15 million euro or 3 percent of worldwide annual turnover; for small and medium sized enterprises the lower of the two applies.
On 30 September 2025 the data protection commissioner of Hamburg announced a fine of 492,000 euro on a financial company that had rejected credit card applications by automated decision and did not give the applicants adequate reasons when they asked. The bank carries that duty under the General Data Protection Regulation and can meet it only if the system produces reasons for each decision. From December 2027 the bank, as deployer, must also keep the system's logs for at least six months.
The usual response is to let sales and legal answer with a security report and the standard contract, and to write that data is hosted in the United States under the Data Privacy Framework. That is lawful today. The General Court of the European Union upheld the framework on 3 September 2025 and noted that the Commission may suspend, amend or repeal it. A bank that must show its supervisor a workable exit will not accept an answer that rests on that decision alone.
The better answer is an architecture decision, which makes it the chief technology officer's. For each type of work the company decides which route the data takes. Applicant data from the Union goes to a private deployment in a European region, on a deployment type that keeps processing inside the Union; provider documentation separates regional deployments from those labelled global, which may process anywhere. For a bank that demands it, the service is installed in the bank's own environment, which is also the exit in house that the Act describes. Running at the bank changes where the data sits and leaves the documentation, the logging and the evaluation as they were.
So the compliance work is engineering work with a fixed list: an inventory of every model in the product, the company's role under the Act, the supplier file the bank must hold, evaluation on each client's own applicant population, logging, human oversight, staff competence and an incident route. Most of it ships as product features, such as a log export per decision, the model version in every record and reasons a credit officer can read.
The AI Guys, a Dutch firm that works on compliance for artificial intelligence in regulated industries, works with chief technology officers on this file from the route decision to implementation.
Next month you should have four documents. A data flow diagram that shows processing and storage locations per client region and every subcontractor, the model provider included. A written statement of the company's role under the Act, with a gap list against the provider obligations that apply from 2 December 2027. The route decision per type of data. And a draft contract annex that follows Article 30 point by point.