DORA

A European financial entity now answers for the resilience of its technology, not only for its balance sheet. An assistant inside that estate becomes part of the risk register. This starter covers the part of the duty that a gateway can enforce and leaves the program work visible.

Evidence matters more than intent in this regulation. A supervisor wants to see how a system behaves under pressure and who answers when it fails. AI traffic is now part of that picture.

Order matters on the request path. Injection screening protects the identity check that follows it, and that check refuses calls without verified user and organization claims. Redaction masks tax identification numbers next. A block list then stops account export instructions, payment wire details, access tokens and private keys.

Answers face a combined floor of 0.86, a relevance floor of 0.78 and an accuracy floor of 0.80. The gate also rejects a reply shorter than 120 characters or a single sentence. Grounding is measured, and an unverified citation is flagged rather than blocked until you change that setting.

Nothing generated here reaches a caller unaided. The review stage holds back every response and records an escalation, so a person supplies the words that leave the building. That fits the reporting duties in the regulation, where a major incident needs human judgment and a filing. Weigh the cost as well, because incident handling, control changes and report releases all wait in the same queue. The closing stage marks the request and stays out of the decision.

Resilience testing, continuity exercises and provider registers stay with your teams and your contracts. Threat led penetration testing is not gateway work. Choose the NIS2 starter when the duty comes from the wider cyber directive rather than financial regulation.