DORA applies. We make your resilience demonstrable.

Yes, but not with a second management system. § 28 Abs. 6 Nr. 1 of the German BSIG exempts DORA financial entities from §§ 30, 31, 32, 35, 36, 38 and 39 BSIG: ICT risk management and incident reporting run under DORA via BaFin. That is statutory non-application, not mere overlap in substance, and it does not touch the status as an entity. Registration with the BSI under § 33 BSIG therefore remains, because § 33 is not on the exemption list. Management responsibility does not fall away either: DORA assigns it to the management body itself, including regular ICT risk training. The platform maps both regimes from one control set, so reporting does not have to run in parallel.

Contract register with 19 EBA mandatory fields, subcontractor chains, AI-assisted contract analysis, concentration-risk heatmap, documented exit strategies. Outsourcing register on demand for the regulator.

Multi-entity architecture for group structures, subsidiaries and international sites. Consolidated supervisory report at group, subsidiary and tenant level. Methodology comes from partner mandates in DAX banks at PwC, Deloitte and KPMG.

AI models are self-operated in Sovereign mode, with no data sharing with external model providers; alternatively BYOK or Managed, where you define the data flow. Bring your own API keys (OpenAI, Azure, Anthropic, Ollama) or managed service with German data residency. GDPR-compliant with anonymisation and scheduled deletion.

API integration with existing GRC and reporting tools (RSA Archer, MetricStream, ServiceNow GRC). Three migration scenarios: co-existence, gradual replacement, full migration. Reports can be exported automatically into supervisory workflows.