DORA applies. We make your resilience demonstrable.

Not in substance. § 28 Abs. 6 Nr. 1 of the German BSIG exempts DORA financial entities from §§ 30, 31, 32, 35, 36, 38 and 39 BSIG: ICT risk management and incident reporting run under DORA via BaFin. That is statutory non-application, not mere overlap in substance, and it does not touch any status as an entity. What remains is registration under § 33 BSIG, provided your company counts as an essential or important entity under the BSIG; entity type and size thresholds decide that. DORA alone does not make a company an Annex 1 entity. Management responsibility does not fall away either: DORA assigns it to the management body itself, including regular ICT risk training. The platform maps both regimes from one control set, so reporting does not have to run in parallel.

Contract register with 19 EBA mandatory fields, subcontractor chains, AI-assisted contract analysis, concentration-risk heatmap, documented exit strategies. Outsourcing register on demand for the regulator.

Multi-entity architecture for group structures, subsidiaries and international sites. Consolidated supervisory report at group, subsidiary and tenant level.

AI models are self-operated in Sovereign mode, with no data sharing with external model providers; alternatively BYOK or Managed, where you define the data flow. Bring your own API keys (OpenAI, Azure, Anthropic, Ollama) or managed service with German data residency. GDPR-compliant with anonymisation and scheduled deletion.

API integration with existing GRC and reporting tools (RSA Archer, MetricStream, ServiceNow GRC). Three migration scenarios: co-existence, gradual replacement, full migration. Reports can be exported automatically into supervisory workflows.