Governance, DORA and the EU AI Act
Automated decisions now have to be evidenced, not just made. This page sets out exactly what our platform produces, and what remains your obligation.
The honest version
DORA and the EU AI Act require you to evidence how automated decisions are governed, tested, logged and explained. Decisimo does not make you compliant, and no vendor can. What it does is produce that evidence as a by-product of normal work, rather than as an annual project.
Three regimes, one demand
DORA, since January 2025
The Digital Operational Resilience Act has applied to EU financial entities and their ICT providers since 17 January 2025. It asks for managed ICT risk, documented arrangements, resilience testing, and a workable exit strategy for every critical provider. Of those, the exit strategy is the one that matters most - and it is the one we keep simple. With Decisimo you are always ready to leave.
EU AI Act, from December 2027
Assessing the creditworthiness of a person is an Annex III high-risk use, as is risk pricing in life and health insurance. The AI Omnibus moved those obligations to 2 December 2027. They land on the deployer, not only on whoever built the model: risk management, data governance, technical documentation, record-keeping, human oversight and transparency toward the affected person.
GDPR Article 22, already today
A person subject to a solely automated decision with legal or significant effects can demand human intervention and a meaningful explanation. For credit scoring this is settled, and it applies now, without waiting for either regime above.
What the obligations ask for, and what the platform produces
Every row below is something the system does as part of normal work. None of it is a report someone has to remember to run.
| What the obligation asks for | What the platform already produces |
|---|---|
| Technical documentation of the system | Versioned entities with full revision history; release snapshots with generated notes; policy documents linked to the requirements they produced |
| Record-keeping and logging | Full execution traces, written to infrastructure you control, plus a platform-wide audit log of every human action, with actor, time and IP |
| Human oversight | Approval sequences before any release; AI proposals require explicit human acceptance, one change at a time, against a visible diff |
| Transparency, and explaining a decision to the person it affected | Step-by-step execution trace, rule-level and scorecard-level explanation, readable in the UI without a developer |
| Accuracy and robustness testing | Unit tests on every artifact, regression suites captured from real runs, impact analysis across scenario sets, champion and challenger, decision table overlap and gap validation |
| Change management | Computed release-to-release diffs. Nothing reaches production outside a release |
| Data governance and access control | Role-based access rights, SSO, two-factor authentication and IP restrictions - on every plan - plus an encrypted credential vault with step-up authentication and key rotation |
| Data residency | Regionally distributed execution endpoints. You choose where decisions run |
| Exit strategy | Decision results streamed to a database you own, decision logic exported as a Markdown file, and execution deployable in your own environment |
Your exit strategy, in concrete terms
DORA asks you to hold a documented exit strategy for critical providers. Most answers to that question are a promise to help with a migration. Ours is a set of facts you can put in the file.
- Decision results land in a database you own. Configure a sink to your own Postgres and the results of your decision logic are written into a table in infrastructure you control.
- Your decision logic exports as a Markdown file. Readable, portable, reviewable structure - not compiled proprietary bytecode you could never reconstruct.
- Execution runs where you need it. Regional endpoints for latency and residency, or an execution node in your own environment.
- Ordinary integration. REST and JSON in, REST and JSON out. Nothing in your surrounding architecture becomes Decisimo-shaped, and your bureau credentials point at your own contracts.
We would rather you stayed because the platform works.
Questions a compliance review asks
Does Decisimo make us compliant with DORA or the EU AI Act?
No, and be wary of any vendor who says otherwise. Compliance is an obligation on your organisation, assessed against how you use the system. What we do is produce the documentation, records, traces and exports those regimes ask you to hold.
Are you certified under the AI Act?
There is no such certification for us to hold. We are certified to ISO 27001 for information security management. Where the AI Act places obligations on a deployer of a high-risk system, those obligations are yours; the platform is built to produce the evidence they require.
Who is the deployer of the high-risk AI system, us or you?
In almost every case, you are. You decide the policy, the thresholds and the models, and you put the decision into service for your customers. That is why the platform is built so that every one of those choices is versioned, testable, approvable and explainable by you.
Can a non-engineer open a decision from eight months ago and explain it?
Yes. That is the test we build for. The trace shows which rules fired on which values, what each model scored, and what data was used, against the exact version of the logic that was live at the time. That version is still there and still readable.
What happens to our decision history if we leave?
It is already in your systems. Decision results are written continuously into a Postgres database you own, so there is nothing to request from us. Your decision logic exports as a Markdown file.
Do you train models on our data?
No. Execution runs on zero data retention: the data passes through to make the decision and is not kept here, and it is never used to train models.
This page describes what the platform produces. It is not legal advice, and it is not a statement that using Decisimo satisfies your obligations under any regulation. Your compliance assessment remains yours to make.