A compliance lead at a UK financial entity is halfway through mapping the firm's ICT third-party arrangements when a new proposal lands: adopt an AI tool that reads the firm's policies, procedures, and client files and answers questions about them. The engineering team is enthusiastic. The compliance lead has one question the demo never answers: under whose jurisdiction does that reading and answering actually happen, and can we put that in the register of information?
Since the EU Digital Operational Resilience Act (DORA) came into force on 17 January 2025, that question stopped being academic. DORA turns the governance of ICT third-party service providers into a documented, supervised obligation, and an AI knowledge platform that ingests regulated documents is squarely an ICT third-party service. For any firm with EU entities in scope, or a UK firm serving EU counterparties, the platform decision is now a resilience decision. This post sits within our wider guide to DORA compliance for regulated industries and focuses on the one article that trips up AI procurement: Article 28.
What DORA Article 28 actually requires
Article 28 of DORA sets out the general principles for the sound management of ICT third-party risk. It is not an AI-specific rule, but it applies to AI tools completely. In practice it obliges a financial entity to:
- manage ICT third-party risk as an integral part of its overall risk framework, with named accountability;
- maintain a register of information on all contractual arrangements for the use of ICT services, distinguishing those supporting critical or important functions;
- assess, before contracting, the risks of the arrangement, including where the service and the underlying data are located and processed;
- ensure the contract contains specified provisions covering data access, availability, security, audit rights, subcontracting, and exit; and
- keep the ability to exit the arrangement without undue disruption.
The theme running through all of it is evidence. A supervisor does not want assurances that the firm chose a sensible vendor. It wants the register entry, the pre-contract risk assessment, and the contractual provisions that back it up.
Where data jurisdiction enters the picture
The phrase to hold onto is DORA Article 28 data jurisdiction. Article 28 requires the firm to assess where its data will be stored and processed, and the risks that follow from that location. For a conventional SaaS tool the answer is usually a hosting region. For an AI knowledge platform there are two locations that matter, not one: where the documents are stored, and where the model that reads them runs. Firms routinely assess the first and forget the second.
That gap is where the US CLOUD Act (2018) becomes relevant. The Act compels US-headquartered companies to produce customer data to US authorities on demand, regardless of where that data physically sits, because it follows corporate control rather than data location. Resolving that exposure requires the AI processing tier itself, not just the hosting region, to sit outside US corporate control, which is an Enterprise-tier sovereign deployment choice rather than a setting. In June 2025 Microsoft confirmed under oath to the French Senate that it could not guarantee EU data would never be accessed by US authorities. A platform can host your documents in Frankfurt and still route the AI processing through a US-controlled provider, which is precisely the residual jurisdictional exposure Article 28's location assessment is designed to surface.
Why AI knowledge platforms are the hard case
Three properties make AI knowledge platforms harder to assess under Article 28 than ordinary software.
They read the sensitive material, they do not just store it. A document store holds files at rest. An AI knowledge platform actively processes the content of policies, contracts, and client records to generate answers. The processing tier, not just the storage tier, becomes an ICT service supporting what are often critical or important functions.
Their answer surface is only as governed as their source control. If the platform answers from everything a user can see rather than from an approved, curated set, the firm cannot state in its risk assessment which documents were eligible to inform an answer on a given date. That is a governance gap Article 28's evidence expectations expose immediately.
Their audit trail is the compliance artefact. When a supervisor asks how a member of staff arrived at an answer given to a client, the platform's log of the query, the response, and the source documents is the record that answers the question. A tool without that trail cannot support the demonstrable-compliance posture DORA expects.
What to look for in a DORA compliant knowledge management SaaS
None of this rules out adopting AI. It sets the specification. A DORA compliant knowledge management SaaS should let a compliance function evidence, not merely assert, each of the following:
| Article 28 concern | What to require of the platform |
|---|---|
| Data location and jurisdiction | Clear statement of where documents are stored and where the AI processing runs; an option for non-US infrastructure where exposure is acute |
| Approved-source governance | Answers drawn only from curated, approved document sets, not everything a user can open |
| Auditability | Full log of queries, answers, and cited sources, exportable for a supervisor or internal audit |
| Contractual provisions | Access, security, subcontracting, audit rights, and exit terms that map to DORA's required clauses |
| Register of information | Enough clarity on the service and its subprocessors to complete the register entry accurately |
The distinction between data residency and data sovereignty matters here and is often blurred by vendors. Data residency means choosing the region your data sits in, typically on a mainstream cloud provider. Data sovereignty means the entire stack, including the AI processing layer, sits outside US corporate control. Residency addresses where; sovereignty addresses whose jurisdiction. Article 28's location assessment can be satisfied by residency for many firms; only firms with acute exposure need full sovereignty, and they should scope it deliberately rather than assume a UK hosting region delivers it.
How AnswerVault fits the Article 28 specification
AnswerVault is a governed AI knowledge layer that connects SharePoint, Google Drive, and Confluence and answers only from the document sets a firm approves. It is built around the evidence Article 28 asks for: answers are grounded in curated, approved content; every query, response, and source is logged for audit; and a superseded document stops informing answers the moment it is replaced. Staff query it through web chat, Microsoft Teams, or Slack.
On jurisdiction, the honest scope matters. AnswerVault's Starter, Pro, and Business tiers run on mainstream cloud infrastructure with a commercially managed AI layer, and firms should assess them on a data-residency basis. For firms whose Article 28 assessment identifies acute exposure, the Enterprise tier offers a sovereign deployment on non-US infrastructure where the AI processing layer also sits outside US corporate control. AnswerVault is ISO 27001 aligned, G-Cloud listed, and ISO 42001 certification is underway; the procurement-grade detail a register entry and risk assessment need, including subprocessors and audit rights, is on the security and compliance page.
For the full regulatory picture across DORA, the EU AI Act, and ISO standards, our pillar on DORA compliance for AI knowledge management is the place to start.
AnswerVault's Starter tier is free: connect a document source and see how a governed, fully logged answer behaves before it ever reaches a risk assessment.
AnswerVault is built by Catapult CX, an enterprise technology consultancy. The product was originally developed for a global pharmaceutical company with strict data governance requirements, and the same architecture now powers the SaaS platform.