Financial services
AI governance for banks and financial firms.
Know which AI tools touch customer and financial data, put rules on them, and keep the evidence your supervisors and auditors will ask for.
The rules that apply
DORA already covers the AI services you buy. The EU AI Act adds credit scoring to the list of high-risk uses.
DORA has applied since 17 January 2025 to banks, insurers, investment firms, payment institutions and other financial entities. It asks them to manage ICT third-party risk and to keep a register of information on their contracts with ICT third-party providers. AI services bought from vendors, from model APIs to AI software, are ICT services in that sense.
Under the EU AI Act, AI systems used to evaluate the creditworthiness of people or establish their credit score are high-risk (Annex III, point 5(b)), fraud detection excepted. Deployers of these systems must carry out a fundamental rights impact assessment before first use (Article 27). The high-risk obligations for these systems apply from 2 December 2027.
Neither is possible without knowing which AI systems are in use, who uses them and what data they receive.
Common scenarios
Three situations you will recognise, and how Qastel handles each.
Scenario 1
Customer data pasted into a personal AI account
An adviser drafts a client letter with a consumer AI account. Qastel recognises personal-account use, and its detectors find IBANs, card numbers and customer data in the prompt. A policy enforced by the browser extension or the desktop agent can redact or block them before the message is sent.
Scenario 2
AI services missing from your third-party register
Teams adopt AI tools faster than procurement can record them. Qastel keeps one inventory of every AI system in use, sanctioned or not, with the vendor, DPA status and data residency of each: a starting point for your DORA register of information.
Scenario 3
An AI system in a credit decision
Qastel classifies each AI system against the EU AI Act risk tiers and shows why, so the ones used in high-risk decisions such as credit scoring can be reviewed early. The Compliance Report gathers the evaluations, violations and recommendations for your compliance team.
Questions people ask.
Does Qastel make us DORA compliant?
No tool does that on its own. Qastel gives you the inventory of AI services in use, with vendor, DPA status and data residency, plus the policies and evidence around them. Your DORA programme decides what to do with it.
Does Qastel store what our staff type?
Prompt analysis is off by default and only an admin can turn it on. When it is on, prompt text is classified in memory and never stored: Qastel keeps the category of what it found, not the text.
Will a policy block people on day one?
No. A new policy can run in monitoring first, recording what it would have done without changing anything for anyone. Only a policy in Enforcing blocks, redacts or warns.
This page is general information, not legal advice.
See it in action.
Get a 30-minute overview of how Qastel discovers, assesses and controls the AI used across a business.