A prime brokerage deploys an AI-driven margin call system that monitors 50,000 client accounts in real time. During a sudden market dislocation, the model enters a degraded inference state — producing erratic margin calculations — while the firm's human oversight team is offline for a scheduled maintenance window. Under DORA (EU Digital Operational Resilience Act) and operational resilience principles, which control failure is most significant?
Select an answer to reveal the explanation.
Short Explanation and Infographic
DORA's operational resilience framework isn't just about surviving cyberattacks — it's about ensuring critical functions can keep running at an acceptable level when any component fails, including AI components. A margin call system with no graceful degradation path — no fallback to rule-based calculations, no circuit breaker, no safe-state — is a single point of failure in a systemically important process. The oversight team being offline compounds a design flaw that should never have been allowed to exist.
Full explanation below image
Full Explanation
The EU's Digital Operational Resilience Act (DORA, Regulation 2022/2554), effective January 2025, imposes specific requirements on financial entities' ICT risk management frameworks, including AI systems that support critical or important functions. A margin call system processing 50,000 accounts in real time clearly qualifies as a critical ICT function under DORA's taxonomy.
DORA's resilience principles require that critical functions remain operational within defined impact tolerances even when individual components fail. This requires pre-defined fallback mechanisms — not reactive improvisation during an incident. For an AI inference system, operational resilience standards require: (1) confidence score monitoring with automated circuit breakers; (2) fallback to a simpler, more interpretable computation method (e.g., rule-based margin calculations) when the AI model's outputs become unreliable; (3) human-in-the-loop escalation paths that are not contingent on scheduled availability; and (4) regular testing of these fallback paths under simulated stress conditions.
The scenario describes a double failure: the AI system degraded without a failsafe, AND human oversight was unavailable. The architectural failure is the absence of an automated fallback — the human availability gap is a secondary compounding factor, not the root cause.
Option A (penetration testing) is a DORA requirement but addresses ICT security rather than operational continuity. Option C (training data documentation) relates to the ICT asset register, which is a DORA obligation but administrative rather than operational. Option D addresses incident reporting — DORA does require reporting major ICT incidents to national competent authorities (NCAs), but the timing threshold is generally four hours for initial notification of major incidents, not 24 hours, making this answer doubly incorrect.
From a design standpoint, the firm should implement a tiered degradation architecture: full AI inference in normal state → constrained AI with confidence floor → rule-based fallback → human review queue, each with defined activation thresholds and escalation protocols.