What does ECB Guide on outsourcing cloud services say about AI in banking?

What are the key points of ECB Guide on outsourcing cloud services?

• Status: final Guide published 16 July 2025; like other ECB Guides it 'does not lay down legally binding requirements' and does not introduce rules beyond DORA, but sets out how the ECB will assess compliance; it also separates DORA requirements from recommended good practices.
• Scope (section 1.2): outsourcing of cloud services to cloud service providers by directly supervised institutions, read with the proportionality principle in Article 4 of DORA; expectations also apply where a non-cloud third-party provider relies on cloud services underpinning critical or important functions.
• Governance (section 2.1): the management body bears ultimate responsibility for ICT risk (DORA Article 5(2)) and the institution stays fully responsible for outsourced cloud services under Article 28(1); good practice is to apply the same diligence as if the service were in-house.
• Ex ante risk assessment (section 2.1.2): required before contracting under Article 28(4) of DORA; should cover concentration and lock-in risk (Article 29), and for critical or important functions the risks of long sub-outsourcing chains (Article 29(2)).
• Availability and resilience (section 2.2): business continuity measures must account for the cloud provider's ability to terminate access, and the ECB recommends a holistic business continuity approach and assessment of the provider's disaster recovery plan.
• Data security and location (section 2.3): security measures, risks from the location and processing of data, inclusion of outsourced assets in the institution's asset inventory, and identity and access management for cloud services.
• Exit and termination (section 2.4): termination rights aligned with Article 28(7) of DORA, a comprehensive exit strategy and plans at suitable granularity, aligned with the termination terms in the contract; the ECB also recommends additional termination triggers such as a merger or sale of the provider or relocation of its head office or data centres.
• Oversight and audit (section 2.5): independent monitoring of providers, incident reporting provisions in contracts (Article 19(5) of DORA keeps responsibility with the institution even where reporting is outsourced), and internal audit of the arrangements.

What did ECB Guide on outsourcing cloud services change for banks?

The ECB had flagged deficiencies in how banks manage outsourced ICT in its supervisory priorities for 2024-26 and now documents what it considers adequate. For AI, the Guide makes cloud-hosted model services subject to the same exit-plan, concentration, data-location and audit expectations as any other critical cloud dependency, and it applies the ECB's reading of DORA Articles 28-30 to the hyperscalers that supply most bank AI infrastructure.

What does the ECB expect of banks that outsource cloud services, including AI platforms?

The ECB's Guide on outsourcing cloud services (16 July 2025) expects directly supervised banks to treat cloud providers as ICT third parties under DORA: keep full responsibility, run an ex ante risk assessment covering concentration and lock-in, ensure business continuity if the provider cuts access, secure data and assess where it is processed, hold termination rights and a tested exit plan, and monitor and audit the provider independently. It is not binding and adds no new rules, but joint supervisory teams use it to judge whether a bank's cloud arrangements meet DORA. Hosted AI services are cloud services, so the same expectations apply to them.

The Guide is one of the ECB's supervisory guides, a category that states the ECB's interpretation without creating rules. Its legal anchors are DORA, which has applied since 17 January 2025, and the Capital Requirements Directive's governance and continuity provisions; the final version differentiates DORA requirements from the ECB's recommended good practices more clearly than the consultation draft did.

It is part of a wider ECB focus on operational resilience, including the 2026-28 supervisory priorities and ECB speeches on operational resilience in the age of AI. Banks that depend on a small number of hyperscalers for AI workloads are the case the Guide's concentration and exit sections were written for, and the largest providers are separately subject to ESA oversight as critical ICT third-party providers under DORA.

Because the Guide addresses ECB-supervised institutions, smaller banks should look to their national authority's expectations, but the DORA provisions it interprets apply to all EU banks.

WHAT THIS MEANS IN PRACTICE

• Map every cloud-hosted AI workload to a provider, region and sub-processor and identify those supporting critical or important functions.
• Document the ex ante risk assessment for each cloud arrangement, including concentration across business lines and sub-outsourcing chains.
• Negotiate termination rights that go beyond the DORA Article 28(7) minimum where the ECB's good practice calls for it, and align notice periods with the exit plan.
• Test exit and fallback plans for AI services, including data and model portability, not only for core infrastructure.
• Assign independent monitoring of provider performance and incidents, and make sure contracts give the access, audit and incident-reporting rights needed.