DORA, the EU AI Act, and the self-application problem

DORA and the AI Act both test whether the institution can reconstruct the decision record

The paper argues that financial regulators are asking for inspectable decision reconstruction, not scattered proof that policies, model files, contracts, and incident tickets exist. Decision Accounting answers with a 17-field record that makes each material decision the audit object.

• Central claim: a full Decision Accounting record that passes the five-minute/stranger test satisfies the decision-documentation function of DORA Articles 5, 6, 8, 11, 13, 17, 18, 19, 28, and 30
• For in-scope high-risk AI, the same record satisfies the technical-documentation and oversight function of EU AI Act Articles 9, 11, 13, 14, and 26
• The record must let a competent outsider reconstruct the decision, alternatives, evidence, assumptions, authority chain, outcomes, variance, and system-welfare claim in five minutes

Financial AI creates one decision chain across model, ICT, vendor, and business files

The paper’s collision case is financial AI inside ICT-supported business functions. A credit scoring model can be an AI Act issue because it affects access to essential private services, and a DORA issue because it depends on ICT assets, data pipelines, providers, continuity plans, and incident controls.

• Credit scoring: high-risk AI classification can meet DORA dependency, resilience, and third-party risk duties in the same workflow
• Fraud detection: account freezes, payment interruptions, incident triage, and customer treatment may sit across AI governance and operational resilience records
• Claims automation: model documentation, insurance operations, vendor contracts, customer-facing workflows, and continuity controls can fragment the same decision

Bilateral payoff records cannot prove system welfare when resilience variables are missing

The theorem compares two decisions with identical recorded bilateral payoff matrices. One preserves vendor substitutability, tested recovery capacity, and human override capacity; the other creates single-provider concentration, untested recovery, and degraded override capacity. The payoffs match, but system welfare differs.

• System-state variables include resilience, concentration, contestability, reversibility, information quality, and externalized burden
• If any component of X(d) is not recoverable from recorded bilateral payoffs P(d), then W(d) is not a function of P(d) alone
• A favorable contract, improved outage metric, higher model score, or passed checklist can still leave the system worse off

A Hollow Win occurs when private revenue is positive and system welfare turns negative

The paper defines the bad equilibrium as the Missing System Trap: actors optimize over recorded private benefits while system-state variables remain unrecorded, non-owned, or non-auditable. The measurable failure case is a Hollow Win: Πd > 0 while ΔWd < 0.

• Trap condition 1: a private payoff or revenue claim is recorded
• Trap conditions 2 and 3: a system-state variable is affected but no record owner has correction authority
• Trap condition 4: the decision is approved or defended as if the private payoff were a sufficient welfare measure

The Seventeen fields separate evidence, assumptions, outcomes, authority, and welfare

Decision Accounting makes the decision, not the document owner, the unit of record. The fields are identifier, timestamp, who, what, context, alternatives, criteria, evidence, assumptions, stakeholders, prediction, outcome, variance, review, authority, and system welfare.

• Fields 8 and 9 separate evidence from assumptions so an uncertain premise cannot be treated as fact
• Fields 11, 12, and 13 separate prediction, observed outcome, and variance so success cannot be declared before measurement
• Fields 15 and 16 separate approval from welfare so senior sign-off cannot replace a system-welfare claim

Field 17 records βΠ minus externalized burden and correction cost

The Master Formula is ΔWd = βdΠd - Ed - Cd. In the paper’s notation, Π is private revenue captured or protected, not profit; β is the conversion factor from private revenue to system welfare; E is externalized burden; and C is compliance, monitoring, and correction cost.

• Field 17 must record the private revenue claim, the tested conversion factor, the externalized burden, and the correction authority
• A narrative paragraph called system impact does not execute the formula if it is added after the decision is already made
• The paper warns firms to state revenue rather than profit as Π because using profit would change the welfare calculation

The same EUR 20M revenue claim flips from system-positive to system-negative when β falls

The paper’s simple cloud-migration example uses a bank expecting to protect EUR 20 million in annual revenue by reducing outage risk and preserving product continuity. With β=0.55, E=6M, and C=2M, ΔW is EUR 3M. When new evidence lowers β to 0.35, ΔW becomes EUR -1M.

• Positive case: 0.55(20) - 6 - 2 = 3, so the decision remains system-positive by EUR 3M
• Negative case: 0.35(20) - 6 - 2 = -1 after provider concentration and failed exit testing lower β
• Field 17 forces concentration risk, outage correlation, exit friction, supervisory response, monitoring cost, and remediation cost into the record

The DORA claim spans governance, ICT risk, incidents, learning, and third-party controls

Proposition 1 says a complete Decision Accounting record satisfies the decision-documentation function of DORA Articles 5, 6, 8, 11, 13, 17, 18, 19, 28, and 30, subject to any required format, template, timing, or supervisory submission duty.

• Articles 5 and 6 map to Fields 1-5 and 15 for decision object, time, actor, type, context, and authority
• Article 13 maps to Fields 12-14 for observed results, variance, lessons, remediation, and future controls
• Articles 28 and 30 map to Fields 6, 7, 8, 9, 10, 15, and 16 for outsourcing alternatives, diligence evidence, assumptions, affected parties, contractual authority, concentration risk, exit risk

Article 12 is backup and recovery, while Article 17 is the incident-record rule

The paper corrects a common shortcut: DORA Article 12 is not the main incident-record rule. Article 12 concerns backup policies, procedures, restoration, and recovery methods. Article 17 requires recording ICT-related incidents and significant cyber threats, and documenting and addressing root causes.

• Article 18 supplies incident classification criteria: affected clients or counterparties, duration, geographical spread, data losses, criticality of affected services, and economic impact
• Article 19 supplies major-incident reporting and voluntary cyber-threat notification through prescribed templates and timelines
• The stronger mapping is across DORA’s full record structure, not a single mislabeled article

The AI Act record must bind lifecycle risk, technical documentation, transparency, oversight, and deployer use

For high-risk AI systems, Proposition 2 maps Decision Accounting to Articles 9, 11, 13, 14, and 26. The paper treats Article 14 as an authority test: the human in Field 15 must have practical power to override, disregard, reverse, or stop the AI use.

• Article 9 risk management maps to Fields 5, 8, 9, 10, and 16 for risk identification; Fields 7, 11, and 16 for risk estimation; and Fields 12-14 for post-deployment update
• Article 11 technical documentation maps to Fields 1-16 plus attached artifacts, kept current across the system lifecycle
• Article 26 deployer duties map to use according to instructions, input-data relevance where controlled by the deployer, monitoring, log retention where under deployer control

A Decision Accounting scorer becomes high-risk only when it enters an Annex III decision path

The paper resolves the self-application problem with a legal-function distinction. A tool that scores Decision Accounting record quality is not high-risk merely because it audits high-risk AI documentation. Classification changes when its intended purpose or actual use places it inside Article 6 and Annex III decisions about natural persons.

• Ordinary governance-record auditing is outside Annex III when the scorer does not affect person-facing outcomes
• Classification can change for employment, credit, insurance, benefits, law enforcement, migration, asylum, border control, judicial administration, or democratic-process decisions
• The bright line holds only while the scorer remains outside the decision path for natural persons

Decision Accounting is a control architecture, not immunity from supervision or other law

The paper’s policy implication is narrow. Decision Accounting reduces documentation fragmentation only when the record names the flawed game, records the Missing System Trap, states revenue as Π, and preserves human authority over person-affecting uses.

• It does not replace DORA templates, major-incident reporting, outsourcing contracts, threat-led penetration testing, data protection law, consumer-credit rules, employment law
• The record fails if it is thin, stale, unverified, or written to justify an outcome already chosen
• The paper’s stated contribution is a formal classification theorem, a field-by-field regulatory map, three worked examples, and falsification conditions