Operational resilience inside your own environment, before the supervisor opens the file.
Continuous, sovereign, citation-grade evidence for ICT risk management, third-party oversight, and the Register of Information. Inside your tenant. Inside your EU data boundary.
The tolerance period is over. The supervisor is not reviewing paperwork.
DORA became fully applicable on January 17, 2025. In 2026, NCAs and the European Supervisory Authorities have moved decisively from reviewing paperwork to demanding proof: active enforcement reviews, automated Register of Information cross-checks, first compulsion payments issued.
For the most serious breaches; up to 1% of average daily turnover worldwide depending on the breach.
Per day of continued non-compliance, for up to six months. For a large technology vendor, hundreds of millions of euros.
Up to €1M in most member states; up to €5M in Germany, Italy, and Belgium. Member states may impose criminal penalties under Article 52.
Temporary activity bans, removal of board members, enhanced supervisory scrutiny. Reputational damage is concurrent.
Continuous operational resilience evidence, inside your EU Azure tenant.
Kyūdō converts the Microsoft Security signals you already produce into continuous, supervisor-defensible evidence across DORA, NIS2, ISO 27001, SOC 2, and the EU AI Act on a single Compliance Graph.
Sovereign EU deployment, structural by default
Every Kyūdō service runs inside your Azure subscription in the EU region you select. Compliance data, AI inference, and graph reasoning all stay inside your EU data boundary. No cross-tenant data plane.
Vendor Risk Management for Articles 28-31
Continuous monitoring with AI-scored vendor posture and Compliance Graph citations. Concentration-risk analysis is a graph property, not an annual review. ICT third-party register stays current as a property of the architecture.
Your EU tenant. Your EU data boundary. No exceptions.
DORA places ICT risk evidence inside the regulatory and operational scope of EU supervisory authorities. Sovereignty is not a deployment preference for EU financial entities. It is the boundary inside which supervisory evidence belongs.
No cross-tenant data plane
Every Kyūdō service runs inside your Azure subscription in your selected EU region. Operational resilience evidence does not reach extra-EU vendor infrastructure because no path exists for it to.
Private endpoints on every service
Application services, storage, Key Vault, SQL, identity, and AI inference all expose private endpoints only. Traffic does not leave the Microsoft EU backbone.
Tenant-scoped AI inference
Prompts, retrieved context, and AI responses execute inside your EU tenant. Article 9(10) of the EU AI Act lets you integrate AI risk management into the same DORA ICT risk framework.
Continuous monitoring, AI-scored, Compliance Graph cited.
DORA Articles 28-31 govern the management of ICT third-party risk. The supervisory expectation is continuous, not annual. The Vendor Risk Management module addresses the requirement directly.
DORA, NIS2, ISO 27001, EU AI Act: one control fabric.
STRM crosswalking (NIST IR 8477) resolves the same control across each regime as same, partial-match, or stronger/weaker variant on one Compliance Graph. Most EU financial entities operate under several concurrent regulatory regimes; one evidence pipeline should cover them.
Article 9(10) explicitly permits AI risk management to be integrated into DORA ICT risk management procedures.
Kyūdō implements that integration as a property of the architecture: AI risk and ICT risk are typed entities in the same graph, governed by the same evidence pipeline, defensible to both regulators on the same retrieval trace.
For DORA specifically, the architectural diff is a supervisory diff.
The VRM module on the platform that runs your full DORA program.
You don't reassess your ICT third parties when the supervisor asks.
The post-tolerance period is the operating reality. Continuous evidence inside your EU tenant is the operating answer.