The Relevance of the Proportionality Principle under DORA for the Interpretation of the Artificial Intelligence Act in the Context of AI-Based ICT Systems

Abstract

This article constitutes a scientific and conceptual legal study examining the relationship between cybersecurity obligations applicable to high-risk AI systems and sector-specific ICT risk management in the financial sector under EU law. The research problem concerns the interpretation of the reference to “relevant circumstances and risks” in Article 15 (5) of the Artificial Intelligence Act (AI Act) when high-risk AI systems operate as components of ICT infrastructure within financial institutions. The article argues that these circumstances and risks should be interpreted in light of the proportionality framework laid down in Article 4 of the Digital Operational Resilience Act (DORA). The aim of the research is to determine whether the proportionality criteria established in DORA may function as an interpretative benchmark for assessing the adequacy of cybersecurity measures required under the AI Act. The main thesis advanced is that the proportionality criteria concerning the size of the entity, its risk profile, and the nature, scale and complexity of its activities provide objective parameters for identifying the “relevant circumstances and risks” referred to in Article 15 (5) of the AI Act in the financial sector. The originality of the study lies in demonstrating the systemic complementarity between horizontal AI regulation, which applies regardless of the status of the entity using the AI system, and the sector-specific ICT operational resilience rules. The research is conducted at the level of EU law and contributes to the doctrinal interpretation of emerging EU digital regulations, offering practical relevance for supervisory authorities and financial institutions implementing cybersecurity obligations for AI systems.