THE GLOBAL CONVERGENCE.

Payments on behalf of a customer’s clients may only be executed if it is ensured that the customer can provide the client information required for due-diligence duties on request.

The guidance ties AI operation to DORA ICT risk management and highlights strict authorisation management, resilient operation, logging, Zero Trust controls and conditions set in advance of AI use that users should not be able to exceed on their own.

DORA requires an ICT risk-management framework, resilience testing, incident processes and controlled ICT third-party risk for in-scope financial entities.

The AI Act establishes risk-based obligations including governance, technical documentation, logging, human oversight, accuracy, robustness and cybersecurity for covered high-risk systems and actors.

NIST separates policy decision and enforcement: the policy engine grants, denies or revokes access; the policy administrator and policy enforcement point establish or shut down the communication path.

NSA describes Zero Trust as continuous authentication and authorization of users, devices and applications under “never trust, always verify” and “assume breach.”

The plan calls for secure-by-design, robust and resilient AI in safety-critical contexts, mature AI incident response and, in biosecurity screening, enforcement mechanisms rather than reliance on voluntary attestation.

The strategy directs modernization around cybersecurity best practices, post-quantum cryptography, Zero Trust, resilient federal systems, critical infrastructure and secure scaling of agentic AI.