DORA's AI Vendor Trap: Liability Flows, Capital Charges, and Board Exit Strategies

The Digital Operational Resilience Act creates an unprecedented liability trap for financial institutions that have become dependent on AI vendors for critical business functions. Unlike traditional ICT outsourcing, AI vendor relationships create non-linear liability flows where model failures can cascade across multiple business lines simultaneously, triggering capital charge implications that boards have not anticipated. This paper maps the liability architecture of AI vendor relationships under DORA, identifies the specific provisions that create 'vendor traps' — situations where switching costs exceed the risk of continued dependence — and provides board-level strategies for either restructuring these relationships or establishing credible exit pathways.

The analysis covers concentration risk provisions, subcontracting chains, and the new requirements for testing AI vendor resilience that take effect in 2025.