DORA AI Compliance Platform

LLM risk scoring on contracts, expert review in the loop, and audit-ready trails at Tier-1 scale.

Tier-1 banks needed to audit large ICT contract portfolios under DORA with tight deadlines and strict regulatory accountability.

DORA forced Tier-1 banks to prove control over ICT third-party risk across thousands of contracts, on timelines that the existing operating model could not absorb. Non-compliance carried nine-figure fines. The exposure was concrete: each unmanaged vendor relationship was a regulatory gap waiting to be found.

The process in place was manual, slow and built around expert judgment trapped in documents and meetings. Auditors read, compared and escalated contract by contract. That worked at a small scale. At portfolio scale it broke: backlog grew faster than review capacity, and the bank could not show a consistent, auditable trail from signal to signed decision.

The problem to solve was operational: a repeatable workflow that could surface risk across large contract sets, while keeping the auditor's last word that regulators still require. Speed had to come without losing an auditable trail.

I led design end to end on an LLM compliance platform for ICT third-party contract audits under DORA: from the operating model with data engineers to the interactive MVP. No design handoff. One decision chain.

The decision that mattered most was architectural: the model scores and flags; the auditor validates, corrects and signs. Every architecture that removed the auditor from the decision path broke somewhere: either it failed regulatory accountability, or it eroded trust in the output. For Tier-1 banks, that loop was the only shape that held both accountability and trust.

I mapped the compliance value chain and saw that the real cost sat in auditor hours, not in storing more documents. That finding reoriented the roadmap before a line of UI was locked: compress the path from signal to signed decision, not the volume of documents the system could hold.

Designing for the model meant redesigning how information appears before deciding what information appears. The LLM could explain every regulatory gap in detail; dumping that on the auditor first was counterproductive. I designed traffic lights (green, amber, red) so status came first and detail only when needed. The model output became raw material; the interface was something else.

I kept the last word with the auditor and made that control the path of least resistance. The MVP that came out of that chain is what we used for executive alignment and global pre-sales with Tier-1 clients.