Welcome and introductions
Participants’ experiences, aims and introduction to the AI Workshop Assistant.
Two-day programme
Workshop agenda
Presentations, discussion and five group exercises over two days. Session durations are indicative; breaks and start times are not specified here.
How the agenda works
Each day contains 4 hours and 30 minutes of scheduled content plus breaks. The updated group-work handout governs the exercise details, including the simplified register exercise without mandatory Excel completion.
11 November 2026Day 14 h 30 min sessions
plus breaks
plus breaks
DORA as an implementation project
Governance, management responsibilities, resources, gaps and prioritisation.
Exercise 1 · Design AHB’s DORA implementation project
Agree on three first workstreams, responsibilities and two board decisions.
What does DORA mean by ICT services?
ICT services, third-party providers, subcontracting and critical or important functions.
Exercise 2 · Map ICT services and critical functions
Map five providers to ICT services and AHB functions; document two information gaps.
The DORA register of information
Purpose and linked templates, functions, contracts, providers and data quality.
Exercise 3 · Draft key information-register entries
Create selected entries for FinCore and a three-item data request; no Excel completion required.
Contractual requirements
Requirements, contract inventories, amendments and ongoing provider engagement.
Contracts, monitoring and practical questions
Facilitated questions and exchange on third-party arrangements.
Day 1 review and peer exchange
Consolidate practical lessons and implementation priorities.
12 November 2026Day 24 h 30 min sessions
plus breaks
plus breaks
Recap and introduction
Review Day 1, open questions and goals for Day 2.
ICT-related incident reporting
Detection, classification, reporting, escalation and communications.
Exercise 4 · Respond to an ICT incident — and reassess
Assess a FinCore outage in two stages with updated incident facts.
Testing, vulnerability management and strong authentication
Risk-based testing, remediation and access protection.
Exit strategies under DORA
Exit scenarios, transition planning and hard-to-substitute core services.
Exercise 5 · Prepare a credible exit strategy for FinCore
Choose a feasible exit route, continuity measures and immediate owners.
ICT risk management framework in practice
ICT strategy, control function and manageable implementation tasks.
Oversight of critical ICT third-party service providers
Designation, ESA oversight and implications for banks.
Final review, implementation support and next steps
Five major challenges, Practical Guides, resources and final questions.
Get ready for the group exercises
Read the shared AHB profile and download the updated workshop handout before the sessions.