AI in banking and insurance: DORA, data protection and control in-house.
Policies, tariff terms, circulars: in banks and insurers the right rule makes the right answer. RAGSuite finds it with a source, and runs in your data centre, with an audit log for internal audit and supervisors.
Open source under Apache 2.0 · makes the DORA exit strategy easier
„What notice period applies to the Instant Access Plus account?“
The account can be closed any day. The balance is paid out within two banking days.
„How long do we keep advice records?“
Under policy R-12, ten years from the end of the meeting year, in the customer record.
„Whom do I tell if I suspect phishing?“
Call the Security Operations Center on 4400 straight away. Don’t open or forward the email.
Key takeaways
- Besides the GDPR and banking secrecy, DORA has applied since 17 January 2025; BAIT is phased out by the end of 2026.
- RAGSuite runs on your servers. The audit log records access and changes, in Enterprise with export.
- Self-hosted software still belongs in the DORA register of information; RAGSuite processes none of your data.
- Open source under Apache 2.0 makes the exit strategy easier.
Which rules apply to AI in banks and insurers?
Banks and insurers use AI under strict supervision. These rules shape every decision:
Data protection and secrecy
Besides the GDPR, banking secrecy applies. Staff of private health, accident and life insurers are bound by secrecy under section 203 StGB.
DORA
Since 17 January 2025 DORA requires ICT risk management, oversight of ICT third-party providers, a register of information and exit strategies.
BaFin
The former IT circulars merge into DORA: VAIT, KAIT and ZAIT no longer apply since January 2025; BAIT is phased out by the end of 2026.
EU AI Act
AI for creditworthiness checks or for risk assessment and pricing in life and health insurance is high-risk. A knowledge assistant for policies usually is not.
AI in banks and insurance: what institutions use it for.
Policies and work instructions
Your written rules by question: the valid rule with a source, instead of searching the intranet.
Advice and service
Product and insurance terms, tariffs, processes: correct answers in customer conversations.
Compliance and audit
Find circulars, internal rules and audit reports fast, with a traceable source.
IT and information security
Emergency manual, authorisation concepts, procedures: answers for the service desk and in an emergency.
Data protection and evidence in-house.
RAGSuite runs on your servers or on rented servers with a host of your choice, air-gapped if you like. With a local language model no request leaves your network. Roles and teams control who sees what; the audit log records access and changes, in Enterprise in full and with export for internal audit and supervisors.
For content without customer data, such as public product information, you can also use RAGSuite Engine. RAGSuite is then an ICT third-party provider that processes data. For customer and contract data we recommend running it in your own data centre.
| Time | User | Action |
|---|---|---|
| 24 Sep 09:14 | a.weber | Source added |
| 24 Sep 08:52 | a.weber | Role changed |
| 23 Sep 17:30 | p.neumann | Model switched |
| 23 Sep 11:05 | a.weber | Retention changed |
| 22 Sep 16:48 | l.hoffmann | Sign-in |
| 22 Sep 10:12 | a.weber | Export created |
What your information security team settles before the start.
Tick off what you’ve already clarified. Nothing is stored.
Why open source makes the exit strategy easier.
DORA requires that you can switch or replace an ICT provider without putting operations at risk. With self-hosted RAGSuite, data and index already sit on your servers, and the core is open source under Apache 2.0. You can keep running the Community Edition without a contract with us.
Questions about AI in banking and insurance.
May banks and insurers use AI under the GDPR?
Yes, if the legal basis, secrecy and data flow are clarified and supervisory rules are met. It is simplest when the AI runs in-house and no customer data goes to third parties. Clarify the use with data protection and information security. This is general information, not legal advice.
What do banks use AI for today?
Mainly for knowledge in policies, work instructions and circulars: staff find the valid rule with a source, in customer conversations, in compliance and at the service desk. Such assistants do not decide about customers and so usually stay outside the high-risk rules of the EU AI Act.
Does RAGSuite belong in the DORA register of information?
Usually yes, because software licences and support are ICT services too. With self-hosted RAGSuite we process none of your data, and operations do not depend on our infrastructure. That makes assessing criticality and planning your exit strategy for the provider much simpler.
Is an AI assistant for policies a high-risk system?
Usually not. In finance, high-risk mainly means AI for checking creditworthiness and for risk assessment and pricing in life and health insurance. An assistant that answers questions from policies does not decide about customers. Check your case with our free risk class check.
How do we show internal audit and supervisors what the AI does?
Every answer names its source, and the audit log records access and changes. In the Community Edition you see the last 15 days; in Enterprise, the full log with export. Query tracing adds which passages led to an answer, step by step.
AI for your institution, with evidence for audit and supervisors.
We show you RAGSuite with policies like yours and go through your information security team’s questions with you.