01
EU data and model residency
The managed service, customer data and the standard language models are hosted and processed within the European Union.
DORA-compliant PowerPoint AI for banking teams.
Banks can use offgen as part of a fully DORA-compliant operating model. The review still has to cover the concrete use case, service classification, contract and customer controls. offgen supports that review with EU hosting, documented security controls and native PowerPoint output.
Can a bank use offgen in full DORA compliance?
Yes. offgen can be integrated into a fully DORA-compliant setup when the bank classifies the service and supported function, completes its due diligence, records the arrangement, agrees the applicable contractual clauses and operates the required internal controls. offgen provides the technical, organizational and supplier information needed for this assessment. The final decision remains part of the bank’s ICT risk management framework.
How offgen maps to a bank’s DORA review
BaFin highlights the full service lifecycle: ex-ante risk assessment, due diligence, contractual safeguards, ongoing monitoring, the Register of Information and an exit strategy for services supporting critical or important functions.
| DORA topic | What the bank assesses | What offgen provides |
|---|---|---|
| Classification and due diligence | The bank determines whether offgen is an ICT service and whether it supports a critical or important function. It evaluates security, concentration, location and dependency risks before signing. | Architecture, hosting boundary, processing locations, relevant suppliers, ISO 27001 status and security documentation for the scoped service. |
| Written contract | Article 30 requires a written agreement with clear service descriptions, data locations, security duties, availability, assistance and termination provisions. | Enterprise contracting can document the selected deployment, service boundary, processing locations, support model and the controls that apply to the agreed plan. |
| Register of Information | Article 28 requires financial entities to maintain a register of contractual arrangements for ICT services. | Provider, service, location, deployment and supplier information can be supplied for the bank’s register and procurement record. |
| ICT incidents and continuity | The bank needs notification paths, assistance for service-related incidents and continuity measures proportionate to the supported function. | Operational contacts, incident cooperation, availability and recovery responsibilities are documented for the scoped service. |
| Access, inspection and audit | For services supporting critical or important functions, Article 30 includes access, inspection and audit rights that must not be contractually impeded. | Current control evidence is available through the Trust Center. The appropriate audit and assurance approach is agreed during enterprise review based on scope and criticality. |
| Subcontracting | The bank assesses the ICT supply chain and applicable conditions for subcontracting, including risks to critical or important functions. | The relevant service and model boundaries, processing locations and supplier dependencies are disclosed for the scoped service. |
| Exit and termination | The bank plans how to leave the service without disrupting critical or important functions and defines return, access, migration and deletion requirements. | Generated work remains available as native .pptx files. Export, retention, deletion and transition support are defined for the contract. |
Controls for confidential banking presentations
DORA is broader than data residency. These controls reduce the specific operational and information risks created when deal teams, finance teams or committees use AI in PowerPoint workflows.
02
No customer-data training by default
Templates, prompts, financial context and generated presentations are not used to train the standard managed models by default.
03
Role-based access and traceability
Enterprise access controls, tenant isolation and audit logging support controlled use across deal teams, functions and legal entities.
04
Approved content boundaries
Teams can work from approved templates, slide libraries, wording and business context instead of sending presentation work to uncontrolled public tools.
05
Human review in PowerPoint
Outputs remain native and editable. Bank employees retain responsibility for figures, disclosures, approvals and the final communication.
06
Evidence for procurement
Security documentation, the Data Processing Agreement and current assurance material can be reviewed before deployment.
A practical DORA procurement process
The fastest review starts with the actual presentation workflow, not a generic vendor questionnaire. This keeps the assessment proportionate and makes contractual requirements concrete.
- 01
Classify the workflow
Define users, data categories, affected legal entities and whether the service supports a critical or important function.
- 02
Review the hosting boundary
Assess the documented EU hosting boundary for the service, customer data and standard language models against the bank’s risk appetite.
- 03
Complete evidence and contract review
Review controls, suppliers, locations, incident duties, assurance rights, subcontracting conditions and register information.
- 04
Test controls and exit
Validate access, logging, approved content, output handling, continuity assumptions and the practical route to export or terminate.
What “DORA-compliant” means here
offgen is designed to support the contractual, security, evidence and exit requirements relevant to an ICT third-party review. The bank must still decide how the concrete service is classified, which DORA provisions apply and whether its own configuration, permissions, retention and approval process meet those requirements.
Continue the banking review
Use the detailed architecture and evidence pages to validate the statements for your planned service scope.
Security controls
Review ISO 27001, encryption, access controls, isolation and audit logs.
EU hosting
Review the European hosting boundary for the service, customer data and standard language models.
European data sovereignty
Review jurisdiction, model residency, data control, portability and exit.
Trust Center
Request current security and procurement evidence.
DORA checklist for AI presentation software
Use our practical guide to review scope, contracts, the Register of Information, incidents, testing and exit planning.
DORA and offgen: banking questions
No standalone DORA software certification exists. DORA compliance is assessed for the financial entity, its ICT risk management framework and the concrete contractual arrangement. offgen can support a fully DORA-compliant deployment with scoped controls, evidence and contract terms.
The bank must classify the contracted service and its use. A continuously provided software or cloud service will generally require assessment as an ICT service. The bank also determines whether it supports a critical or important function.
The enhanced provisions in Article 30(3) apply when an ICT service supports a critical or important function. The baseline provisions in Article 30(2) apply more broadly. The bank must determine the classification and required clauses for its arrangement.
Yes. offgen can provide the service, provider, hosting location and relevant supplier information needed for the bank’s record. The bank owns and submits its Register of Information.
No. EU hosting creates a clear jurisdiction and processing boundary, but DORA also covers governance, due diligence, contracts, incidents, testing, monitoring, audit rights, subcontracting and exit planning.
Yes. The core work product is a native, editable .pptx file. Data export, retention, deletion and transition support are defined in the selected plan and contract.
The bank does. offgen assists with controlled creation in approved templates. Users remain responsible for source data, financial figures, disclosures, approvals and the final presentation.
Official DORA sources
The page reflects the regulation and current supervisory guidance. Legal and compliance teams should assess the latest official texts against the specific deployment and contract.
Review offgen against your DORA scope
Bring the intended users, data classes, supported function and hosting preference. We will map the service boundary and the available evidence to your review.
Book a demo
Choose a time and share how your company creates PowerPoint presentations today.
We will map your PowerPoint knowledge base, MCP use cases, governance rules, and first agentic presentation workflow.
In 30 minutes, you will see
How existing masters, templates, slide libraries, and approved content become a Company Brain
How people and AI agents can create native PowerPoint presentations through MCPs
How brand governance, editability, human review, and enterprise security work together