Grant Thornton
DORA Compliance at Scale
How AI agents mapped 500+ regulatory requirements to client controls in days.
The Challenge
The Digital Operational Resilience Act (DORA) is the EU's new regulation for financial services IT resilience. It introduces hundreds of new requirements that firms must map to their existing controls.
Grant Thornton's compliance practice was helping clients prepare for DORA. The challenge: manually reading the regulation, extracting requirements, and mapping them to existing control frameworks was taking weeks per client.
They needed a solution that could parse complex regulatory text, extract specific requirements and obligations, map requirements to standard control frameworks (COBIT, ISO 27001), and identify gaps in existing controls.
The Solution
We built a compliance mapping agent that automates the heaviest parts of the analysis:
Regulatory Parser
Reads DORA regulation and technical standards. Extracts 500+ specific requirements. Categorizes by theme, entity type, and timeline.
Control Mapper
Maps each requirement to relevant control frameworks. Suggests existing controls that address each requirement. Identifies gaps requiring new controls. Generates client-ready documentation.
The Results
"We used to spend weeks on the initial mapping. Now we spend that time on higher-value advisory work."