The supervisor already asked who holds the switch.
DORA treats your AI vendor as an ICT provider wherever the model runs. On Kernwall OS the model runs on an appliance in your own room, so the contract's location answer is that room, and when the contract ends the box keeps answering.
Who holds the switch
This summer, model access became a resilience question.
The ECB President said so on 1 Oct 2026, pointing at an event in June.
“Since this summer, it no longer is.”
Christine Lagarde on who controls access to the models banks rely on: the question “was once hypothetical”. Nearly nine in ten significant euro-area banks use AI, and Europe should not depend on “a switch controlled elsewhere”.
Two frontier models, switched off for every customer.
A US export-control directive required a licence for foreign nationals to use two models. Their provider could not check nationality in real time, so it disabled both worldwide. One came back globally from 1 Jul; the other only for some US organisations.
Lagarde's speech names the risk and no fix. Ours is plain: open weights already on your appliance keep answering when an API is switched off, because nothing on the box calls out.
BaFin · Dec 2025
BaFin compared on-premise, tenant and API. Its on-premise risks read like a spec.
Its guidance on AI under DORA walks one case through three ways of running an LLM assistant and names the main risk of each. It recommends none of them.
The model runs in your own infrastructure
All data flows stay inside the firm's own infrastructure, with full control over the ICT assets.
Staff who can run open-source models; attack exposure if the assistant is not securely built and kept updated; capacity that only grows with new hardware.
“wenn der KI-Assistent nicht sicher implementiert und fortlaufend aktualisiert wird”The model runs in your tenant at a provider
Data stays in the firm's tenant; the provider operates the platform underneath.
Strategic dependence on the model's operator, unless the model is open source.
The model sits with its provider
Prompts and documents leave the tenant for the model provider's service.
The main risk is that data leaves the tenant and flows to the model's provider. Mitigations: filters, upload limits, lower data classes.
“Das wesentliche Risiko in dieser Variante ist, dass Daten den Tenant verlassen und zum Anbieter des Modells fließen.”- Skills
- A packaged appliance: the OS, runtime and models arrive as one signed image, so the bank runs a box, not an open-source stack.What is in the image
- Attack exposure
- A read-only image with measured boot, signed updates carried in by hand that roll back, and access logged on the box.The update and trust model
- Capacity
- Sized before purchase against users and models, from published GPU and memory figures, and re-sized when load grows.Size a box
BaFin lays the three variants out neutrally and calls its guidance a non-binding aid. The answers above are our design targets against its list, not anything BaFin has reviewed.
Why now
Three dates have passed. One is on the calendar.
A document assistant for policies, KYC files and regulatory questions is not high-risk under the AI Act on its own. Credit scoring and insurance pricing are, from Dec 2027.
- Jan 2025DORA applies: every ICT provider goes in the register.
- Nov 2025The ESAs named 19 critical ICT providers.
- Dec 2025BaFin: AI systems are ICT systems under DORA.
- Dec 2027Credit scoring and insurance pricing AI become high-risk.
First job
Read the file, list the gaps. An analyst signs.
Summarising a client file for its periodic review, with every line cited to a document, is the kind of job the appliance is built for first. The window runs one.
Summarising and finding documents is not an Annex III use. Scoring a person's creditworthiness or pricing their life or health insurance with the model would be high-risk, from 2 Dec 2027.
DORA Art. 30 · BaFin guidance
What your outsourcing and ICT-risk teams will put in the contract.
Art. 30(2) applies to every ICT contract; 30(3) adds terms where the service supports a critical or important function. Each row maps a clause to the control designed for it and who carries it.
- DORA Art. 30(2)(b) · Location
Every ICT contract names where the service is provided and where data is processed and stored, with notice before that changes.
SharedOne answer for the life of the contract: the bank's own room. The appliance opens no outbound connection, so no data is processed anywhere else.
Evidence you take awayEgress audit report; listening-services manifest per release
- DORA Art. 30(2)(d) · Data access and return
Access to, recovery and return of the bank's data, including when the provider fails or the contract ends.
Your site owns itNothing to return: prompts, documents and logs never leave the appliance's encrypted disks, and the drives stay with the bank when a unit goes back.
Evidence you take awayStatement of no vendor access; drive-retention repair policy (planned)
- DORA Art. 30(2)(f) · Incidents
The provider helps with ICT incidents at no extra cost or at a cost agreed in advance.
Kernwall OS builds itIncident help is part of the support subscription, at a price agreed up front. With no vendor access to the box, that help works through the bank's own staff or on site.
Evidence you take awaySupport terms in the contract (planned)
- DORA Art. 30(2)(h) · Termination
Termination rights and minimum notice periods, as the supervisor expects.
Kernwall OS builds itEnding the contract stops signed updates. The appliance keeps running its last signed image and the open-weight models already on it.
Evidence you take awayTermination clause (planned); last-image behaviour in the release notes
- DORA Art. 30(3)(c) · Contingency and security
For critical or important functions: tested business-contingency plans and appropriate ICT security measures.
SharedA read-only image with measured boot and A/B updates that roll back. A second appliance is the fallback the bank's plan can test.
Evidence you take awayBoot measurements per release; rollback in the release notes
- DORA Art. 30(3)(e) · Audit rights
For critical or important functions: unrestricted rights of access, inspection and audit.
SharedThe box is on the bank's premises, so auditors inspect it there. Release contents, signatures and the build's software bill of materials are published per release.
Evidence you take awayRelease ledger with signatures and SBOM; on-site inspection
- DORA Art. 30(3)(f) · Exit
For critical or important functions: exit strategies with a mandatory transition period.
Your site owns itThe bank owns the hardware and the open-weight models outlive the contract. Moving to another stack means copying documents off a box the bank already holds.
Evidence you take awayExit plan template (planned); model licence per catalog entry
- BaFin guidance ch. V.1 · Logging
Log the system's relevant output and calls for later analysis; risk-based, complete logs of AI decisions and model versions.
“…Protokollierung des relevanten Outputs des KI-Systems…”
SharedPrompts, answers, user and model version are logged append-only on the appliance, kept as long as the bank sets. No copy sits with a vendor.
Evidence you take awayHash-chained log export; retention setting per appliance
DORA contract clauses and BaFin's logging line mapped to appliance controls.
Signed updates and support are an ICT service, so Kernwall OS goes in your register of information like any other provider, as on-premise software (service type S13), and signs the Art. 30 clauses. What changes is the answers.
Test it
Bring your register entry to a pilot.
Tell us which functions the assistant would support and what your outsourcing team checks. The pilot runs on your hardware, inside your wall, against that list.