TOPIC
DORA Article 5 board accountability, BCBS 239 risk-data aggregation, third-party concentration risk, exit testing, and the engineering controls that turn operational resilience from a compliance project into a supervisor-ready scoreboard.
From 12 January 2027 cloud switching charges are abolished, egress included. The cost defence that kept DORA exit plans theoretical expires with them.
On 11 September the CRA starts a 24-hour reporting clock. It attaches to products, so the DORA carve-out that spares banks from NIS2 never reaches it.
A 2026 banking resilience index combining AI risk, cloud concentration, quantum-safe security, payment continuity, and critical third-party dependency.
A 2026 cloud native banking index for measuring DORA readiness, platform engineering maturity, cloud concentration risk, exit evidence, and operational resilience.
DORA, the EU AI Act, GDPR, cloud concentration risk, and data sovereignty are converging into one 2026 compliance stack for banks.
Cloud architecture in 2026 has crystallised around six pillars: AI-native infrastructure, intelligent multi-cloud, serverless-first design with WebAssembly at the edge, edge computing, automated security with crypto-agility, and sustainable high-density operations. For banks, the question is whether to consume cloud or design it — under converging pressure from agentic commerce, agentic unit economics, harvest-now-decrypt-later quantum risk, MCP security and algorithmic contagion, cryptographic agent identity, continuous-treasury demands, and the EU AI Act.