DORA pushes ICT risk, third-party concentration, and incident readiness into the board conversation. For portfolio platforms, the quiet killer is unnecessary data gravity: every vendor-hosted ledger copy expands the blast radius of an ICT event.
The EU AI Act raises the bar on transparency, risk classification, and human oversight for AI systems touching financial decisions. BYOC + stateless inference with minimized context is a structural control: less retained personal data outside the buyer perimeter, clearer processor boundaries, and auditable request/response scopes.
Open Portfolio positions wealth operators to adopt AI assistance without converting every client CSV into a permanent training or warehousing surface. Pair this pillar with Architecture and Tier 1 Design Partnership for diligence-ready narratives.