One map for operational resilience and AI.

Two regimes, one underlying artefact

The UK operational resilience regime has been fully in force since 31 March 2025, the end of the transitional period during which firms had to be able to remain within their impact tolerances for each important business service. DORA has applied across the EU since 17 January 2025.

They are different instruments with different emphases. The UK regime is outcome-focused and service-centred: identify your important business services, set an impact tolerance for each, map what supports them, and test that you can stay within tolerance under severe but plausible disruption. DORA is more prescriptive and ICT-centred: ICT risk management, incident classification and reporting, digital operational resilience testing, third-party risk, and information sharing.

What they share is a dependency. Both are evidenced through a granular, current, maintained understanding of how work actually runs: the processes, the people, the systems, the third parties, the controls, and the points at which it fails.

A firm in scope of both often commissions two mapping exercises, in two formats, owned by two teams. One well-built map can serve both.

The obligations mapping below sets out what the map needs to be able to answer for each area.

Where the resilience map and the AI question converge

The overlap is larger than many firms notice, because the two exercises are usually commissioned by different people at different times.

Resilience mapping asks: what is this process, who owns it, what does it depend on, what controls sit on it, and how does it break?

An AI opportunity assessment asks: what is this process, who owns it, what does it depend on, what controls sit on it, and which steps could a machine do?

Five of six inputs are identical. Only the final question differs. Captured once, properly, with owners, controls, volumes, dependencies and exception paths, the same structured record answers both, and continues to answer both as the firm changes. The scoring method is applied to that same map.

Keeping the map current

A common pattern we see: a mapping exercise is commissioned, runs for eight weeks, delivers a set of documents, and is filed. Within two quarters the firm has changed, the documents stay as they were, and the next regulatory question starts a fresh exercise from close to zero.

The answer lies in the container. A map delivered as a document is seldom opened again. A map that is the operating record, one that gets consulted when something changes, re-scored when a process is redesigned, and cited when someone asks how a decision was made, stays current because using it and maintaining it are the same act.

The practical route

Start with one important business service. Map the processes that constitute it to the level of detail a scenario test would need. That includes the steps that run on email, spreadsheets and portals, which is often where a breach of tolerance begins. Record owners, controls, dependencies and volumes as you go, because capturing them early costs less than retrofitting them.

Then score the same map for AI and automation potential. You will have paid once for an artefact that serves the resilience obligation, the AI decision, and the next reorganisation.