The agent is a subcontractor — Deutsche Bank co-designs Google's finance agent, and DORA is the clock that already ran out

Google Cloud launched Gemini Enterprise for Financial Services on 25 August 2026 with Deutsche Bank as a named key design partner, deploying a Google-managed Financial Research agent in the Corporate Bank for German MidCorp clients — and the instrument that binds the bank is not the one the coverage reaches for. Article 25(1) of the AI Act converts a deployer into a provider only by name, substantial modification or changed intended purpose, none of which is contributing requirements, and Annex III 5(b) reaches creditworthiness of natural persons rather than corporate research. DORA has applied since 17 January 2025: Article 30(2)(a) makes the contract state whether subcontracting of an ICT service supporting a critical or important function is permitted, 30(2)(b) makes it name the countries where those functions run and data is processed, 28(3) puts every such arrangement in the register of information and 28(8) demands a tested exit strategy — so the five third-party agents from four outside firms that ship beside Google's own are a subcontracting chain that can grow without a contract amendment, and Google Cloud EMEA's own CTPP designation and Lead Overseer, in Google's words, "does not replace your own responsibilities under DORA".

Post

Deutsche Bank helped design a Google agent, then put it in the Corporate Bank. The compliance question everyone will ask about it is the wrong one.

On 25 August, Google Cloud launched Gemini Enterprise for Financial Services: 50+ purpose-built financial skills, 13 connectors to market data, filings and internal databases, and a Google-managed Financial Research agent. Deutsche Bank is named a key design partner — in its own words it helped shape requirements around security, auditability, data residency and user needs. First deployment: the Corporate Bank, serving German MidCorp clients.

Three corrections before you reach for the AI Act.

  1. Co-design does not make you a provider. Article 25(1) converts a deployer into a provider in three cases: your name goes on it, you substantially modify it, or you modify the intended purpose so it becomes high-risk. Writing requirements is none of them.

  2. It probably is not high-risk anyway. Annex III 5(b) covers creditworthiness of natural persons. MidCorp clients are legal persons, and a briefing agent is not scoring anybody.

  3. The instrument that binds here is older and has no transition left. DORA has applied since 17 January 2025.

DORA is where the agent roster becomes the problem. Beside Google's own agent, the platform ships five third-party agents from four outside firms — Dun & Bradstreet, FlowX, Obin, S&P Global. Article 30(2)(a) says the contract has to state whether subcontracting of an ICT service supporting a critical or important function is permitted at all. Article 30(2)(b) says it has to name the countries where those functions run and the data is processed. Article 28(3) puts every one of those arrangements in your register of information.

Google Cloud EMEA was designated a critical ICT third-party provider on 18 November 2025 and has its own Lead Overseer. Google's own wording: that oversight "does not replace your own responsibilities under DORA."

What I would do Monday:

  1. Put every third-party agent in the register as a subcontractor, not a platform feature.
  2. Check the contract names countries, not just a cloud region.
  3. Test the exit strategy against the agent and its grounding, not the infrastructure.
  4. Keep Article 26 logs regardless. Annex III moves on 2 December 2027 and your use cases will drift first.

An agent marketplace is a subcontracting chain that grows without an amendment.

Which of your agents is in the register?

#DORA #AIAct #AgenticAI #EUCompliance #FinTech

First comment

Sources.

Google Cloud's own launch release, 25 August 2026 — the 50+ financial skills, the 13 connectors, the Google-managed Financial Research agent, and the five third-party agents from D&B, FlowX, Obin and S&P Global: https://www.googlecloudpresscorner.com/2026-08-25-Google-Cloud-Launches-Gemini-Enterprise-for-Financial-Services

Deutsche Bank's own release, same day — "key design partner", the security/auditability/data-residency requirements it shaped, and the Corporate Bank MidCorp deployment: https://www.db.com/news/detail/20260825-deutsche-bank-helps-shape-google-cloud-s-new-ai-solution-for-financial-services?language_id=1

DORA, Regulation (EU) 2022/2554. Article 28(3) is the register of information, 28(8) the exit strategy, 30(2)(a) the subcontracting permission and 30(2)(b) the locations clause. Article 64 gives the application date, 17 January 2025: https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng

The ESAs' designation of critical ICT third-party providers under DORA, 18 November 2025: https://www.eba.europa.eu/publications-and-media/press-releases/european-supervisory-authorities-designate-critical-ict-third-party-providers-under-digital

Google's own post on that designation — Google Cloud EMEA Limited and its subsidiaries, a dedicated Lead Overseer, and the sentence that oversight "does not replace your own responsibilities under DORA": https://cloud.google.com/blog/products/identity-security/supporting-customers-as-a-critical-provider-under-eu-dora

Commission Delegated Regulation (EU) 2025/532, the RTS on subcontracting ICT services that support critical or important functions — what you have to assess before you permit it. Adopted 24 March 2025, in force since 22 July 2025: https://eur-lex.europa.eu/eli/reg_del/2025/532/oj

AI Act Article 25, the three ways a deployer becomes a provider: https://artificialintelligenceact.eu/article/25/

AI Act Annex III, point 5(b) — creditworthiness of natural persons: https://artificialintelligenceact.eu/annex/3/

One point cut for length: there is an Article 50 thread here too, but it points at Google rather than at the bank. Article 50(2) puts machine-readable marking of synthetic output on the provider of the generating system, and Article 50(4)'s deployer duty is about text published to inform the public on matters of public interest. A client briefing is neither published nor public-interest, so the bank's transparency exposure is thinner than the launch coverage implies — which is exactly why the DORA paperwork is the part worth doing this week.

Claims

Sources

Corrections

  • Took the launch date from Google Cloud's own press corner release and Deutsche Bank's own release, both 25 August 2026, not from the aggregator listings that placed it on 26 or 27 August. A coverage date is not an event date.
  • Did not treat co-design as a provider trigger. Article 25(1) is quoted in full in the archived source; contributing requirements matches none of its three circumstances, and the article only operates on high-risk systems in the first place.
  • Did not assert the Financial Research agent is or is not a high-risk system as a verified claim. What is claimed is the wording of Annex III 5(b) — creditworthiness of natural persons — and that MidCorp clients are corporate. The inference that the agent falls outside Annex III is presented as the edition's argument, not as a claim about Google's system.
  • Did not take the identity of any designated CTPP from the ESAs' press release, which does not name providers in its body. Google Cloud EMEA Limited is named from Google's own post about its own designation.
  • Dropped the Official Journal publication date of 2 July 2025 for Delegated Regulation (EU) 2025/532, which came only from law-firm commentary. The EUR-Lex record supports the act date of 24 March 2025 and entry into force on 22 July 2025, and only those are used.
  • Used artificialintelligenceact.eu solely for the verbatim text of Article 25(1) and Annex III point 5, graded secondary. No date comes from that site. The 2 December 2027 Annex III date is carried from CLAIM-2026-08-23-08, verified against Regulation (EU) 2026/1744 on EUR-Lex.
  • Did not repeat Google's marketing line that the platform is "engineered from the ground up to address key regulatory and data residency requirements". It is vendor language about vendor architecture and it is not evidence about the deployer's obligations.
  • Issued new cite keys for all eight new sources after checking the published vault: none of these URLs was previously archived, and no existing key was overloaded.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice and the cover art is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.