Barings automates DORA compliance with AI Agents

The challenge

When the Digital Operational Resilience Act (DORA), an EU regulation governing third-party technology risk in financial services, came into effect, Barings faced a challenge in maintaining compliance across their organization. As a global asset management firm operating in multiple regions, they were heavily impacted. The regulation required documented evidence of controls and governance over all third-party in scope vendors, an ongoing register, and a formal due diligence process for every new purchase.

Barings manages relationships with approximately 2,000 vendors, meaning implementing and maintaining this level of governance was a large undertaking. Just determining which ones were in scope for DORA required outsourcing to an external legal firm at a significant cost  before Barings could even begin the internal task of  populating the required register.

"It was very manual and frankly external. We had to pay legal firms to tell us whether or not each vendor was in scope for DORA," noted one employee of Barings. "Time-wise, it was easily a full-time job."

For Barings, the manual workload was relentless. Every new vendor request required a manual review of contracts and documentation. The process created downstream bottlenecks and  category managers often didn't know which DORA addendum to attach to a new contract until late in the negotiation.  

As Barings continued growing rapidly, with approximately 170 new vendors being onboarded in 2025 alone, the team knew this manual approach would not scale. Something had to change.

The solution

In early 2025, with a deadline looming to file their annual DORA register, Barings discovered that Zip had released a DORA AI agent. The timing was almost uncanny.

As one Barings employee notes, "the timing couldn't have been better."

Barings was able to build out two workflows in parallel. The first tackled the backlog: all 170-plus newly onboarded vendors were run through a purpose-built DORA assessment workflow. The second embedded the DORA Agent directly into Barings' standard request-to-purchase and renewal workflows, ensuring every future vendor purchase would be automatically screened. 

"After a category manager verifies the request, if it meets the conditions, such as the subsidiary, and the vendor hasn't already been checked,  the DORA Agent runs in parallel with vendor due diligence, legal, and infosec review," one Barings employee explains.

The agent reads contracts, invoices, and supporting documentation, then classifies each vendor as in-scope, needs more information, or out of scope. Out-of-scope requests flow straight through without ever touching the team, and only in-scope or uncertain cases are routed to an employee for for a secondary review.

The Barings team didn't stop at the base agent. Working in Zip's App Studio, they extended the workflow to automatically update DORA status fields on both the vendor record and the individual request, ensuring the same vendor would never need to be re-screened on future requests.

As explained by one Barings employee "After it runs, it takes the results of the agent and updates the relevant field. If it comes back “in scope”, the agent marks the request and the vendor. If it comes back “out of scope”, it just keeps going.” The result: a filter that gets smarter over time, automatically routing only the requests that truly need human judgment.

Another Barings employee noted that "We had to not only help people understand DORA, but also educate them on what an AI agent can actually do,It was definitely trial and error — showing it, letting people play with it, getting their feedback, and layering more on." What ultimately converted skeptics was “seeing citations in action, pointing to the exact citations on the specific page.”

Barings is also piloting a Pre-Fill Agent that automatically populates the DORA register from assessment data. The register, which consists of a sprawling spreadsheet with 50 to 75 columns per vendor, remains one of the most time-intensive parts of the process.

Most companies still have to create their register manually, but with the Pre-Fill Agent, Barings is hoping that it will save an exponential amount of additional time.

The result

Zip’s AI Agents’ impact at Barings has been meaningful, most notably around the workload needed to meet the relevant regulatory requirements and reviews.  Before the DORA Agent, an employee would have to manually review 10 to 15 vendor requests per week for DORA compliance. Today, the reviews are cut down to just one or two on average: an overall reduction of roughly 90%. The vendor-level DORA flag built by Barings means already-assessed vendors don't require a second look and out-of-scope requests never require review under DORA.

This allows Barings to focus on building better processes and other strategic work instead of tactical data entry. 

Additionally, the team no longer relies on outside resources or additional headcount to help meet its regulatory requirements.  Barings estimates they’ve seen a 2400% ROI in cost savings/avoidance by not adding additional headcount. Barings still has a human in the loop at the end, but all the rigor of the review and the classifications of the vendors is being done by the Agent.

The contract process was transformed as well. Category managers now know exactly which DORA addendum applies before negotiations conclude. 

With intake and contract orchestration already in their sights, the Barings procurement team is just getting started.