Využití AI pro digitální provozní odolnost finančního sektoru (DORA)

This master's thesis explores the possibilities of using generative artificial intelligence to support meeting DORA requirements. The aim of the thesis is to analyze selected, practically significant DORA requirements and, based on this analysis, to design, implement, and experimentally evaluate a prototype of a conversational assistant based on the Retrieval-Augmented Generation (RAG) architecture. The theoretical part summarizes the DORA legislative framework, focusing on ICT risk management, incident classification and reporting, digital operational resilience testing, and ICT third-party risk management. The practical part describes the design of the knowledge base, the iterative development of a chunking strategy, the configuration of the retrieval pipeline in the Dify environment, and the use of query rewriting and reranking. The prototype was evaluated on a dataset of 15 test scenarios using the RAGAS framework, supplemented by a manual citation audit and a pilot expert evaluation with two respondents. In its final configuration, the prototype achieved the following metric values: average faithfulness of 0.75, answer relevancy of 0.56, context precision of 0.73, and context recall of 0.58. The introduction of a query rewriting layer resulted in a 102% increase in context recall. A manual citation audit demonstrated full citation accuracy in 60% of the answers and partial accuracy in another 33%, with the identified limitations concentrated around queries requiring specific provisions from the main DORA text. The pilot expert evaluation suggests that the tool can shorten the initial desk research phase, especially for users without detailed knowledge of the regulation. Based on the design and evaluation conducted, it can be concluded that a no-code/low-code RAG approach is technically feasible for DORA related use cases, with the greatest challenge remaining retrieval over extensive documents and synthesis across multiple sources. Its practical application should be understood as support for initial orientation, not as a substitute for professional regulatory assessment.