Frankfurt am Main Worked from Barcelona Built for BaFin and DORA scrutiny Same hour as us

Frankfurt.
BaFin-ready systems.

Frankfurt is the rare city where the regulator and the datacentre are both local. BaFin supervises the institutions, DORA governs how they manage the technology suppliers underneath them, and the largest cloud region in the EU sits on the edge of town. All three shape a build here, and the third one is the only one that makes life easier.

Last reviewed 5 September 2026 · Engineering guidance, not legal advice.

WHAT IS ACTUALLY DIFFERENT HERE

BaFin sits on top of the data protection regime

A Frankfurt institution is supervised for data protection by the Hessischer Beauftragter für Datenschutz und Informationsfreiheit and, separately, by BaFin for everything about how it is run. The financial supervisor has been consistent that existing expectations on governance, outsourcing and accountability apply to AI rather than being replaced by it. In practice that means a named accountable person, a human decision point wherever the output affects a customer, and records that let someone reconstruct a decision long after the person who made it has moved on.

DORA makes us an ICT third party before it makes us a supplier

Under the Digital Operational Resilience Act, an external firm touching your ICT arrangements is not just a vendor with an invoice. The arrangement has to be recorded in your register of information, the contract has to carry specific terms on access, audit and exit, and you have to be able to describe what happens if we disappear. We would rather have that conversation in week one than have procurement discover it in week nine. It also shapes the architecture: we build so that the running system does not depend on us, because an exit plan you cannot execute is a document, not a plan.

The compute is next door, and that is genuinely useful

Frankfurt hosts the largest cloud region in the EU across the major providers, alongside one of the world's biggest internet exchanges. Two things follow. New services and model endpoints tend to be available here early rather than late, so the argument about whether a European deployment means giving up capability is weaker here than almost anywhere. And network paths to your own datacentre are short, which matters when a hybrid design keeps the data in your estate and sends only the query out.

The trace is the deliverable

Regulated decisioning turns the usual priority order upside down. The model choice is the least interesting decision in the system; what matters is retrieval that cites its source, versioning that records exactly which prompt, which retrieval index and which model produced a given output, and evidence that a human reviewed the ones that needed reviewing. Model and third-party risk documentation is easier to produce from a system designed to emit it than to reconstruct afterwards from logs written for debugging.

THE WORK THAT COMES OUT OF THIS CITY

Nearly everything that reaches us from Frankfurt is a decision that has to be explained later. That single characteristic does more to determine the architecture than the sector label on the front of it.

In banking and asset management the recurring shape is a person reading a long document and then forming a judgement: a credit file, a suitability assessment, a set of transaction alerts, a fund prospectus against a mandate. A system that replaces the judgement is both harder to build and harder to defend than one that assembles the evidence, marks what it could not find, and puts a reviewer in front of the residual. The second one also fails more gracefully, which is the property you want when the failure is visible to a supervisor. That pattern is written down in our risk and compliance architecture, and the reporting end of it under regulatory reporting.

Insurers here bring claims and underwriting files with the same structure and a different vocabulary. Asset managers bring reconciliation and client reporting, where the volume is high and the tolerance for a quiet error is zero.

The other Frankfurt speciality is second-line work: model risk, third-party risk, and the documentation that has to exist for both. Institutions increasingly arrive not with a use case but with forty of them and no consistent way to describe, rank or evidence any of them. That is a governance build rather than a model build, and it is covered under AI governance. Where the question is instead about exactly which data crosses which border, data residency is the more useful starting point.

HOW A FRANKFURT PROJECT ACTUALLY RUNS

Discovery in person, with the second line in the room

Barcelona to Frankfurt is a short direct flight, and we come for the first workshop. The one thing we ask is that risk and compliance attend it rather than reviewing a design six weeks later, because almost every expensive change we have seen in this sector came from that meeting happening in the wrong order.

Then remote, on the same clock

No timezone offset at all. A question raised at nine in Frankfurt gets an answer that morning, and a review comment does not cost a day of calendar in each direction.

And back for handover

Handover includes the artefacts your own governance process needs — architecture, data flows, model and version records, and what the exit looks like — delivered as part of the build rather than sold as an extra. After that it runs in your accounts, under your change control.

QUESTIONS

QUESTIONS — 5

No. We have one office and it is in Barcelona. We travel to Frankfurt for discovery, for handover and for the workshops where regulated design decisions get made. Given how much of this page is about honest documentation, inventing a local presence would be a poor start.

As an ICT third-party service provider for whichever function the engagement touches, with the arrangement in your register of information and the contractual terms on audit, access, sub-contracting and exit that the regulation requires. We have no objection to any of them. The one we take seriously in the engineering rather than only in the contract is exit: the system is built in your cloud accounts and your repositories so that removing us is a commercial event, not a technical one. Your own resilience function owns the classification of whether the function is critical or important.

For storage, compute and retrieval, yes — this is the best-served region in the EU and it is unusual for something not to be available here. For hosted frontier models, availability by region does change, so we document which endpoint is being used, where it runs and what its retention and training terms say at the time of writing, and you should confirm those against the provider's current terms before signing. Where the answer is not good enough, a self-hosted open-weight model inside your own environment is the fallback and we will say so.

Nothing we have seen suggests a general objection. The consistent supervisory theme is that accountability cannot be delegated to a system: someone must own the outcome, the customer-affecting decisions need a human in the loop, and you must be able to evidence both. Those are design inputs, and they are cheaper to accept at the start than to retrofit. Whether a specific use meets your obligations is a judgement for your compliance function, not for your engineers.

Our ranges are on the pricing page, in euros and exclusive of VAT. We do not price by postcode. Regulated work does tend to sit at the upper end of a range, because the evidence and documentation are part of the build rather than a wrapper around it.

Keep reading

Industry

AI for Financial Services

30-minute technical call · no deck