The median institution shares AI dependencies with 300 other institutions.
DORA Articles 31 to 44 establish the framework under which the European Supervisory Authorities may designate a third-party ICT provider as critical to the financial system. Designation triggers joint oversight under the Lead Overseer mechanism, including the right to perform on-site inspections of the designated provider and to require remediation plans for institutions dependent on it. The designation criteria draw on multiple inputs including the systemic impact on the stability or continuity of financial services. The Meridian substrate operationalises this criterion at the agent level. A pairwise institutional link exists between two regulated institutions when both deploy AI agents through the same vendor. Cross-institutional propagation of any vendor-side governance event is bounded above by the pairwise link count. Hyperscaler A generates 85,491 such links across the regulated financial population. The next-largest vendor group generates 10,296. The substrate is provided as evidence input to designation analysis, not as a designation conclusion. The threshold shown on the chart is illustrative.
Each bar shows the count of pairwise institutional links generated by shared dependency on the named vendor group across the v13.1.0 sealed substrate. The dashed vertical line represents an illustrative designation threshold; the actual ESA designation criteria are multi-factor and set out in Commission Delegated Regulation under DORA Article 31. The status pills indicate where the substrate evidence places the vendor group: designation candidate, ongoing monitor, or below threshold. The metric is independent of agent count and measures the structural concentration risk that the bilateral framework of DORA Article 28 was not designed to address.