Mettle

Stream

Regulation and compliance

Every obligation traced to the text of the law and documented for sign-off. With the Mindstreet team.

4DORA foundations delivered: the function register, traceability from obligation to work item, the impact analysis and the decision forum.

DORA puts much of its detail in technical standards and in the Q&As of the EU supervisors, and your firm has to stand behind the register and the recovery times it builds from them.

On a DORA programme Mettle works from those texts to a function register in the format of the register of information, a business impact analysis with recovery times, and a first classification of systems.

Mettle also built MetLex: it gives an AI tool the text of DORA, its technical standards, the GDPR and the FFFS (the rules of Finansinspektionen), with official links, so an answer arrives with the provision attached.

Mettle starts from the text of the law and takes the result, in writing, to the people who must approve it.

Packages

A scope and a price agreed before each phase starts. Joakim leads every package in person.

DORA groundwork

Delivery Typically 6–10 weeks

Banks, payment and credit institutions, fund managers, investment firms and insurers under DORA.

You get

  • A function register in the format of the DORA register of information
  • An impact analysis with recovery times, and a first classification of systems

Previously

Took the first draft of the function register to approval by the head of product and technology and the IT security lead. A Swedish financial firm, 2026

For financial firms, as part of the Mindstreet team.

Available advisorWhere Joakim has done it 

Ask about this Read about the package

Also useful in this stream

  • Transformation delivery A change across systems, teams and suppliers, from plan to cutover.Typically from 3 months, full or part time
  • Interim CTO Engineering without a leader, or a structure that no longer fits.Typically 3–9 months, full or part time
  • Second opinion A project or system in doubt, with a decision ahead.Typically 2 weeks

Approach

See all
  1. Start from the whole textMettle works from DORA together with its technical standards and the Q&As of the EU supervisors (ESAs). The rules on logging, for one, are in Delegated Regulation (EU) 2024/1774, not in DORA itself.
  2. Obligations traced to the workMettle traces obligations to the governing document that meets them and the work item that proves it. At a Swedish financial firm Joakim also brought the product and technology organisation into the ICT governing documents, with a daily cross-team stand-up.
  3. Compliance inside the workflowAt Nord Fondkommission Joakim set up sign-off by UX, compliance and the business in native Jira workflows, so the approvals are recorded with the work. There Joakim also set up policies for MiFID II, GDPR and ISO 27001.

Cases

See all
A Swedish financial firm (Mindstreet team), 2026The function register: first draft taken to approvalIn its authorisation programme, a Swedish financial firm needed its function register, impact analysis and system classification. Joakim joined as ICT project manager, as part of the Mindstreet team.Read the case Own product (MetLex), 2026DORA answers that arrive with the provision attachedSome answers sit outside DORA itself: in the technical standards, the ESA Q&As and, for Swedish firms, the FFFS. In the MetLex test, most misses from memory fell right there.Read the case BNP Paribas Personal Finance Nordic (Mindstreet team), 2022–2026An e-archive chosen by tender and taken through governanceBNP Paribas Personal Finance Nordic needed one e-archive to replace several older archives, and a large body of paper documents made digital. Joakim took it on as technical project manager, as part of the Mindstreet team.Read the case

Papers and studies

  • The same question, three ways One AI model asked 39 regulatory questions, 36 of them with an answer in the law: from memory, with web search, and with MetLex. What each got right, and how long it took.Study · 8 October 2026
  • Answering from the text of the law Eight places where an answer from memory goes wrong on DORA, FFFS and GDPR, and the method that catches them.Being revised; ask for a copy
  • Your AI provider is an ICT third party Buying AI under DORA: the register, the contract minimums, and three ways to run the model.Being revised; ask for a copy

Courses

Talks

Coaching

  • DORA, one to one The person accountable for DORA: the register, impact analysis and recovery times.One session a month

Get in touch

Two lines are enough. You will have an answer by email within two working days.

hello at mettle.se

Book a 45-minute call

What happens to what you send: privacy notice.

Other streams

Leadership and collaborationProduct managementPlatforms and infrastructureTrustworthy AI