Deutsche Bank has built an agentic AI resilience platform on Google Cloud to modernize the regulatory tabletop exercises required under the European Union’s Digital Operational Resiliency Act (DORA). With DORA‘s more explicit, harmonized, and evidence-driven requirements, financial institutions must demonstrate that critical business services and supporting digital infrastructures can withstand disruption, coordinate response, and recover with control. The platform addresses this by assembling enterprise context from architecture, data flows, logs, incident history, alerting signals, and operational telemetry. It then generates scenarios, simulated operational evidence, structured session records, and regulator-ready artifacts from that real-world data, replacing manual preparation with context-aware and evidence-ready simulations.

The design goal is to make tabletop exercises reflect production dependencies, actual operating conditions, and consistent evidence standards. At large banks with interdependent applications, data flows, and third-party services, the shift from static inputs to real enterprise signals is critical. Every scenario is grounded in actual system dependencies, failure patterns, and business impact. The platform uses Gemini Enterprise Agent Platform to migrate operational context into structured scenarios with clear timelines, decision points, and expected responses, ensuring each exercise produces consistent, audit-ready evidence.

A dual-orchestration architecture separates workflows into two complementary execution models. For regulator-aligned execution, LangGraph provides a traceable, deterministic process with clear lineage from input context to output, supporting auditability for supervisory review. For adaptive and investigative scenarios, Google Agent Development Kit (ADK) enables agent-driven coordination that dynamically analyzes conditions and generates responses without predefined execution paths. The two models share a common intelligence layer, so the same agents and tools reason over architecture, data-flow diagrams, logs, and code artifacts across tabletop scenario generation and incident-analysis workflows. This separation combines governed execution with adaptive investigation while preserving a consistent resilience model for both planned exercises and real operational events.

The Google Cloud foundation includes Cloud Run for elastic execution of scenario and evidence-generation services, Gemini Enterprise Agent Platform for transforming operational context into structured resilience scenarios, Google ADK for adaptive agent coordination, and Cloud SQL for durable persistence of scenarios, session artifacts, and review records. Together these services support traceable generation, controlled execution, and persistent evidence records for compliance review and continuous improvement.

Each generated scenario drives a structured tabletop session for response, escalation, and recovery teams. Because exercises are grounded in real enterprise context, they reflect operational reality and strengthen consistency across teams while creating audit-ready evidence. Root-cause analysis acts as a feedback loop between real incidents and future resilience testing: insights from production events inform future scenarios, while exercise outcomes strengthen response playbooks, escalation paths, and recovery readiness. This extends the platform’s value from planned exercises to real operational events, with scenario-based resilience testing remaining the primary use case.

The model is being applied across multiple Deutsche Bank portfolios, establishing more consistent and scalable resilience paradigms and a replicable blueprint for the broader financial sector. The next step is extending the approach into a broader resilience intelligence layer to support playbook refinement, recovery-readiness assessments, and continuous validation of controls against evolving system conditions. As Deutsche Bank‘s Managing Director Sanjay Tripathi puts it, the platform links dynamically generated scenarios to real business context and combines governed orchestration with adaptive analysis to deliver an intelligent, continuously adaptive model for operational resilience.